From bdc1c12f9c0a053edbbbe688c35c6dded7561fa5 Mon Sep 17 00:00:00 2001
From: Simon Bruder <simon@sbruder.de>
Date: Sat, 5 Dec 2020 16:42:49 +0100
Subject: [PATCH] Refactor pubkey configuration

---
 modules/default.nix     |  1 +
 modules/pubkeys.nix     | 31 +++++++++++++++++++++++++++++--
 modules/ssh.nix         |  9 ++-------
 users/simon/default.nix |  8 +-------
 4 files changed, 33 insertions(+), 16 deletions(-)

diff --git a/modules/default.nix b/modules/default.nix
index ba6cffe..561365c 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -23,6 +23,7 @@
     ./network-manager.nix
     ./office.nix
     ./prometheus/node_exporter.nix
+    ./pubkeys.nix
     ./pulseaudio.nix
     ./restic.nix
     ./ssd.nix
diff --git a/modules/pubkeys.nix b/modules/pubkeys.nix
index 98243c0..6a0f16d 100644
--- a/modules/pubkeys.nix
+++ b/modules/pubkeys.nix
@@ -1,4 +1,31 @@
+{ config, lib, ... }:
+let
+  cfg = config.sbruder.pubkeys;
+in
 {
-  "simon@nunotaba" = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwMo0mYcTU1Y4BKpEUsvKAtcTPq3ylKaw+ZjUxNg9VqU5gDy2TDUfWk2FjM2VYcqQJ9ZaNGKE1S18fRU7ZHrcgtFPMgAuji87yOKojH74cwz9ZRf5ZiluWBmR3dFd7kddqHUKVS8utpiQuTLIyQwpgmUHA81IasWXuB2pHaI6HGntMlJTm1CvpcQvwKsDBqJ2bFjFMk6EDgAZWXyooQgthYAfmc+YfAX5T9fWKiqFnEJ0ryN3/RngJZe65HWV8WZwY1CxgKQhOZuRcPdkTEQlUk9Qu0JbVa2sTgdYDpw/Dz0ma+h4rxOrH63MD6Cf0pFgOwLeZVSmXqKTjXVaH1QkHWRat88J8Q6MM6LlhLx/48VcQshhIssAZ37YoW2W0NxnGSM7YtlwTVe+w7rU//cS5TyIQa4joq2pnIh4uurbNkIULa4Q2t2nEMzlqI9gEE9DK1ctOcuCyFOerNZD0yRZ5Rs8WouDLL1PR6ps4czK2N7h2MXABcELuVwX+sdxwFgf6AJaRvrlw4qIOohpeX48FhzZfcI9Cqvnakm+O42J3qXuUDVc6/NjE9zBku3dNaeseGv9CQxtvyVDq6o9MRDiFror3yEiN0Fwou7CXBfXrbeb7MvahsRxSKkSDY0uA+AXmsm1UwdArjEcEMsS1JeFQCdX1yR/Z5xzj2gx60NcR4w==";
-  "simon@sayuri" = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1kQUoPII8A9/bgPA+OrZGQLPA8MxkdmPSCCsfGMh9qRZfF7BSD8W6VdE/28tLw+39QeUl1+/9VuVvGjZBP1zBAbKIcKx4DjtgxpNXCsfWMjXFtpTGk2dyl71CaY5n72YlADxXYwtEvuwfNixgE2yTCefMbBsfwqYC0GZGiDlFtjxdg+RuUC8jU++C+WFUFct9gj9ieQ0LWjud+Oh0AF0JhyGnou+wVZIIO8mwo7Cc5xiPldXhbc13XiNC3mpNGCLFj+nh1feazk8TeAVDBps6xaDkOd+hDwTBQh8LoimePK7MiShzLvC38Vd/sim5ym/IqY634CjqBDGCMp1KXnqHUTT8CqeifMv10+aRJKUPevVkO3nEE3VoSPt7Ui9ZzLnL4qhZyygoBau+PvD2WCWm+gRwBkvU1uNrYKi4HIGhB/gXcYHKJimqJwLMyqG5Wv1jfuhn3ZZN+uNqTgdAznGgPRU1Q/Mx6nMEDiQip78qdYEc0YGwdb/TldEL6aHRjuNuZPpTW+zakQHiQTRb/0VdZT1bAwyT9yL0Uf40h706Kh/pKiSQ1yq1dlSdl3RlfedbqLqGjspds1iRSrSXyH2MBghPbz/SF7Vt4LW/tXF0rcyV7CU98ZvxJDWeN60OE0vPf/AT5udYyfPO1691y0F8jGKxGYYPg9R/Y5o7J24PbQ== simon@sayuri";
+  options.sbruder.pubkeys = {
+    keys = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      description = "Known public keys that can be used in the configuration";
+      default = {
