73 lines
2.3 KiB
Nix
73 lines
2.3 KiB
Nix
|
{ lib, config, ... }:
|
||
|
|
with lib;
|
||
|
|
{
|
||
|
|
options = {
|
||
|
|
system = {
|
||
|
|
host-name = mkOption {
|
||
|
|
type = types.str;
|
||
|
|
description = "The hostname of the switch.";
|
||
|
|
};
|
||
|
|
root-authentication = {
|
||
|
|
hashedPasswd = mkOption {
|
||
|
|
type = types.str;
|
||
|
|
description = "Hashed password for root.";
|
||
|
|
};
|
||
|
|
ssh-keys = mkOption {
|
||
|
|
type = types.listOf types.str;
|
||
|
|
description = "ssh keys for root user.";
|
||
|
|
default = [ ];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
services = {
|
||
|
|
ssh.root-login = mkOption {
|
||
|
|
type = types.enum [
|
||
|
|
"allow"
|
||
|
|
"deny"
|
||
|
|
"deny-password"
|
||
|
|
];
|
||
|
|
description = "Login policy to use for root.";
|
||
|
|
};
|
||
|
|
netconf.port = mkOption {
|
||
|
|
type = types.port;
|
||
|
|
description = "Port to use for netconf.";
|
||
|
|
default = 830;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
netconf.xmls.system = mkOption {
|
||
|
|
type = types.str;
|
||
|
|
visible = false;
|
||
|
|
readOnly = true;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
config.netconf.xmls.system =
|
||
|
|
let
|
||
|
|
ssh-keys1 = map (splitString " ") config.system.root-authentication.ssh-keys;
|
||
|
|
ssh-keys2 = map (key: if length key < 3 then key ++ [ "foo@bar" ] else key) ssh-keys1;
|
||
|
|
ssh-keys = map (concatStringsSep " ") ssh-keys2;
|
||
|
|
edsca = map (key: "<ssh-edsca><name>${key}</name></ssh-edsca>") (
|
||
|
|
filter (hasPrefix "ssh-edsca ") ssh-keys
|
||
|
|
);
|
||
|
|
rsa = map (key: "<ssh-rsa><name>${key}</name></ssh-rsa>") (filter (hasPrefix "ssh-rsa ") ssh-keys);
|
||
|
|
ed25519 = map (key: "<ssh-ed25519><name>${key}</name></ssh-ed25519>") (
|
||
|
|
filter (hasPrefix "ssh-ed25519 ") ssh-keys
|
||
|
|
);
|
||
|
|
in
|
||
|
|
''
|
||
|
|
<system>
|
||
|
|
<host-name operation="replace">${config.system.host-name}</host-name>
|
||
|
|
<root-authentication operation="replace">
|
||
|
|
<encrypted-password>${config.system.root-authentication.hashedPasswd}</encrypted-password>
|
||
|
|
${concatStrings (edsca ++ rsa ++ ed25519)}
|
||
|
|
</root-authentication>
|
||
|
|
<services operation="replace">
|
||
|
|
<ssh><root-login>${config.system.services.ssh.root-login}</root-login></ssh>
|
||
|
|
<netconf>
|
||
|
|
<ssh><port>${toString config.system.services.netconf.port}</port></ssh>
|
||
|
|
<rfc-compliant/><yang-compliant/>
|
||
|
|
</netconf>
|
||
|
|
</services>
|
||
|
|
</system>
|
||
|
|
'';
|
||
|
|
}
|