This repository has no description
configs.kartei: drop krebs.users
The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's
key for the download user. ssh.pub now lists every key lass logs in
with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's
key is read from kartei directly.
author
lassulus
date
(Oct 7, 2026, 1:35 AM CEST)
commit
38937c4f
38937c4fef397a054b273515624e988dd7994138
parent
037fe687
037fe68771a38cb6efed1335be3bb16a57292764
+12
-29
+2
-2
configs/download-user.nix
+2
-2
configs/download-user.nix
···
1
-
{ self, config, ... }:
1
+
{ self, ... }:
2
2
{
3
3
users.users.download = {
4
4
isNormalUser = true;
···
16
16
self.keys.ssh.xerxes.public
17
17
self.keys.ssh.ignavia.public
18
18
self.keys.ssh.massulus.public
19
-
config.krebs.users.makefu.pubkey
19
+
self.inputs.kartei.users.makefu.pubkey
20
20
];
21
21
};
22
22
+3
-22
configs/kartei.nix
+3
-22
configs/kartei.nix
···
1
-
# Host and user data from the kartei flake input, rendered straight into
2
-
# NixOS options; stockholm's krebs.hosts (and its hosts/ssh/build modules) is
3
-
# not used. Hosts are kartei's plus the superconfig-only cards in ../retiolum.
4
-
# Our own users are defined here from ../keys, not taken from kartei.
1
+
# Host data from the kartei flake input, rendered straight into NixOS
2
+
# options; stockholm's krebs.hosts (and its hosts/ssh/build modules) is not
3
+
# used. Hosts are kartei's plus the superconfig-only cards in ../retiolum.
5
4
{
6
5
config,
7
6
lib,
···
36
35
37
36
allNets = lib.concatMap (host: lib.attrValues (host.nets or { })) (lib.attrValues hosts);
38
37
39
-
ownUsers = {
40
-
lass = {
41
-
mail = "lass@green.r";
42
-
pgp.pubkeys.default = builtins.readFile ../keys/pgp/yubi_pgp.pgp;
43
-
pubkey = lib.removeSuffix "\n" (builtins.readFile ../keys/ssh/yubi_pgp.pub);
44
-
};
45
-
};
46
38
in
47
39
{
48
-
options.krebs.users = lib.mkOption {
49
-
type = lib.types.attrsOf self.inputs.stockholm.lib.types.user;
50
-
};
51
-
52
40
config = {
53
41
networking.hosts = lib.filterAttrs (_: names: names != [ ]) (
54
42
lib.zipAttrsWith (_: lib.concatLists) (
···
93
81
Port ${toString (sshPort net)}
94
82
'') (lib.filter (net: sshPort net != 22) allNets)
95
83
);
96
-
97
-
# drop null fields so they keep the krebs.users type defaults
98
-
krebs.users =
99
-
lib.mapAttrs (_: lib.filterAttrs (_: v: v != null)) (
100
-
removeAttrs kartei.users (lib.attrNames ownUsers)
101
-
)
102
-
// ownUsers;
103
84
};
104
85
}
+1
-1
configs/red-host.nix
+1
-1
configs/red-host.nix
+4
-2
configs/websites/lassulus.nix
+4
-2
configs/websites/lassulus.nix
···
1
1
{
2
2
self,
3
3
config,
4
+
lib,
4
5
pkgs,
5
6
...
6
7
}:
···
47
48
locations."= /wireguard-key".extraConfig = ''
48
49
alias ${pkgs.writeText "neoprism.wg" self.inputs.kartei.hosts.neoprism.nets.wiregrill.wireguard.pubkey};
49
50
'';
51
+
# the keys lass logs in with, one per line
50
52
locations."= /ssh.pub".extraConfig = ''
51
-
alias ${pkgs.writeText "pub" config.krebs.users.lass.pubkey};
53
+
alias ${pkgs.writeText "ssh.pub" (lib.concatLines config.users.users.mainUser.openssh.authorizedKeys.keys)};
52
54
'';
53
55
locations."= /gpg.pub".extraConfig = ''
54
-
alias ${pkgs.writeText "pub" config.krebs.users.lass.pgp.pubkeys.default};
56
+
alias ${self.keys.pgp.yubi_pgp.key};
55
57
'';
56
58
locations."= /ip".extraConfig = ''
57
59
return 200 '$remote_addr';
+1
-1
machines/icarus/config.nix
+1
-1
machines/icarus/config.nix