NixOps 2.0 self SSH?

[cristian-rivera]

I currently have NixOps 2.0 (Master) installed on my Mac.

My configuration file is:

{
  network = {
    description = "sylent";
    enableRollback = true;
  };

  apollo = {
    imports = [ ./machines/apollo/configuration.nix ];

    deployment = {
      targetHost = "10.0.1.2";
      hasFastConnection = true;
    };

    nixpkgs.localSystem.system = "x86_64-linux";
  };
}

This is great, and it works, but I want to manage my SSH keys to this server instead of having NixOps generate one and store it somewhere.

If I add this configuration option to the above:

deployment.provisionSSHKey = false;

I get an error saying do not know private SSH key for machine 'apollo'. Still pretty new to Nix and comfortable enough to read the source code of NixOps to determine configuration options that might not be full documented yet or have examples, but for the life of me I can’t figure out how to get this to work. Do I need to set options like sshPrivateKey, sshPublicKey somewhere? Will it pick up my SSH config on my Mac ~/.ssh/config?

In plain old shell I can call ssh 10.0.1.2 and my config is picked up perfectly by the SSH agent, so I don’t think it is an issue there.

Any help would be greatly appreciated!

[Pamplemousse]

@cristian-rivera

Incidentally read your issue right now. I am not too sure of what you are trying to accomplish, but if you want your local user to be able to connect to the machines you setup using nixops, you can configure specific users on these machines with some authorizedKeys.

For example, using the following in your deployment expression:

let
  # The following you copy from your `~/.ssh` on your local machine
  authorizedKeys = [
    "id..."
    "id..."
  ];
in
[...]
  # And within your machine's configuration
  users.users = {                                                                                                                  
    root.openssh.authorizedKeys.keys = authorizedKeys;                                                                           
  };

With the aforementionned expression, you will be able to connect to the root account on your server using your local ssh key.