diff options
author | phaer <hello@phaer.org> | 2022-12-03 14:58:52 +0100 |
---|---|---|
committer | phaer <hello@phaer.org> | 2022-12-03 15:10:43 +0100 |
commit | 3c1906b2023a1824ea78f69ae1fcf36d8ee4da28 (patch) | |
tree | 9560d4a22e5db44edec83b5741ff95584003390e /nixos/modules/system | |
parent | 1fc076154c790324e9b9cc87b53f4872bceb02e1 (diff) |
initrd-ssh: add ignoreEmptyHostKeys option
Diffstat (limited to 'nixos/modules/system')
-rw-r--r-- | nixos/modules/system/boot/initrd-ssh.nix | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/nixos/modules/system/boot/initrd-ssh.nix b/nixos/modules/system/boot/initrd-ssh.nix index 673655f20ee84..701d242abc154 100644 --- a/nixos/modules/system/boot/initrd-ssh.nix +++ b/nixos/modules/system/boot/initrd-ssh.nix @@ -73,6 +73,15 @@ in ''; }; + ignoreEmptyHostKeys = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Allow leaving {option}`config.boot.initrd.network.ssh` empty, + to deploy ssh host keys out of band. + ''; + }; + authorizedKeys = mkOption { type = types.listOf types.str; default = config.users.users.root.openssh.authorizedKeys.keys; @@ -141,7 +150,7 @@ in } { - assertion = cfg.hostKeys != []; + assertion = (cfg.hostKeys != []) || cfg.ignoreEmptyHostKeys; message = '' You must now pre-generate the host keys for initrd SSH. See the boot.initrd.network.ssh.hostKeys documentation |