31 lines
938 B
Nix
31 lines
938 B
Nix
{ lib, settings, age, pkgs, ... } @ args:
|
|
{
|
|
# We always want a standard ssh key-pair used for secret management, create it if not there.
|
|
home.activation.generateSshKey = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
|
|
if [ ! -f $HOME/.ssh/id_ed25519 ]; then
|
|
if [ -v DRY_RUN ]; then
|
|
echo "DRY_RUN is set. Would generate SSH key for ${settings.user.username}."
|
|
else
|
|
echo "Generating SSH key for ${settings.user.username}."
|
|
mkdir -p $HOME/.ssh
|
|
chmod 700 $HOME/.ssh
|
|
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $HOME/.ssh/id_ed25519 -N ""
|
|
fi
|
|
else
|
|
echo "SSH key already exists for ${settings.user.username}."
|
|
fi
|
|
'';
|
|
|
|
programs.ssh = {
|
|
enable = true;
|
|
matchBlocks = {
|
|
"github.com" = {
|
|
identityFile = age.secrets.nix2github.path;
|
|
};
|
|
"bitbucket.org" = {
|
|
identityFile = age.secrets.nix2bitbucket.path;
|
|
};
|
|
};
|
|
};
|
|
}
|
|
|