forked from emily/nixfiles
91 lines
2.9 KiB
Nix
91 lines
2.9 KiB
Nix
# I hate this so much aaa
|
|
{
|
|
callPackage,
|
|
dockerTools,
|
|
openssh,
|
|
bash,
|
|
gnused,
|
|
util-linux,
|
|
}:
|
|
|
|
dockerTools.buildLayeredImage {
|
|
name = "build-worker-oci";
|
|
tag = "latest";
|
|
|
|
fromImage = callPackage ./source.nix {};
|
|
|
|
maxLayers = 110;
|
|
|
|
passthru.updateScript = ./update.sh;
|
|
|
|
enableFakechroot = true;
|
|
|
|
contents = [ openssh util-linux bash gnused ];
|
|
|
|
config.Cmd = [ "/entrypoint.sh" ];
|
|
|
|
fakeRootCommands = ''
|
|
mkdir -p /root
|
|
cat <<EOF > /root/nix.conf
|
|
build-users-group = nixbld
|
|
experimental-features = nix-command flakes
|
|
sandbox = true
|
|
substituters = https://cache.kyouma.net https://cache.nixos.org
|
|
trusted-public-keys = cache.kyouma.net:Frjwu4q1rnwE/MnSTmX9yx86GNA/z3p/oElGvucLiZg= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
|
|
max-substitution-jobs = 20
|
|
max-silent-time = 14400
|
|
min-free = 17179869184
|
|
max-free = 34359738368
|
|
system-features = benchmark big-parallel kvm nixos-test uid-range gccarch-x86-64 gccarch-x86-64-v2 gccarch-x86-64-v3
|
|
EOF
|
|
|
|
mkdir -p /root/.ssh
|
|
cat <<EOF > /root/.ssh/authorized_keys
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA/+iN407+HsfHbbC3tfdA8Yf4TZ08qXQMb4tb/SDAs+ emily@card
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/vCXM3IaxJP9v2Y+xcQrQD2IcffgdzqtWhpMjj9Xl5 hydra@seras
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICT0dGyLUjxFnvqUmex+5xUGQ7D4yGHKo267JgApcq0k root@ryuuko
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIDTwCSWYODyvTJxwB6Rahuy0j6s/YYwtQta8bjzG/We root@ryuuko-arch
|
|
EOF
|
|
|
|
cat <<EOF > /root/.ssh/environment
|
|
PATH=/root/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin
|
|
EOF
|
|
|
|
cat <<EOF > /root/sshd_config
|
|
AcceptEnv GIT_PROTOCOL
|
|
AuthenticationMethods publickey
|
|
AuthorizedPrincipalsFile none
|
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
|
|
GatewayPorts no
|
|
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,sk-ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com
|
|
KbdInteractiveAuthentication no
|
|
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
|
|
LogLevel INFO
|
|
Macs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
|
PasswordAuthentication no
|
|
PermitRootLogin prohibit-password
|
|
PermitUserEnvironment yes
|
|
PrintMotd no
|
|
PubkeyAcceptedAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,sk-ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com
|
|
StreamLocalBindUnlink yes
|
|
StrictModes yes
|
|
UseDns no
|
|
UsePAM no
|
|
X11Forwarding no
|
|
Banner none
|
|
AddressFamily any
|
|
Port 2222
|
|
|
|
Subsystem sftp ${openssh}/libexec/sftp-server
|
|
AuthorizedKeysFile %h/.ssh/authorized_keys /etc/ssh/authorized_keys.d/%u
|
|
HostKey /mnt/data/ssh/ssh_host_ed25519_key
|
|
EOF
|
|
|
|
mkdir -p /etc/keys
|
|
mkdir -p /var/empty
|
|
mkdir -p /var/log
|
|
|
|
cp ${./entrypoint.sh} /entrypoint.sh
|
|
chmod +x /entrypoint.sh
|
|
'';
|
|
}
|