Make it possible to use Nixops without automatic SSH key provisioning #1247

adisbladis · 2020-03-10T23:52:27Z

No description provided.

grahamc

Looking pretty cool so far :)

You and I were talking about this a few days ago, and this is what I wrote up then. I wonder if there is a way to author this PR in a way way to build out support for the other use cases?

example use cases we might want...

what we do now, but more explicit:

{
  defaults = { resources, ... }: {
    deployment.sshKey = resources.sshKeyPairs.management-key;
  };
  resources.sshKeyPairs.management-key = {};
}

create an SSH key per machine, automatically:

{
  defaults = { machine_uuid, resources, ... }: {
    deployment.sshKey = resources.sshKeyPairs."${machine_uid}"; # implicitly create an SSH key per host
  };
}

use a yubikey or other PKCS11-compatible device for SSH:

{
  defaults = { machine_uuid, resources, ... }: {
    deployment.sshKey = resources.sshKeyPairs.adams-yubikey;
  };
  resources.sshKeyPairs.adams-yubikey = {
    provider = "pkcs11";
    keyId = "abc123";
  };
}

get an automatically provisioned SSH key from Vault:

{
  defaults = { machine_uuid, resources, ... }: {
    deployment.sshKey = resources.sshKeyPairs.vault-deploykey;
  };
  resources.sshKeyPairs.vault-deploykey = {
    provider = "vault";
    server = "https://127.0.0.1:8200";
    secretEngine = "ssh-keys";
    role = "nixops-deploy";
  };
}

use your SSH agent, and using a defined SSH public key for provisioning:

{
  defaults = { machine_uuid, resources, ... }: {
    deployment.sshKey = resources.sshKeyPairs.agent;
  };
  resources.sshKeyPairs.agent = {
    provider = "ssh-agent";
    publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDUy2CGT6P3q2kApZEuyCHsuCruwdRzeWMdQe/WjdCak grahamc@Petunia"; # needed to copy to the target during provisioning
  };
}

nix/options.nix

nixops/backends/none.py

adisbladis · 2020-03-11T00:21:17Z

You and I were talking about this a few days ago, and this is what I wrote up then. I wonder if there is a way to author this PR in a way way to build out support for the other use cases?

I actually think we end up with more flexibility by not supporting each use case explicitly.
I think the most reasonable and flexible approach is to leave the specifics of authentication up to the user.

By doing this we automatically support most use cases that supports SSH agent.
PKCS11 is supported natively by OpenSSH too so that's supported with this approach already.

I don't know about using Vault, that may require explicit support from Nixops.

tomberek · 2020-03-12T20:58:34Z

There is some overlap between this and #1048 #1054. A cohesive solution would be great.

nixos-discourse · 2020-04-01T16:38:38Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update/6525/1

adisbladis · 2020-04-14T11:59:42Z

Rebased on latest master

chreekat

Looking forward to this!

nix/options.nix

chreekat · 2020-04-19T12:30:44Z

I actually think we end up with more flexibility by not supporting each use case explicitly.
I think the most reasonable and flexible approach is to leave the specifics of authentication up to the user.

While working on a similar problem recently, I realized that accepting and/or generating an entire openssh config file is a really flexible option! In my utility, I was able to clean up all my ssh invocations this way (simply ssh -F $config_file) .

(This is not a recommendation for this PR, just a note!)

adisbladis · 2020-04-19T12:32:37Z

While working on a similar problem recently, I realized that accepting and/or generating an entire openssh config file is a really flexible option!

This has been somewhat addressed in #1270 with the addition of sshOptions.

nix/options.nix

nixops/backends/none.py

This line has been a constant source of annoyance when adding/removing options. This may look ugly but optimises for "diffability".

nixops/backends/none.py

grahamc

lgtm!

adisbladis force-pushed the no-ssh-key-provision branch from 897f04b to 7060b92 Compare March 10, 2020 23:55

adisbladis changed the title ~~Make it possible to use Nixops automatic SSH key provisioning~~ Make it possible to use Nixops without automatic SSH key provisioning Mar 10, 2020

adisbladis changed the title ~~Make it possible to use Nixops without automatic SSH key provisioning~~ WIP: Make it possible to use Nixops without automatic SSH key provisioning Mar 10, 2020

grahamc reviewed Mar 10, 2020

View reviewed changes

nix/options.nix Outdated Show resolved Hide resolved

nixops/backends/none.py Outdated Show resolved Hide resolved

nixops/backends/none.py Outdated Show resolved Hide resolved

adisbladis closed this Mar 11, 2020

adisbladis force-pushed the no-ssh-key-provision branch from 7060b92 to b4c38df Compare March 11, 2020 00:12

adisbladis reopened this Mar 11, 2020

adisbladis force-pushed the no-ssh-key-provision branch from db4546b to aa91367 Compare March 11, 2020 00:17

