diff --git a/clanServices/admin/default.nix b/clanServices/admin/default.nix index 2e9090433..0b9bb4bca 100644 --- a/clanServices/admin/default.nix +++ b/clanServices/admin/default.nix @@ -26,7 +26,6 @@ nixosModule = { ... }: { - imports = [ ../../clanModules/sshd ../../clanModules/root-password diff --git a/clanServices/emergency-access/README.md b/clanServices/emergency-access/README.md new file mode 100644 index 000000000..08c682169 --- /dev/null +++ b/clanServices/emergency-access/README.md @@ -0,0 +1,16 @@ +This service will automatically set the emergency access password if your system fails to boot. + +## Usage + +```nix +inventory.instances = { + mylounge = { + module = { + name = "emergency-access"; + input = "clan-core"; + }; + + roles.default.tags.nixos = { }; + }; +} +``` diff --git a/clanServices/emergency-access/default.nix b/clanServices/emergency-access/default.nix new file mode 100644 index 000000000..41a7cfcce --- /dev/null +++ b/clanServices/emergency-access/default.nix @@ -0,0 +1,31 @@ +{ ... }: +{ + _class = "clan.service"; + manifest.name = "clan-core/emergency-access"; + manifest.description = "Set recovery password for emergency access to machine"; + manifest.categories = [ "System" ]; + + roles.default.perInstance = { + nixosModule = + { config, pkgs, ... }: + { + boot.initrd.systemd.emergencyAccess = + config.clan.core.vars.generators.emergency-access.files.password-hash.value; + + clan.core.vars.generators.emergency-access = { + runtimeInputs = [ + pkgs.coreutils + pkgs.mkpasswd + pkgs.xkcdpass + ]; + files.password.secret = true; + files.password-hash.secret = false; + + script = '' + xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > $out/password + mkpasswd -s -m sha-512 < $out/password | tr -d "\n" > $out/password-hash + ''; + }; + }; + }; +} diff --git a/clanServices/emergency-access/flake-module.nix b/clanServices/emergency-access/flake-module.nix new file mode 100644 index 000000000..f8a017707 --- /dev/null +++ b/clanServices/emergency-access/flake-module.nix @@ -0,0 +1,6 @@ +{ lib, ... }: +{ + clan.modules = { + emergency-access = lib.modules.importApply ./default.nix { }; + }; +} diff --git a/docs/mkdocs.yml b/docs/mkdocs.yml index 7a8d90391..3d41d0ed1 100644 --- a/docs/mkdocs.yml +++ b/docs/mkdocs.yml @@ -86,6 +86,7 @@ nav: - reference/clanServices/auto-upgrade.md - reference/clanServices/borgbackup.md - reference/clanServices/deltachat.md + - reference/clanServices/emergency-access.md - reference/clanServices/ergochat.md - reference/clanServices/garage.md - reference/clanServices/heisenbridge.md