ssh: dynamically generate known_hosts for all hosts (#362)

Author: 24apricots

modules/auth.nix

@@ -9,6 +9,33 @@ let
   cfg = config.ocf.auth;
   keytabSecretPath = ../secrets/master-keyed/keytabs + "/${config.networking.hostName}.age";
   hasKeytab = builtins.pathExists keytabSecretPath;
+
+  # sort for regular *.pub files
+  hostKeyDir = ../secrets/host-keys;
+  hostKeyFiles = lib.filterAttrs (
+    filename: filetype: lib.hasSuffix ".pub" filename && filetype == "regular"
+  ) (builtins.readDir hostKeyDir);
+
+  # remove .pub suffix and set the value for each host to the attribute sets
+  # that programs.ssh.knownHosts expects
+  knownHosts = lib.concatMapAttrs (
+    name: value:
+    let
+      host = lib.removeSuffix ".pub" name;
+    in
+    {
+      ${host} = {
+        # TODO: add *.ocf.io and ip addresses, but i want to clean up those values
+        # into a centrally accessible place like networking.domain first
+        # add fqdn
+        hostNames = [
+          host
+          "${host}.${config.networking.domain}"
+        ];
+        publicKeyFile = "${hostKeyDir}/${name}";
+      };
+    }
+  ) hostKeyFiles;
 in
 {
   options.ocf.auth = {
@@ -145,6 +172,13 @@ in
       };
     };
 
+    # dynamically generate the known_hosts file with the public keys of all
+    # nix hosts and directly put it on each host:
+    # - this approach is really simple and avoids the need for managing a cert
+    #   authority.
+    # - one drawback is that hosts need to be re-deployed to in order to
+    #   add/change a host public key.
+    programs.ssh.knownHosts = knownHosts;
     services.openssh.settings = {
       GSSAPIAuthentication = "yes";
       GSSAPICleanupCredentials = "yes";