Reuse ssh-keys for non-critical-infra
Creates the `infra` key list and migrates hetzner-01 to run with it. The wrong keys were deployed for me, so I had to access the host using the keypair I use for GitHub. Fetching keys from GitHub is not great for key hygiene and did in fact cause a hash mismatch on Julien's keys.
Martin Weinelt committed
Sep 10, 2023 at 22:59 UTC
083723ea6de2ecd5d7abc430aad2ef3462781e4f
2 files changed
+13
-14
non-critical-infra/hosts/hetzner-01/default.nix
+9
-14
@@ -44,20 +44,15 @@
44
45
systemd.network.networks."10-uplink".networkConfig.Address = "2a01:4f9:5a:186c::2";
46
47
- users.users.root.openssh.authorizedKeys.keyFiles = [
48
- (pkgs.fetchurl {
49
- url = "https://github.com/JulienMalka.keys";
50
- sha256 = "sha256-yH84N5aPt9MJDuvaDf9BvnM+z9yaUKYxU7W2Bf89174=";
51
- })
52
- (pkgs.fetchurl {
53
- url = "https://github.com/zimbatm.keys";
54
- sha256 = "sha256-QEOYK1aoF626VTTjlcFtY020NSCfiCnBRQfrNfl0j5s=";
55
- })
56
- (pkgs.fetchurl {
57
- url = "https://github.com/mweinelt.keys";
58
- sha256 = "sha256-gAD2jUc5SBWuuiRGgJEmb0I7rR/jti1FMxVuA0BtILk=";
59
- })
60
- ];
47
+ users.users.root.openssh.authorizedKeys = {
48
+ keyFiles = [
49
+ (pkgs.fetchurl {
50
+ url = "https://github.com/JulienMalka.keys";
51
+ hash = "sha256-glt0tL13aqC00/Bu+13xZbOGqeNlYx5oElLwfYs7knY=";
52
+ })
53
+ ];
54
+ keys = (import ../../../ssh-keys.nix).infra;
55
+ };
56
57
system.stateVersion = "23.05";
58
ssh-keys.nix
+4
@@ -26,4 +26,8 @@ rec {
26
hexa-helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFSpdtIxIBFtd7TLrmIPmIu5uemAFJx4sNslRsJXfFxr hexa@helix";
27
28
infra-core = [ eelco graham graham-hermes-conrad zimbatm amine vcunat ];
29
+ infra = infra-core ++ [
30
+ hexa-gaia
31
+ hexa-helix
32
+ ];
33
}