diff --git a/morph/grid/local/grid.nix b/morph/grid/local/grid.nix
index a17f4546eb1a19232f7f7f822862bfdd57440c9c..19fc3cfded5f41498ddc2f091c72298b11751762 100644
--- a/morph/grid/local/grid.nix
+++ b/morph/grid/local/grid.nix
@@ -4,8 +4,6 @@ let
gridlib = import ../../lib;
rawConfig = pkgs.lib.trivial.importJSON ./config.json;
config = rawConfig // {
- sshUsers = import ./public-keys/users.nix;
-
# Convert relative paths to absolute so library code can resolve names
# correctly.
publicKeyPath = toString ./. + "/${rawConfig.publicKeyPath}";
@@ -14,6 +12,13 @@ let
# Module with per-grid configuration
grid-module = {
+ imports = [
+ # Allow us to remotely trigger updates to this system.
+ ../../../nixos/modules/deployment.nix
+ # Give it a good SSH configuration.
+ ../../../nixos/modules/ssh.nix
+ ];
+ services.private-storage.sshUsers = import ./public-keys/users.nix;
# Configure deployment management authorization for all systems in the grid.
services.private-storage.deployment = {
authorizedKey = builtins.readFile "${config.publicKeyPath}/deploy_key.pub";
@@ -62,7 +67,7 @@ let
(gridlib.hardware-virtual ({ publicIPv4 = "192.168.67.24"; }))
(gridlib.customize-monitoring {
inherit hostsMap vpnClientIPs nodeExporterTargets paymentExporterTargets;
- inherit (config) domain publicKeyPath privateKeyPath sshUsers letsEncryptAdminEmail;
+ inherit (config) domain publicKeyPath privateKeyPath letsEncryptAdminEmail;
googleOAuthClientID = config.monitoringGoogleOAuthClientID;
monitoringvpnIPv4 = "172.23.23.1";
stateVersion = "19.09";
diff --git a/morph/grid/production/grid.nix b/morph/grid/production/grid.nix
index fac74ccf2f028c270a773788dde71451f6025d4f..4578218b23cac6f9e2a62e0b7f97bb39bfc7ec19 100644
--- a/morph/grid/production/grid.nix
+++ b/morph/grid/production/grid.nix
@@ -5,8 +5,6 @@ let
gridlib = import ../../lib;
rawConfig = pkgs.lib.trivial.importJSON ./config.json;
config = rawConfig // {
- sshUsers = import ./public-keys/users.nix;
-
# Convert relative paths to absolute so library code can resolve names
# correctly.
publicKeyPath = toString ./. + "/${rawConfig.publicKeyPath}";
@@ -15,6 +13,13 @@ let
# Module with per-grid configuration
grid-module = {
+ imports = [
+ # Allow us to remotely trigger updates to this system.
+ ../../../nixos/modules/deployment.nix
+ # Give it a good SSH configuration.
+ ../../../nixos/modules/ssh.nix
+ ];
+ services.private-storage.sshUsers = import ./public-keys/users.nix;
# Configure deployment management authorization for all systems in the grid.
services.private-storage.deployment = {
authorizedKey = builtins.readFile "${config.publicKeyPath}/deploy_key.pub";
@@ -39,7 +44,7 @@ let
gridlib.hardware-aws
(gridlib.customize-monitoring {
inherit hostsMap vpnClientIPs nodeExporterTargets paymentExporterTargets;
- inherit (config) domain publicKeyPath privateKeyPath sshUsers letsEncryptAdminEmail;
+ inherit (config) domain publicKeyPath privateKeyPath letsEncryptAdminEmail;
googleOAuthClientID = config.monitoringGoogleOAuthClientID;
monitoringvpnIPv4 = "172.23.23.1";
stateVersion = "19.09";
diff --git a/morph/grid/testing/grid.nix b/morph/grid/testing/grid.nix
index 9e03a500c3c22fc90c16b65460324a9ed2adec78..9997463fbf72dc30af20f6aba1f194b54011b433 100644
--- a/morph/grid/testing/grid.nix
+++ b/morph/grid/testing/grid.nix
@@ -5,8 +5,6 @@ let
gridlib = import ../../lib;
rawConfig = pkgs.lib.trivial.importJSON ./config.json;
config = rawConfig // {
- sshUsers = import ./public-keys/users.nix;
-
# Convert relative paths to absolute so library code can resolve names
# correctly.
publicKeyPath = toString ./. + "/${rawConfig.publicKeyPath}";
@@ -15,6 +13,13 @@ let
# Module with per-grid configuration
grid-module = {
+ imports = [
+ # Allow us to remotely trigger updates to this system.
