From 8fa2e787f1400fd636983c9865ce0ef6cd3d193d Mon Sep 17 00:00:00 2001 From: Taeer Bar-Yam Date: Wed, 19 Jan 2022 08:48:41 -0500 Subject: [PATCH 1/4] modules/programs/ssh: knownHosts -> extraKnownHosts --- nixos/modules/programs/ssh.nix | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix index 35380f864208..6086abfc2380 100644 --- a/nixos/modules/programs/ssh.nix +++ b/nixos/modules/programs/ssh.nix @@ -17,7 +17,7 @@ let exec ${askPassword} "$@" ''; - knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts); + knownHosts = attrValues cfg.knownHosts; knownHostsText = (flip (concatMapStringsSep "\n") knownHosts (h: assert h.hostNames != []; @@ -142,7 +142,7 @@ in knownHosts = mkOption { default = {}; - type = types.attrsOf (types.submodule ({ name, ... }: { + type = types.attrsOf (types.submodule ({ name, config, ... }: { options = { certAuthority = mkOption { type = types.bool; @@ -154,12 +154,21 @@ in }; hostNames = mkOption { type = types.listOf types.str; - default = []; + default = [ name ] ++ config.extraHostNames; description = '' + DEPRECATED, please use extraHostNames. A list of host names and/or IP numbers used for accessing the host's ssh service. ''; }; + extraHostNames = mkOption { + type = types.listOf types.str; + default = []; + description = '' + A list of additional host names and/or IP numbers used for + accessing the host's ssh service. + ''; + }; publicKey = mkOption { default = null; type = types.nullOr types.str; @@ -186,9 +195,6 @@ in ''; }; }; - config = { - hostNames = mkDefault [ name ]; - }; })); description = '' The set of system-wide known SSH hosts. @@ -196,13 +202,10 @@ in example = literalExpression '' { myhost = { - hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ]; + extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ]; publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub; }; - myhost2 = { - hostNames = [ "myhost2" ]; - publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub; - }; + "myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK"; } ''; }; @@ -275,6 +278,9 @@ in message = "knownHost ${name} must contain either a publicKey or publicKeyFile"; }); + warnings = mapAttrsToList (name: _: ''programs.ssh.knownHosts.${name}.hostNames is deprecated use programs.ssh.knownHosts.${name}.extraHostNames'') + (filterAttrs (name: {hostNames, extraHostNames, ...}: hostNames != [ name ] ++ extraHostNames) cfg.knownHosts); + # SSH configuration. Slight duplication of the sshd_config # generation in the sshd service. environment.etc."ssh/ssh_config".text = From aa99bd69f0fb2ea5d7e6ff99af3a01c1209857f7 Mon Sep 17 00:00:00 2001 From: Taeer Bar-Yam Date: Wed, 19 Jan 2022 09:38:13 -0500 Subject: [PATCH 2/4] fix punctuation Co-authored-by: pennae <82953136+pennae@users.noreply.github.com> --- nixos/modules/programs/ssh.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix index 6086abfc2380..f2d02362a0a8 100644 --- a/nixos/modules/programs/ssh.nix +++ b/nixos/modules/programs/ssh.nix @@ -278,7 +278,7 @@ in message = "knownHost ${name} must contain either a publicKey or publicKeyFile"; }); - warnings = mapAttrsToList (name: _: ''programs.ssh.knownHosts.${name}.hostNames is deprecated use programs.ssh.knownHosts.${name}.extraHostNames'') + warnings = mapAttrsToList (name: _: ''programs.ssh.knownHosts.${name}.hostNames is deprecated, use programs.ssh.knownHosts.${name}.extraHostNames'') (filterAttrs (name: {hostNames, extraHostNames, ...}: hostNames != [ name ] ++ extraHostNames) cfg.knownHosts); # SSH configuration. Slight duplication of the sshd_config From 552b80dc51d4c9ad383f95a01ff18ad02134bb79 Mon Sep 17 00:00:00 2001 From: Taeer Bar-Yam Date: Wed, 19 Jan 2022 09:39:50 -0500 Subject: [PATCH 3/4] add defaultText Co-authored-by: pennae <82953136+pennae@users.noreply.github.com> --- nixos/modules/programs/ssh.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix index f2d02362a0a8..b31fce915240 100644 --- a/nixos/modules/programs/ssh.nix +++ b/nixos/modules/programs/ssh.nix @@ -142,7 +142,7 @@ in knownHosts = mkOption { default = {}; - type = types.attrsOf (types.submodule ({ name, config, ... }: { + type = types.attrsOf (types.submodule ({ name, config, options, ... }: { options = { certAuthority = mkOption { type = types.bool; @@ -155,6 +155,7 @@ in hostNames = mkOption { type = types.listOf types.str; default = [ name ] ++ config.extraHostNames; + defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}"; description = '' DEPRECATED, please use extraHostNames. A list of host names and/or IP numbers used for accessing From 989fd06cb82e17c9700443269b0595d730140cd9 Mon Sep 17 00:00:00 2001 From: pennae Date: Wed, 19 Jan 2022 17:21:11 +0100 Subject: [PATCH 4/4] nixos/ssh: add release notes for extraHostNames option --- .../doc/manual/from_md/release-notes/rl-2205.section.xml | 9 +++++++++ nixos/doc/manual/release-notes/rl-2205.section.md | 3 +++ 2 files changed, 12 insertions(+) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index 34e31b6e505e..dc2373c7a266 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -512,6 +512,15 @@ usage in non-X11 environments, e.g. Wayland. + + + programs.ssh.knownHosts + has gained an extraHostNames option to + replace hostNames. + hostNames is deprecated, but still + available for now. + + The services.stubby module was converted to diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index 068984d0e151..6754b3adb886 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -180,6 +180,9 @@ In addition to numerous new and upgraded packages, this release has the followin `services.xserver.enable`. This allows easy usage in non-X11 environments, e.g. Wayland. +- [programs.ssh.knownHosts](#opt-programs.ssh.knownHosts) has gained an `extraHostNames` + option to replace `hostNames`. `hostNames` is deprecated, but still available for now. + - The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration. - The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files.