jory
582faec359
- Replace age-based key decryption with automatic SSH host key support - Simplify SSH configuration with consolidated host entries and enhanced security settings - Upgrade home-manager to himmelblau for Microsoft Entra ID authentication - Remove legacy agenix inputs and consolidate secrets to essential services only - Add Cisco Secure Client overlay for enterprise VPN capabilities - Update secrets.yaml to minimal configuration with gitea/github/hetzner services - Expand system packages with tun module for VPN connectivity - Add work directory setup for user development environment
56 lines
1.2 KiB
Nix
56 lines
1.2 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
...
|
|
}: {
|
|
users.users.someone.packages = with pkgs; [
|
|
openssh
|
|
];
|
|
|
|
home.file.".ssh/config".text = ''
|
|
AddKeysToAgent yes
|
|
CheckHostIP yes
|
|
Compression no
|
|
ControlMaster no
|
|
ControlPath ~/.ssh/master-%r@%n:%p
|
|
ControlPersist no
|
|
HashKnownHosts yes
|
|
IdentitiesOnly yes
|
|
PasswordAuthentication no
|
|
ForwardAgent no
|
|
ForwardX11 no
|
|
ForwardX11Trusted no
|
|
ServerAliveInterval 60
|
|
ServerAliveCountMax 3
|
|
UserKnownHostsFile ~/.ssh/known_hosts
|
|
|
|
Host git.severijnse.eu
|
|
HostName git.severijnse.eu
|
|
Port 222
|
|
User git
|
|
IdentityFile /run/secrets/gitea_laptop
|
|
|
|
Host hetzner
|
|
HostName severijnse.eu
|
|
User admin
|
|
IdentityFile /run/secrets/hetzner_server
|
|
|
|
Host github.com
|
|
HostName github.com
|
|
User git
|
|
IdentityFile /run/secrets/github_laptop
|
|
|
|
Include ~/.ssh/config.d/*
|
|
'';
|
|
|
|
systemd.user.services.ssh-agent = {
|
|
description = "SSH agent service";
|
|
wantedBy = ["default.target"];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
ExecStart = "${pkgs.openssh}/bin/ssh-agent -D -a ${config.xdg.runtimeDir}/ssh-agent.socket";
|
|
Restart = "on-failure";
|
|
};
|
|
};
|
|
}
|