jasmine
8874c88fbc
Fixes backup system authentication and hostname resolution issues. Changes: - Change PermitRootLogin from "no" to "prohibit-password" in global SSH config (allows key-based root login for host-to-host backups while blocking passwords) - Update fuchsia onsite backup to use viridian.home.arpa FQDN instead of shortname - Update SSH knownHosts to use FQDNs (fuchsia.home.arpa, viridian.home.arpa) (system-level config uses FQDNs, user shortcuts remain in home-manager) This enables the complete 3-2-1 backup strategy with automated backups working correctly between fuchsia and viridian, and fuchsia to BorgBase.
29 lines
984 B
Nix
29 lines
984 B
Nix
{inputs, ...}: let
|
|
# Fuchsia's host key for backup authentication
|
|
fuchsiaHostKey = builtins.readFile (
|
|
"${inputs.self}/nixos/fuchsia/ssh_host_ed25519_key.pub"
|
|
);
|
|
in {
|
|
# Trust fuchsia's host keys for SSH connections (system-level, uses FQDN)
|
|
programs.ssh.knownHosts = {
|
|
"fuchsia-ed25519" = {
|
|
hostNames = ["fuchsia.home.arpa"];
|
|
publicKeyFile = "${inputs.self}/nixos/fuchsia/ssh_host_ed25519_key.pub";
|
|
};
|
|
"fuchsia-rsa" = {
|
|
hostNames = ["fuchsia.home.arpa"];
|
|
publicKeyFile = "${inputs.self}/nixos/fuchsia/ssh_host_rsa_key.pub";
|
|
};
|
|
};
|
|
|
|
# Trust BorgBase repository (offsite backup target)
|
|
programs.ssh.knownHostsFiles = [
|
|
./borgbase_hosts
|
|
];
|
|
|
|
# Accept remote backups from fuchsia using host key authentication
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
# Restrict fuchsia to only run borg serve in /srv/borg-repo
|
|
''command="borg serve --restrict-to-path /srv/borg-repo",restrict ${fuchsiaHostKey}''
|
|
];
|
|
}
|