diff options
| author | Michael Hoang <Enzime@users.noreply.github.com> | 2023-09-26 01:05:13 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-09-26 01:05:13 +0100 |
| commit | e236a1e598a9a59265897948ac9874c364b9555f (patch) | |
| tree | 62c4f3346bad31ca9c3184f92e3958232e7b61e6 /modules/programs/ssh | |
| parent | c286b23c7fd7f0622bc4af898c91f58b8d304ff1 (diff) | |
| parent | e58bcb921bfd6e90b3e2d11a03ba32918a1cfad4 (diff) | |
Merge pull request #187 from kalbasit/known-hosts-only-if-set
programs.ssh: write ssh known_hosts only if there are any set
Diffstat (limited to 'modules/programs/ssh')
| -rw-r--r-- | modules/programs/ssh/default.nix | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/modules/programs/ssh/default.nix b/modules/programs/ssh/default.nix index 87978e6..5fc7415 100644 --- a/modules/programs/ssh/default.nix +++ b/modules/programs/ssh/default.nix @@ -151,12 +151,13 @@ in services.openssh.authorizedKeysFiles = [ "%h/.ssh/authorized_keys" "/etc/ssh/authorized_keys.d/%u" ]; environment.etc = authKeysFiles // - { "ssh/ssh_known_hosts".text = (flip (concatMapStringsSep "\n") knownHosts - (h: assert h.hostNames != []; - concatStringsSep "," h.hostNames + " " - + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile) - )) + "\n"; - + { "ssh/ssh_known_hosts" = mkIf (builtins.length knownHosts > 0) { + text = (flip (concatMapStringsSep "\n") knownHosts + (h: assert h.hostNames != []; + concatStringsSep "," h.hostNames + " " + + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile) + )) + "\n"; + }; "ssh/sshd_config.d/101-authorized-keys.conf" = { text = "AuthorizedKeysFile ${toString config.services.openssh.authorizedKeysFiles}\n"; # Allows us to automatically migrate from using a file to a symlink |