From 0c589031c02d6114d05131b249a559e06c802c1f Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 20 Sep 2022 11:17:19 +0200 Subject: krebs: move github modules to subdir --- krebs/3modules/github/default.nix | 6 +++ krebs/3modules/github/hosts-sync.nix | 86 +++++++++++++++++++++++++++++++++++ krebs/3modules/github/known-hosts.nix | 66 +++++++++++++++++++++++++++ 3 files changed, 158 insertions(+) create mode 100644 krebs/3modules/github/default.nix create mode 100644 krebs/3modules/github/hosts-sync.nix create mode 100644 krebs/3modules/github/known-hosts.nix (limited to 'krebs/3modules/github') diff --git a/krebs/3modules/github/default.nix b/krebs/3modules/github/default.nix new file mode 100644 index 000000000..2df4ba717 --- /dev/null +++ b/krebs/3modules/github/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./hosts-sync.nix + ./known-hosts.nix + ]; +} diff --git a/krebs/3modules/github/hosts-sync.nix b/krebs/3modules/github/hosts-sync.nix new file mode 100644 index 000000000..71eed6c69 --- /dev/null +++ b/krebs/3modules/github/hosts-sync.nix @@ -0,0 +1,86 @@ +{ config, lib, pkgs, ... }: + +with import ; +let + cfg = config.krebs.github-hosts-sync; + + out = { + options.krebs.github-hosts-sync = api; + config = lib.mkIf cfg.enable imp; + }; + + api = { + enable = mkEnableOption "krebs.github-hosts-sync"; + dataDir = mkOption { + type = types.str; # TODO path (but not just into store) + default = "/var/lib/github-hosts-sync"; + }; + srcDir = mkOption { + type = types.str; + default = "${config.krebs.tinc.retiolum.confDir}/hosts"; + defaultText = "\${config.krebs.tinc.retiolum.confDir}/hosts"; + }; + ssh-identity-file = mkOption { + type = types.suffixed-str [".ssh.id_ed25519" ".ssh.id_rsa"]; + default = toString ; + defaultText = "‹secrets/github-hosts-sync.ssh.id_ed25519›"; + }; + url = mkOption { + type = types.str; + default = "git@github.com:krebs/hosts.git"; + }; + workTree = mkOption { + type = types.absolute-pathname; + default = "${cfg.dataDir}/cache"; + }; + }; + + imp = { + systemd.services.github-hosts-sync = { + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + environment = { + GITHUB_HOST_SYNC_USER_MAIL = user.mail; + GITHUB_HOST_SYNC_USER_NAME = user.name; + GITHUB_HOST_SYNC_SRCDIR = cfg.srcDir; + GITHUB_HOST_SYNC_WORKTREE = cfg.workTree; + GITHUB_HOST_SYNC_URL = cfg.url; + }; + serviceConfig = { + PermissionsStartOnly = "true"; + SyslogIdentifier = "github-hosts-sync"; + User = user.name; + Type = "oneshot"; + RemainAfterExit = true; + ExecStartPre = pkgs.writeDash "github-hosts-sync-init" '' + set -euf + install -m 0711 -o ${user.name} -d ${cfg.dataDir} + install -m 0700 -o ${user.name} -d ${cfg.dataDir}/.ssh + install -m 0400 -o ${user.name} \ + ${cfg.ssh-identity-file} \ + ${cfg.dataDir}/.ssh/${fileExtension cfg.ssh-identity-file} + ''; + ExecStart = "${pkgs.github-hosts-sync}/bin/github-hosts-sync"; + }; + }; + + users.users.${user.name} = { + inherit (user) uid; + group = user.name; + home = cfg.dataDir; + isSystemUser = true; + }; + }; + + users.groups.${user.name} = {}; + + user = rec { + mail = "${name}@${config.krebs.build.host.name}"; + name = "github-hosts-sync"; + uid = genid_uint31 name; + }; + + # TODO move to lib? + fileExtension = s: last (splitString "." s); + +in out diff --git a/krebs/3modules/github/known-hosts.nix b/krebs/3modules/github/known-hosts.nix new file mode 100644 index 000000000..5de88762a --- /dev/null +++ b/krebs/3modules/github/known-hosts.nix @@ -0,0 +1,66 @@ +{ + services.openssh.knownHosts.github = { + hostNames = [ + "github.com" + # List generated with (IPv6 addresses are currently ignored): + # curl -sS https://api.github.com/meta | jq -r .git[] | grep -v : | nix-shell -p cidr2glob --run cidr2glob | jq -R . + "192.30.252.*" + "192.30.253.*" + "192.30.254.*" + "192.30.255.*" + "185.199.108.*" + "185.199.109.*" + "185.199.110.*" + "185.199.111.*" + "140.82.112.*" + "140.82.113.*" + "140.82.114.*" + "140.82.115.*" + "140.82.116.*" + "140.82.117.*" + "140.82.118.*" + "140.82.119.*" + "140.82.120.*" + "140.82.121.*" + "140.82.122.*" + "140.82.123.*" + "140.82.124.*" + "140.82.125.*" + "140.82.126.*" + "140.82.127.*" + "143.55.64.*" + "143.55.65.*" + "143.55.66.*" + "143.55.67.*" + "143.55.68.*" + "143.55.69.*" + "143.55.70.*" + "143.55.71.*" + "143.55.72.*" + "143.55.73.*" + "143.55.74.*" + "143.55.75.*" + "143.55.76.*" + "143.55.77.*" + "143.55.78.*" + "143.55.79.*" + "20.201.28.151" + "20.205.243.166" + "102.133.202.242" + "20.248.137.48" + "20.207.73.82" + "20.27.177.113" + "20.200.245.247" + "20.233.54.53" + "20.201.28.152" + "20.205.243.160" + "102.133.202.246" + "20.248.137.50" + "20.207.73.83" + "20.27.177.118" + "20.200.245.248" + "20.233.54.52" + ]; + publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; + }; +} -- cgit v1.2.3