Nixhost keytabs for non-desktops (#223)

* add age to devshell

* add krb5 keytab for amethyst

* fix: ticket forwarding by enabling GSSAPIDelegateCredentials yes

* fix: GSSAPIDelegateCredentials on desktops only

* add all other non-desktop nix host keytabs

* add todo

Author: jaysa68

flake.nix

@@ -265,6 +265,7 @@
         default = pkgs.mkShell {
           packages = [
             pkgs.git
+	    pkgs.age
             pkgs.agenix-rekey
             pkgs.age-plugin-fido2-hmac
             pkgs.wol

profiles/desktop.nix

@@ -104,4 +104,16 @@ in
   # Needed for generic Linux programs
   # More info: https://nix.dev/guides/faq#how-to-run-non-nix-executables
   programs.nix-ld.enable = true;
+
+  # Enable ticket forwarding on desktops (no password when sshing to other ocf hosts from the desktops thru supernova!)
+  # disabled on everything else bc they dont need to jump through hosts like that...
+  programs.ssh.extraConfig = lib.mkOverride 90 ''
+    CanonicalizeHostname yes
+    CanonicalDomains ocf.berkeley.edu
+    Host *.ocf.berkeley.edu *.ocf.io 169.229.226.* 2607:f140:8801::*
+        GSSAPIAuthentication yes
+        GSSAPIKeyExchange yes
+        GSSAPIDelegateCredentials yes
+  '';
+  # TODO: only forward kerberos tickets to login servers (currently supernova and tsunami)!
 }

secrets/master-keyed/keytabs/adenine.age

@@ -0,0 +1,31 @@
+age-encryption.org/v1
+-> X25519 v86CGNi5g5GB7HfGegSoZKH4IYE6UYuW7O4Qp1XQBEw
+dihtkn1E5Hp9KfrwpFXZbgYsvQrJkjs/qiKFAmv1G64
+-> X25519 7O7Bg+jqRmdoLuwyeYSywn7hNVCnGi9nZNKIIHUCsyg
+TKulo7OydnTnFnLc3O0wSCQG0u3KH+5ftB/uwjaMwyw
+-> X25519 Ugm4wLUijYx0HxzXhBzJcID/AyoAEENw3R/GOeAhWQ0
+gcf5U4zBt7n/JKVT0DFmCGFPSe7hX9q7ZRQ39QMunO4
+-> X25519 sks86NHfXVAad13wF5b+TVpOod3xIJfF1OPbAo4X7Gg
+CmwRGvGmT+2yeAaGRUPLnkwFLCv7b5+0RaSdmF5wvKY
+-> X25519 eaiLusZ1rVAdQwgik0/JgVeaISfHmtLdcLYxKdSxk0s
+Wkk9uEeZV0Hv0XXduWFVRb75gr+vwKyUXOCZZx95fkE
+-> X25519 OfDB8gEUZYrobdcLu5s9oulIgJQXnw9gaabao59VTgQ
+WhhE2aJm0AQylnJqS+hRhOlkK8uJzn14dfk5i6qCuZ8
+-> X25519 REVJFngWWjw7sklDvK7OEOkHMCdgv8+lyVdpsJuelXQ
+sA39hl2OroO1lL9zupLiVBj2hEbNp8AZn526TiSEtd8
+-> X25519 vr1a534JwpFODG5sdIGU7PYxzryfT2ADY2bbmnBxSCk
+/IhpIc4U/2DFduKH0P6cY6Ad1Xn1l/brE09AsLhCZVo
+-> X25519 aNyj/U21JwiD8m3ufCcgQrrnma6qKsOwLCz0sK/KuA4
+XJC83b1O8UZZDJ+wo2/cvem7hhrnD0MQh4pPGgdXA4s
+-> X25519 EF5va1E/0oHsrgFaiE8YSFJU23qFnSgoygW/IgdscB0
+/9d57Ac0VVluue3o7siFOV1kmUrpck2Ti/qd4RGhzOE
+-> X25519 qDRNsbJvMTBGfTq20IkpN2APGSIYVBtRiAVgIR76Alk
+QJjiu1YnDpQYKNEFYgY7DySCZLF2OFW/2Rnt0mS1NP0
+-> X25519 VwauMGDxVnUgHrgvQBbCP2IsZWbrxF03p4ZpzLigVVk
+cROf8nU3o9Y/pzwmsTE0vOvCNRgXUGQr7zQEoSGiSCY
+-> X25519 4e6LaH0Y5hXkfbIEWNMEdp9uIK+E99uwLAQ59MC68Vc
+dl+fQCAdxNt4zS/DivcCIZHLinozu3nxMyCoLbzBrdQ
+--- 6l8SN/q/X9YbV3Ql36NcPTd9M5gg9FQp3Tv14REzJYQ
+��7����%�t��X�
�d��F)�7	�^L8
�ǯl0��{��6�%��
+�����[��!�b��y8� 5bX
+LH��~��r]�Ճ\N柜��G���Ӑa_���	���V$��f���he�$eb?.���uN�9�‡��I��()X��n(�Z�,��X����j	P��f��ij2Ak��nՌHk�����1�*a)I�U.v��d�Ȍ�g��azi�f�	m�:Ha���>��z���bF *sv@�I֞é(�1�������%UEW�;u�mϞ�إ3�k�.��tS�8�kn����8�da�b����{��xM���٤]��

