From 41a28dc2f536bee24210761d027c5f58e965ef58 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Fri, 1 Mar 2024 17:29:10 +0000 Subject: [PATCH] ops/nixos: tidy up various warnings --- ops/nixos/lib/common.nix | 9 +++++++-- ops/secrets/ssh-agent-pam.pub | 4 ++++ 2 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 ops/secrets/ssh-agent-pam.pub diff --git a/ops/nixos/lib/common.nix b/ops/nixos/lib/common.nix index f4b723dc8d..0be262b0cb 100644 --- a/ops/nixos/lib/common.nix +++ b/ops/nixos/lib/common.nix @@ -154,7 +154,12 @@ in }; environment.homeBinInPath = true; - security.pam.enableSSHAgentAuth = true; + security.pam.sshAgentAuth = { + enable = true; + authorizedKeysFiles = [ + (toString ../../secrets/ssh-agent-pam.pub) + ]; + }; security.pam.ussh = { enable = true; control = "sufficient"; @@ -329,7 +334,7 @@ in services.fwupd.enable = true; # This is enabled independently of my.scrapeJournal.enable. - services.journald.enableHttpGateway = config.my.ip.tailscale != null || config.my.ip.tailscale6 != null; + services.journald.gateway.enable = config.my.ip.tailscale != null || config.my.ip.tailscale6 != null; systemd.sockets.systemd-journal-gatewayd.socketConfig = lib.optionalAttrs (config.my.ip.tailscale != null) { ListenStream = [ "" ] ++ (lib.optional (config.my.ip.tailscale != null) "${config.my.ip.tailscale}:19531") ++ (lib.optional (config.my.ip.tailscale6 != null) "[${config.my.ip.tailscale6}:19531"); FreeBind = true; diff --git a/ops/secrets/ssh-agent-pam.pub b/ops/secrets/ssh-agent-pam.pub new file mode 100644 index 0000000000..981bbcfec5 --- /dev/null +++ b/ops/secrets/ssh-agent-pam.pub @@ -0,0 +1,4 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILid+1rq3k3k7Kbaw8X63vrPrQdanH55TucQwp3ZWfo+ lukegb@porcorosso +sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBAgBXCPpGxeapXvRW8z+/ZFMXvZ9q+Z2mcn5ApCSKqkS7CQjlzTj7Z21/DRQEXQALALLyqfFhcDm1VZkEp/ruBYAAAAEc3NoOg== lukegb@porcorosso +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINytpHct7PLdLNp6MoaOPP7ccBPUQKymVNMqix//Wt1f termius +cert-authority,principals="lukegb" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEqNOwlR7Qa8cbGpDfSCOweDPbAGQOZIcoRgh6s/J8DR vault-clients