google-compute-image.nix: Try to download all SSH host keys from metadata server.
This commit is contained in:
parent
3251948029
commit
d1a58ef7c6
|
@ -152,14 +152,26 @@ in
|
||||||
rm -f /root/key.pub /root/authorized-keys-metadata
|
rm -f /root/key.pub /root/authorized-keys-metadata
|
||||||
fi
|
fi
|
||||||
|
|
||||||
echo "obtaining SSH private host key..."
|
countKeys=0
|
||||||
${wget} -O /root/ssh_host_ecdsa_key http://metadata/0.1/meta-data/attributes/ssh_host_ecdsa_key
|
${flip concatMapStrings config.services.openssh.hostKeys (k :
|
||||||
if [ $? -eq 0 -a -e /root/ssh_host_ecdsa_key ]; then
|
let kName = baseNameOf k.path; in ''
|
||||||
mv -f /root/ssh_host_ecdsa_key /etc/ssh/ssh_host_ecdsa_key
|
echo "trying to obtain SSH private host key ${kName}"
|
||||||
echo "downloaded ssh_host_ecdsa_key"
|
${wget} -O /root/${kName} http://metadata/0.1/meta-data/attributes/${kName} && :
|
||||||
chmod 600 /etc/ssh/ssh_host_ecdsa_key
|
if [ $? -eq 0 -a -e /root/${kName} ]; then
|
||||||
${config.programs.ssh.package}/bin/ssh-keygen -y -f /etc/ssh/ssh_host_ecdsa_key > /etc/ssh/ssh_host_ecdsa_key.pub
|
countKeys=$((countKeys+1))
|
||||||
chmod 644 /etc/ssh/ssh_host_ecdsa_key.pub
|
mv -f /root/${kName} ${k.path}
|
||||||
|
echo "downloaded ${k.path}"
|
||||||
|
chmod 600 ${k.path}
|
||||||
|
${config.programs.ssh.package}/bin/ssh-keygen -y -f ${k.path} > ${k.path}.pub
|
||||||
|
chmod 644 ${k.path}.pub
|
||||||
|
fi
|
||||||
|
rm -f /root/${kName}
|
||||||
|
''
|
||||||
|
)}
|
||||||
|
|
||||||
|
if [[ $countKeys -le 0 ]]; then
|
||||||
|
echo "failed to obtain any SSH private host keys."
|
||||||
|
false
|
||||||
fi
|
fi
|
||||||
'';
|
'';
|
||||||
serviceConfig.Type = "oneshot";
|
serviceConfig.Type = "oneshot";
|
||||||
|
|
Loading…
Reference in a new issue