+ ../../../nixos/modules/deployment.nix
+ # Give it a good SSH configuration.
+ ../../../nixos/modules/ssh.nix
+ ];
+ services.private-storage.sshUsers = import ./public-keys/users.nix;
# Configure deployment management authorization for all systems in the grid.
services.private-storage.deployment = {
authorizedKey = builtins.readFile "${config.publicKeyPath}/deploy_key.pub";
@@ -52,7 +57,7 @@ let
gridlib.hardware-aws
(gridlib.customize-monitoring {
inherit hostsMap vpnClientIPs nodeExporterTargets paymentExporterTargets;
- inherit (config) domain publicKeyPath privateKeyPath sshUsers letsEncryptAdminEmail;
+ inherit (config) domain publicKeyPath privateKeyPath letsEncryptAdminEmail;
googleOAuthClientID = config.monitoringGoogleOAuthClientID;
monitoringvpnIPv4 = "172.23.23.1";
stateVersion = "19.09";
diff --git a/morph/lib/customize-issuer.nix b/morph/lib/customize-issuer.nix
index 1c0d668fbd4ae59bab115c2116b7fa377395dcfc..ea5b31fef2893dbf271e37f2b5b2bb20dc9ef446 100644
--- a/morph/lib/customize-issuer.nix
+++ b/morph/lib/customize-issuer.nix
@@ -26,12 +26,6 @@
# ``"example-grid.invalid"`` for the system figure out that
# ``payments.example-grid.invalid`` is the name of this system.
, domain
-
- # A set mapping usernames as strings to SSH public keys as strings. For
- # each element of the site, the indicated user is configured on the system
- # with the indicated SSH key as an authorized key.
-, sshUsers
-
# A string giving an email address to use for Let's Encrypt registration and
# certificate issuance.
, letsEncryptAdminEmail
@@ -77,7 +71,6 @@
networking.domain = domain;
- services.private-storage.sshUsers = sshUsers;
services.private-storage.monitoring.vpn.client = {
enable = true;
ip = monitoringvpnIPv4;
diff --git a/morph/lib/customize-monitoring.nix b/morph/lib/customize-monitoring.nix
index 391aa5602575100c8650d8e4fb6892e38fc95ebf..f5b820a272fcfd4ea7106af32ad2fd0ac5c8ece3 100644
--- a/morph/lib/customize-monitoring.nix
+++ b/morph/lib/customize-monitoring.nix
@@ -13,7 +13,6 @@
, privateKeyPath
, monitoringvpnIPv4
, domain
-, sshUsers
, letsEncryptAdminEmail
# A list of VPN IP addresses as strings indicating which clients will be
@@ -85,8 +84,6 @@
networking.domain = domain;
networking.hosts = hostsMap;
- services.private-storage.sshUsers = sshUsers;
-
services.private-storage.monitoring.vpn.server = {
enable = true;
ip = monitoringvpnIPv4;
diff --git a/morph/lib/customize-storage.nix b/morph/lib/customize-storage.nix
index 68655874efd9ba39b52dacfdddaedb54863ed769..6ec8431651713a4ebd19a1a768a2dfaf09f36f18 100644
--- a/morph/lib/customize-storage.nix
+++ b/morph/lib/customize-storage.nix
@@ -6,7 +6,6 @@
, publicKeyPath
, monitoringvpnEndpoint
, monitoringvpnIPv4
-, sshUsers
, domain
# An integer giving the value of a single pass in byte×months.
@@ -33,7 +32,7 @@
networking.domain = domain;
services.private-storage = {
- inherit sshUsers passValue publicStoragePort;
+ inherit passValue publicStoragePort;
};
services.private-storage.monitoring.vpn.client = {
diff --git a/morph/lib/issuer.nix b/morph/lib/issuer.nix
index f617eef171cfaa35f7cf676915e57ba2654a4319..74db99bb5a24c05597c76ee23977240a9614278a 100644
--- a/morph/lib/issuer.nix
+++ b/morph/lib/issuer.nix
@@ -41,9 +41,6 @@
};
imports = [
- # Allow us to remotely trigger updates to this system.