secrets/master-keyed/keytabs/amethyst.age

@@ -0,0 +1,30 @@
+age-encryption.org/v1
+-> X25519 wYiN7JBlYmkCWAqagn0MkDoYle4f3VqH96BdsS6rgl0
++M56m7ktRfXkf2soTW5gkLGeTeDR1VbxJVCSwGjaaPM
+-> X25519 zNCQv8CAmQIeDkq6mHxBNdDT4SeKVK0VJMiukqC0Oyc
+xTtqthljZYXVBq9E/c3jfyXbResVArzqRWFAUU56cv8
+-> X25519 8+mdvWQqPQDQ+VtNN03ZUPruGKNhmdYttPnQoFhAUXE
+BObzEsrr+pbfLREbwThZzsSOcDeo/HgoasybaDO2rVM
+-> X25519 NsaqYGXFiNQlhoeKrcCYxUH8W8ytYXxCRApr86EDYRk
+os9oaCSbHTo8wTz10c3SKsK8oOcZ/QE9kqEm/m27J5c
+-> X25519 N5KU3NANlBWDv1K3XTauKWy4WJyf+VRB5+b21YCN6X0
+K20D/CjLPGDA0wsLoQLFhVkvIwuaCItKexBImLrXtRM
+-> X25519 Amdtdjn2PeIgvTziB5yTdcI8KszYEMu+7jK3qneXs30
+KDds0Mnyz6M3dfBeqh6d9IU6liwxKFn5qLCTUCUP5Ig
+-> X25519 0bpf5pAKGfrwjgsQMZ7gLdaZMgFUtViXI3UlKWzoQ3k
+oYBXtCWXHFNchtvXouBKiKVvLF75YoAQ21zlOvtB/gE
+-> X25519 xtXOFxVkcdPC0osh76066dPZw98qge3nkLKLKL3f2no
+t01sn4J7YsVvuFPZU3kJoWhpcfu2sAtIt362x+Grz/Y
+-> X25519 ZNtwveFjV2sz1B7VQrQQZSS82L3q80R4qy0EHQKejH8
+zQCk4RY/zWzkpSi5FzR1uJzGl692bEi9Qm+jD9XsWYk
+-> X25519 Sd8kf7OSRCutI/r6zr5HlT8SJRMQAHPTDJ2OhKj8yhI
+YNmjWgB+Eu8Swh+JCCi/28XtbEtWPR9z3pPH014smRM
+-> X25519 t5tW20rsHrk/a5skSFunyXfRfaJCSYVvnpJ/4IG1OQg
+Zug75pzzj8IwE1bcuXkLNThW2RpePbKNUl1rEsVYfeQ
+-> X25519 dEJJZvfmAG3KMgDAIrD8xUCIRfBQxhzrRmN27r9ws18
+aUS8UzzhDclzSUGfnzebUa+a+mARrabTfTtTPFXGOw8
+-> X25519 N0Wv20cechyuH/X1zBz4ngEOtpim5UMthLM8xasGGyE
+ekG3X76le9HnDantOEMEB4smsEnKvsy6So7IPXnZbfs
+--- 6MgTeaSGDth06IIsnOLOsgR4Ub65HCrQkvECdHaAt+Q
+�Θ��8vtx��	�Q1ڌ��#W��N��a�P�����=I.7'e1��vt>�^1Mc��pӑ��L���›7�o��Uii�W$�\v~'`�+)��75�C
+�Y�L=H�g�������y��&��p�.��{�1�HC�<�\��n��R�n՜!�ʐ�V�O��~6�G���нE��]��]+���C�Y�dr���2����y��NH��7��)�iW`p�"����ĭ�Q���%7���w؏$���Ll�X��Tž��s��z5IZ�S��Vm,��E�SA|k���]��<#�	�-���f���cp+��Ү�T����m���K@��4qO�zK

