forked from mirrors/nixpkgs
Merge pull request #110784 from talyz/gce-fetch-ssh-keys
google-compute-config: Reintroduce fetch-ssh-keys
This commit is contained in:
commit
d0be6dcd70
36
nixos/modules/virtualisation/fetch-instance-ssh-keys.bash
Normal file
36
nixos/modules/virtualisation/fetch-instance-ssh-keys.bash
Normal file
|
@ -0,0 +1,36 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
WGET() {
|
||||||
|
wget --retry-connrefused -t 15 --waitretry=10 --header='Metadata-Flavor: Google' "$@"
|
||||||
|
}
|
||||||
|
|
||||||
|
# When dealing with cryptographic keys, we want to keep things private.
|
||||||
|
umask 077
|
||||||
|
mkdir -p /root/.ssh
|
||||||
|
|
||||||
|
echo "Fetching authorized keys..."
|
||||||
|
WGET -O /tmp/auth_keys http://metadata.google.internal/computeMetadata/v1/instance/attributes/sshKeys
|
||||||
|
|
||||||
|
# Read keys one by one, split in case Google decided
|
||||||
|
# to append metadata (it does sometimes) and add to
|
||||||
|
# authorized_keys if not already present.
|
||||||
|
touch /root/.ssh/authorized_keys
|
||||||
|
while IFS='' read -r line || [[ -n "$line" ]]; do
|
||||||
|
keyLine=$(echo -n "$line" | cut -d ':' -f2)
|
||||||
|
IFS=' ' read -r -a array <<<"$keyLine"
|
||||||
|
if [[ ${#array[@]} -ge 3 ]]; then
|
||||||
|
echo "${array[@]:0:3}" >>/tmp/new_keys
|
||||||
|
echo "Added ${array[*]:2} to authorized_keys"
|
||||||
|
fi
|
||||||
|
done </tmp/auth_keys
|
||||||
|
mv /tmp/new_keys /root/.ssh/authorized_keys
|
||||||
|
chmod 600 /root/.ssh/authorized_keys
|
||||||
|
|
||||||
|
echo "Fetching host keys..."
|
||||||
|
WGET -O /tmp/ssh_host_ed25519_key http://metadata.google.internal/computeMetadata/v1/instance/attributes/ssh_host_ed25519_key
|
||||||
|
WGET -O /tmp/ssh_host_ed25519_key.pub http://metadata.google.internal/computeMetadata/v1/instance/attributes/ssh_host_ed25519_key_pub
|
||||||
|
mv -f /tmp/ssh_host_ed25519_key* /etc/ssh/
|
||||||
|
chmod 600 /etc/ssh/ssh_host_ed25519_key
|
||||||
|
chmod 644 /etc/ssh/ssh_host_ed25519_key.pub
|
|
@ -69,6 +69,31 @@ in
|
||||||
# GC has 1460 MTU
|
# GC has 1460 MTU
|
||||||
networking.interfaces.eth0.mtu = 1460;
|
networking.interfaces.eth0.mtu = 1460;
|
||||||
|
|
||||||
|
# Used by NixOps
|
||||||
|
systemd.services.fetch-instance-ssh-keys = {
|
||||||
|
description = "Fetch host keys and authorized_keys for root user";
|
||||||
|
|
||||||
|
wantedBy = [ "sshd.service" ];
|
||||||
|
before = [ "sshd.service" ];
|
||||||
|
after = [ "network-online.target" ];
|
||||||
|
wants = [ "network-online.target" ];
|
||||||
|
path = [ pkgs.wget ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
ExecStart = pkgs.runCommand "fetch-instance-ssh-keys" { } ''
|
||||||
|
cp ${./fetch-instance-ssh-keys.bash} $out
|
||||||
|
chmod +x $out
|
||||||
|
${pkgs.shfmt}/bin/shfmt -i 4 -d $out
|
||||||
|
${pkgs.shellcheck}/bin/shellcheck $out
|
||||||
|
patchShebangs $out
|
||||||
|
'';
|
||||||
|
PrivateTmp = true;
|
||||||
|
StandardError = "journal+console";
|
||||||
|
StandardOutput = "journal+console";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
systemd.services.google-instance-setup = {
|
systemd.services.google-instance-setup = {
|
||||||
description = "Google Compute Engine Instance Setup";
|
description = "Google Compute Engine Instance Setup";
|
||||||
after = [ "network-online.target" "network.target" "rsyslog.service" ];
|
after = [ "network-online.target" "network.target" "rsyslog.service" ];
|
||||||
|
|
Loading…
Reference in a new issue