- ../../nixos/modules/deployment.nix
-
../../nixos/modules/issuer.nix
../../nixos/modules/monitoring/vpn/client.nix
../../nixos/modules/monitoring/exporters/node.nix
diff --git a/morph/lib/monitoring.nix b/morph/lib/monitoring.nix
index 7d59c296d12b06e430ff031b9f0b8b8a0e8616e1..bf92d1041f2bf9b9fb1ff4580a25ff7b596a9bbb 100644
--- a/morph/lib/monitoring.nix
+++ b/morph/lib/monitoring.nix
@@ -21,11 +21,6 @@
};
imports = [
- # Give it a good SSH configuration.
- ../../nixos/modules/ssh.nix
- # Allow us to remotely trigger updates to this system.
- ../../nixos/modules/deployment.nix
-
../../nixos/modules/monitoring/vpn/server.nix
../../nixos/modules/monitoring/server/grafana.nix
../../nixos/modules/monitoring/server/prometheus.nix
diff --git a/morph/lib/storage.nix b/morph/lib/storage.nix
index 52be81364a3659a625854503b8efa7a8c97e108b..c437fcf6166c57a00b0975a616ce5ca8710ea4fe 100644
--- a/morph/lib/storage.nix
+++ b/morph/lib/storage.nix
@@ -33,8 +33,6 @@
# Any extra NixOS modules to load on this server.
imports = [
- # Allow us to remotely trigger updates to this system.
- ../../nixos/modules/deployment.nix
# Bring in our module for configuring the Tahoe-LAFS service and other
# Private Storage-specific things.
../../nixos/modules/private-storage.nix
diff --git a/nixos/modules/issuer.nix b/nixos/modules/issuer.nix
index ce1f928b2738066811425a3c7e3e3c85c03ac272..3a8d05bfb8afbaad63fac0ee52f0bdf3d3cbb956 100644
--- a/nixos/modules/issuer.nix
+++ b/nixos/modules/issuer.nix
@@ -5,11 +5,6 @@
# Our own nixpkgs fork:
ourpkgs = import ../../nixpkgs-ps.nix {};
in {
- imports = [
- # Give it a good SSH configuration.
- ../../nixos/modules/ssh.nix
- ];
-
options = {
services.private-storage-issuer.enable = lib.mkEnableOption "PrivateStorage ZKAP Issuer Service";
services.private-storage-issuer.package = lib.mkOption {
diff --git a/nixos/modules/private-storage.nix b/nixos/modules/private-storage.nix
index fa5fea837c544e66ae8811a2e3c468a67a18759e..d3bc9e61bb8a805d4432edf7d37d51a9501ecc1e 100644
--- a/nixos/modules/private-storage.nix
+++ b/nixos/modules/private-storage.nix
@@ -30,8 +30,6 @@ let
in
{
imports = [
- # Give it a good SSH configuration.
- ./ssh.nix
# Load our tahoe-lafs module. It is configurable in the way I want it to
# be configurable.
./tahoe.nix
diff --git a/nixos/modules/tests/private-storage.nix b/nixos/modules/tests/private-storage.nix
index 59c572fabc6730d2b8351b4bcd37987adab2f88b..2687718bcba3f07cf9e229dadf071489445e4a54 100644
--- a/nixos/modules/tests/private-storage.nix
+++ b/nixos/modules/tests/private-storage.nix
@@ -111,6 +111,7 @@ in {
{ config, pkgs, ... }:
{ imports =
[ ../private-storage.nix
+ ../ssh.nix
];
services.private-storage = {
enable = true;
@@ -128,6 +129,7 @@ in {
{ config, pkgs, ... }:
{ imports =
[ ../issuer.nix
+ ../ssh.nix
];
services.private-storage.sshUsers = sshUsers;