adisbladis force-pushed the no-ssh-key-provision branch from aa91367 to 03a9e0d Compare March 11, 2020 00:36

adisbladis changed the title ~~WIP: Make it possible to use Nixops without automatic SSH key provisioning~~ Make it possible to use Nixops without automatic SSH key provisioning Mar 11, 2020

adisbladis mentioned this pull request Mar 11, 2020

WIP: Add deploy without creating a state file #1248

Closed

adisbladis force-pushed the no-ssh-key-provision branch from 03a9e0d to f703400 Compare April 14, 2020 11:50

chreekat approved these changes Apr 19, 2020

View reviewed changes

nix/options.nix Outdated Show resolved Hide resolved

chreekat mentioned this pull request Apr 19, 2020

Add support for non-root deployments #1270

Merged

grahamc added this to the 2.0 milestone Apr 20, 2020

grahamc added this to In progress in kanban Apr 23, 2020

grahamc moved this from In progress to To do in kanban Apr 23, 2020

adisbladis force-pushed the no-ssh-key-provision branch 2 times, most recently from 1fcaaef to cf6069e Compare April 27, 2020 10:43

adisbladis force-pushed the no-ssh-key-provision branch 2 times, most recently from 1083a18 to b28fcb9 Compare May 5, 2020 11:31

adisbladis force-pushed the no-ssh-key-provision branch 3 times, most recently from 679d98f to 5e7d3a9 Compare May 15, 2020 15:46

adisbladis force-pushed the no-ssh-key-provision branch from 5e7d3a9 to 600d036 Compare May 15, 2020 15:47

grahamc reviewed May 15, 2020

View reviewed changes

nix/options.nix Outdated Show resolved Hide resolved

adisbladis force-pushed the no-ssh-key-provision branch from 60bd470 to a58a7b1 Compare May 15, 2020 15:56

grahamc reviewed May 15, 2020

View reviewed changes

nixops/backends/none.py Outdated Show resolved Hide resolved

adisbladis force-pushed the no-ssh-key-provision branch from a58a7b1 to f2f50af Compare May 15, 2020 15:58

grahamc reviewed May 15, 2020

View reviewed changes

nixops/backends/none.py Outdated Show resolved Hide resolved

adisbladis added 2 commits May 15, 2020 17:00

Make it possible to use Nixops without automatic SSH key provisioning

36b1adf

eval-machine-info: Split options inherit's in multiple lines

a8e70ee

This line has been a constant source of annoyance when adding/removing options. This may look ugly but optimises for "diffability".

adisbladis force-pushed the no-ssh-key-provision branch from f2f50af to a8e70ee Compare May 15, 2020 16:01

grahamc reviewed May 15, 2020

View reviewed changes

nixops/backends/none.py Outdated Show resolved Hide resolved

get_ssh_private_key_file: Add types

6ce1794

grahamc approved these changes May 15, 2020

View reviewed changes

adisbladis merged commit 3bdc020 into NixOS:master May 15, 2020

kanban automation moved this from To do to Done May 15, 2020

ThreeFx mentioned this pull request Jun 26, 2020

Feature request: allow users to specify SSH key pair for first connection rather than generating one #716

Closed

tomberek mentioned this pull request Sep 8, 2021

Prevent nixops from generating a private key & deploying it #920

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make it possible to use Nixops without automatic SSH key provisioning #1247

Make it possible to use Nixops without automatic SSH key provisioning #1247

adisbladis commented Mar 10, 2020

grahamc left a comment

adisbladis commented Mar 11, 2020 •

edited

tomberek commented Mar 12, 2020

nixos-discourse commented Apr 1, 2020

adisbladis commented Apr 14, 2020

chreekat left a comment

chreekat commented Apr 19, 2020 •

edited

adisbladis commented Apr 19, 2020

grahamc left a comment

Make it possible to use Nixops without automatic SSH key provisioning #1247

Make it possible to use Nixops without automatic SSH key provisioning #1247

Conversation

adisbladis commented Mar 10, 2020

grahamc left a comment

Choose a reason for hiding this comment

what we do now, but more explicit:

create an SSH key per machine, automatically:

use a yubikey or other PKCS11-compatible device for SSH:

get an automatically provisioned SSH key from Vault:

use your SSH agent, and using a defined SSH public key for provisioning:

adisbladis commented Mar 11, 2020 • edited

tomberek commented Mar 12, 2020

nixos-discourse commented Apr 1, 2020

adisbladis commented Apr 14, 2020

chreekat left a comment

Choose a reason for hiding this comment

chreekat commented Apr 19, 2020 • edited

adisbladis commented Apr 19, 2020

grahamc left a comment

Choose a reason for hiding this comment

adisbladis commented Mar 11, 2020 •

edited

chreekat commented Apr 19, 2020 •

edited