secrets/master-keyed/keytabs/cytosine.age

@@ -0,0 +1,30 @@
+age-encryption.org/v1
+-> X25519 +vbxVML5ZVJurbjyUAaasXAhOqS1YHpBy/nT7Ktauzg
+CFGoaKVIJbkMfvOpoN0A9cRemDAW9gmkYhyOzlTzG4M
+-> X25519 toQ77/8wakz03wwgFllllS0DpkRDSZIGdsbyrFVSAEI
+fiLLaoXqK3lxG+q/sNqL2Wg4DXh4+/hxAK7KVzKMrzM
+-> X25519 bL/yFQ9qaEApqNpv5jJb5rH491k8wdalXOxqQGhxyC8
+gVvbXoWjfhBFE4DZ7Vt4r5P5PHgUC3F+nkGjdkfs7v4
+-> X25519 Heby4H3iqfdsfrQS5RTq/g3nYehyEsORAhkHgpWczFY
+W51XC3FPi/v1VXsljk9we7xQfNTAvyMsucrtaMWWwoU
+-> X25519 kpOx9BUWXhayycTtWB8SbPUvo3bOtbeNBQreMxQL5z0
+sih+OJtX8v7M9MrIhE7GT5qPshxwqxFv8L1w7sBBmgA
+-> X25519 6U+C3gaSym+Q4Eh/BdQy1mbk0etyF3tZpa8gWIX68Aw
+M/rbwiJQn7SHoK+2fG/rQ2DEM9f4YnYnPBe63KCqk+U
+-> X25519 s8IMERKPnzMATuLAIEk/uXA53DTm164bysAdjnmqZxA
+FuqA0PhbMR49r0NlbsyTc7YODle0IwEWXsECMnZYZWg
+-> X25519 bOHVETkpCZIca1aSwevtaeGWfFlvB2WuR0qh9cc2sEA
+ytlOmsYsMRn4cseJB5wbf77Xz6w6wGpQXIKJtzzrPv0
+-> X25519 KaP+MSXl7DUxLlJdtJF5q0f12Ks20rAwQBfOl7Lsey8
+49rTmlt8yFHEPNWsKH28sTrcYo9pAS6jOH9dc9DygLg
+-> X25519 bYlRShEj5Ha5wKjAFHUFj7N4PSqDV80pm7nQaBC5mFE
+BhqJcB+R6hvXRSAWZEe5mMorJmpQqv34dAIW6s9rdis
+-> X25519 Gys/Pr9NOmjwdfQZ7UQKH9tufJBM2VOWlv/TwX6z/Qs
+48ILZdiyiRgH/LvCOKnUctxOshKZLFf/UyL1UwG1OtU
+-> X25519 BIGNkggmXO3+nEhdub8Ciy2/1tFgh017Ldx7McjzGH8
+TsIz4gc57eHNcbZGQ057R+FBQwB9u7oCE02p0nXEhnM
+-> X25519 wxvv5NfcfVP393oM8QYQBcXtrHLyCVNEk61Ekr+5FTI
+u3NUc5XZ8cDMa6ADmHUHvAROX0zJS3wRyhNaJP6wNIA
+--- UEkt12v7itMXtMfmiOK8SbdCWH/lINgoSF3oA7hF3Ac
+0,S�����L��iVX:+�2����\�-��Z�l�V^^G������yX)����[���s���?r@lJ:�rP��ڎJ������f��H۪�-���F��O <���Q�d���
+�+4�1i������hɘ\�>�o�(<0�8#�W��r��>��׳ך^j)�VT�jj]�2i���[^u�멗��*�5a������e`n�t��F&I'���$l�����F�Vq�u��^��m�;�	�4�X	ћ��EP�������T����n/�ӄ�L�l�
���{����EY6Q+���C��e1R4D9뺋�ȨMB$�Z�d��iO�i�mi�w��,