+        "simon@nunotaba" = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwMo0mYcTU1Y4BKpEUsvKAtcTPq3ylKaw+ZjUxNg9VqU5gDy2TDUfWk2FjM2VYcqQJ9ZaNGKE1S18fRU7ZHrcgtFPMgAuji87yOKojH74cwz9ZRf5ZiluWBmR3dFd7kddqHUKVS8utpiQuTLIyQwpgmUHA81IasWXuB2pHaI6HGntMlJTm1CvpcQvwKsDBqJ2bFjFMk6EDgAZWXyooQgthYAfmc+YfAX5T9fWKiqFnEJ0ryN3/RngJZe65HWV8WZwY1CxgKQhOZuRcPdkTEQlUk9Qu0JbVa2sTgdYDpw/Dz0ma+h4rxOrH63MD6Cf0pFgOwLeZVSmXqKTjXVaH1QkHWRat88J8Q6MM6LlhLx/48VcQshhIssAZ37YoW2W0NxnGSM7YtlwTVe+w7rU//cS5TyIQa4joq2pnIh4uurbNkIULa4Q2t2nEMzlqI9gEE9DK1ctOcuCyFOerNZD0yRZ5Rs8WouDLL1PR6ps4czK2N7h2MXABcELuVwX+sdxwFgf6AJaRvrlw4qIOohpeX48FhzZfcI9Cqvnakm+O42J3qXuUDVc6/NjE9zBku3dNaeseGv9CQxtvyVDq6o9MRDiFror3yEiN0Fwou7CXBfXrbeb7MvahsRxSKkSDY0uA+AXmsm1UwdArjEcEMsS1JeFQCdX1yR/Z5xzj2gx60NcR4w==";
+        "simon@sayuri" = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1kQUoPII8A9/bgPA+OrZGQLPA8MxkdmPSCCsfGMh9qRZfF7BSD8W6VdE/28tLw+39QeUl1+/9VuVvGjZBP1zBAbKIcKx4DjtgxpNXCsfWMjXFtpTGk2dyl71CaY5n72YlADxXYwtEvuwfNixgE2yTCefMbBsfwqYC0GZGiDlFtjxdg+RuUC8jU++C+WFUFct9gj9ieQ0LWjud+Oh0AF0JhyGnou+wVZIIO8mwo7Cc5xiPldXhbc13XiNC3mpNGCLFj+nh1feazk8TeAVDBps6xaDkOd+hDwTBQh8LoimePK7MiShzLvC38Vd/sim5ym/IqY634CjqBDGCMp1KXnqHUTT8CqeifMv10+aRJKUPevVkO3nEE3VoSPt7Ui9ZzLnL4qhZyygoBau+PvD2WCWm+gRwBkvU1uNrYKi4HIGhB/gXcYHKJimqJwLMyqG5Wv1jfuhn3ZZN+uNqTgdAznGgPRU1Q/Mx6nMEDiQip78qdYEc0YGwdb/TldEL6aHRjuNuZPpTW+zakQHiQTRb/0VdZT1bAwyT9yL0Uf40h706Kh/pKiSQ1yq1dlSdl3RlfedbqLqGjspds1iRSrSXyH2MBghPbz/SF7Vt4LW/tXF0rcyV7CU98ZvxJDWeN60OE0vPf/AT5udYyfPO1691y0F8jGKxGYYPg9R/Y5o7J24PbQ==";
+      };
+    };
+    trustedNames = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "Names of trusted public keys, used to generate <literal>sbruder.pubkeys.trustedKeys</literal>";
+      default = [
+        "simon@nunotaba"
+        "simon@sayuri"
+      ];
+    };
+    trustedKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "Trusted public keys, automatically generated from <literal>sbruder.pubkeys.trustedNames</literal>";
+      default = builtins.map
+        (name: cfg.keys."${name}")
+        cfg.trustedNames;
+    };
+  };
 }
diff --git a/modules/ssh.nix b/modules/ssh.nix
index 4fce225..a19c5d2 100644
--- a/modules/ssh.nix
+++ b/modules/ssh.nix
@@ -1,7 +1,4 @@
-{ ... }:
-let
-  pubkeys = import ./pubkeys.nix;
-in
+{ config, ... }:
 {
   services.openssh = {
     enable = true;
@@ -9,7 +6,5 @@ in
     passwordAuthentication = false;
   };
 
-  users.users.root.openssh.authorizedKeys.keys = [
-    pubkeys."simon@nunotaba"
-  ];
+  users.users.root.openssh.authorizedKeys.keys = config.sbruder.pubkeys.trustedKeys;
 }
diff --git a/users/simon/default.nix b/users/simon/default.nix
index e0b70da..b4a4291 100644
--- a/users/simon/default.nix
+++ b/users/simon/default.nix
@@ -1,7 +1,4 @@
 { config, pkgs, ... }:
-let
-  pubkeys = import ../../modules/pubkeys.nix;
-in
 {
   imports = [
     (import "${builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-20.09.tar.gz"}/nixos")
@@ -19,10 +16,7 @@ in
       "video"
       "wheel"
     ];
-    openssh.authorizedKeys.keys = [
-      pubkeys."simon@nunotaba"
-      pubkeys."simon@sayuri"
-    ];
+    openssh.authorizedKeys.keys = config.sbruder.pubkeys.trustedKeys;
   };
 
   home-manager.useUserPackages = true;