Add declarative ssh known hosts

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>

hosts/common/configs/user/console/ssh/default.nix

@@ -4,14 +4,5 @@
 }:
 { ... }:
 {
-  environment.persistence."/persist"."${home}/.ssh/known_hosts" = { };
-
-  home-manager.users.${user} = {
-    programs.ssh = {
-      enable = true;
-      userKnownHostsFile = "${home}/.ssh/known_hosts/default";
-    };
-
-    systemd.user.tmpfiles.rules = [ "d ${home}/.ssh/known_hosts 0755 ${user} users" ];
-  };
+  home-manager.users.${user}.programs.ssh.enable = true;
 }

hosts/common/configs/user/gui/spicetify/default.nix

@@ -10,6 +10,7 @@
   ...
 }:
 let
+  selfLib = inputs.self.lib.${system};
   hmConfig = config.home-manager.users.${user};
 in
 {
@@ -64,7 +65,7 @@ in
       "spotify/prefs.init" = {
         source = ./config/prefs;
         onChange = ''
-          ${config.lib.runtime.merge.keyValue} "${home}/.config/spotify/prefs.init" "${home}/.config/spotify/prefs"
+          ${selfLib.runtime.merge.keyValue} "${home}/.config/spotify/prefs.init" "${home}/.config/spotify/prefs"
         '';
       };
 
@@ -72,7 +73,7 @@ in
         source = ./config/prefs-user;
         onChange = ''
           user = $(cat "${hmConfig.sops.secrets."spotify/username".path}")
-          ${config.lib.runtime.merge.keyValue} "${home}/.config/spotify/prefs-user.init" "${home}/.config/spotify/Users/''${user}-user/prefs"
+          ${selfLib.runtime.merge.keyValue} "${home}/.config/spotify/prefs-user.init" "${home}/.config/spotify/Users/''${user}-user/prefs"
         '';
       };
     };

hosts/eirene/default.nix

@@ -1,8 +1,6 @@
 { inputs, ... }:
 {
   imports = [
-    ../../lib
-
     inputs.disko.nixosModules.disko
     ./format.nix
 

hosts/eirene/users/nick/configs/console/git/default.nix

@@ -2,7 +2,15 @@
   user ? throw "user argument is required",
   home ? throw "home argument is required",
 }:
-{ ... }:
+{
+  inputs,
+  lib,
+  system,
+  ...
+}:
+let
+  selfPkgs = inputs.self.packages.${system};
+in
 {
   home-manager.users.${user} = {
     sops.secrets = {
@@ -17,12 +25,16 @@
       };
     };
 
-    programs.ssh.matchBlocks = {
-      "github.com" = {
-        hostname = "github.com";
-        user = "git";
-        identityFile = "${home}/.ssh/ssh_personal_ed25519_key";
+    programs.ssh = {
+      matchBlocks = {
+        "github.com" = {
+          hostname = "github.com";
+          user = "git";
+          identityFile = "${home}/.ssh/ssh_personal_ed25519_key";
+        };
       };
+
+      userKnownHostsFiles = with selfPkgs; [ ssh-known-hosts-github ];
     };
   };
 }

hosts/elara/configs/git/default.nix

@@ -1,4 +1,7 @@
-{ ... }:
+{ inputs, system, ... }:
+let
+  selfPkgs = inputs.self.packages.${system};
+in
 {
   sops.secrets."ssh/sas/key" = {
     sopsFile = ../../../../secrets/sas/secrets.yaml;
@@ -6,15 +9,22 @@
     path = "/root/.ssh/ssh_sas_ed25519_key";
   };
 
-  programs.ssh.extraConfig = ''
-    Host github.com
-      User git
-      HostName github.com
-      IdentityFile /root/.ssh/ssh_sas_ed25519_key
+  programs.ssh = {
+    extraConfig = ''
+      Host github.com
+        User git
+        HostName github.com
+        IdentityFile /root/.ssh/ssh_sas_ed25519_key
 
-    Host gitlab.sas.com
-      User git
-      HostName gitlab.sas.com
-      IdentityFile /root/.ssh/ssh_sas_ed25519_key
-  '';
+      Host gitlab.sas.com
+        User git
+        HostName gitlab.sas.com
+        IdentityFile /root/.ssh/ssh_sas_ed25519_key
+    '';
+
+    knownHostsFiles = with selfPkgs; [
+      ssh-known-hosts-github
+      ssh-known-hosts-sas-gitlab
+    ];
+  };
 }

hosts/elara/default.nix

@@ -1,8 +1,6 @@
 { config, inputs, ... }:
 {
   imports = [
-    ../../lib
-
     inputs.disko.nixosModules.disko
     ./format.nix
 

hosts/elara/users/nikara/configs/console/git/default.nix

@@ -2,7 +2,16 @@
   user ? throw "user argument is required",
   home ? throw "home argument is required",
 }:
-{ lib, pkgs, ... }:
+{
+  inputs,
+  lib,
+  system,
+  pkgs,
+  ...
+}:
+let
+  selfPkgs = inputs.self.packages.${system};
+in
 {
   home-manager.users.${user} = {
     sops.secrets = {
@@ -26,28 +35,36 @@
         }
       );
 
-      ssh.matchBlocks = {
-        "github.com" = {
-          hostname = "github.com";
-          user = "git";
-          identityFile = [
-            "${home}/.ssh/ssh_sas_ed25519_key"
-            "${home}/.ssh/ssh_personal_ed25519_key"
-          ];
+      ssh = {
+        matchBlocks = {
+          "github.com" = {
+            hostname = "github.com";
+            user = "git";
+            identityFile = [
+              "${home}/.ssh/ssh_sas_ed25519_key"
+              "${home}/.ssh/ssh_personal_ed25519_key"
+            ];
+          };
+
+          "gitlab.sas.com" = {
+            hostname = "gitlab.sas.com";
+            user = "git";
+            identityFile = "${home}/.ssh/ssh_sas_ed25519_key";
+          };
+
+          "gerrit-svi.unx.sas.com" = {
+            hostname = "gerrit-svi.unx.sas.com";
+            user = "nikara";
+            port = 29418;
+            identityFile = "${home}/.ssh/ssh_sas_ed25519_key";
+          };
         };
 
-        "gitlab.sas.com" = {
-          hostname = "gitlab.sas.com";
-          user = "git";
-          identityFile = "${home}/.ssh/ssh_sas_ed25519_key";
-        };
-
-        "gerrit-svi.unx.sas.com" = {
-          hostname = "gerrit-svi.unx.sas.com";
-          user = "nikara";
-          port = 29418;
-          identityFile = "${home}/.ssh/ssh_sas_ed25519_key";
-        };
+        userKnownHostsFiles = with selfPkgs; [
+          ssh-known-hosts-github
+          ssh-known-hosts-sas-gitlab
+          ssh-known-hosts-sas-gerrit
+        ];
       };
     };
   };

hosts/elara/users/nikara/configs/console/ssh/default.nix

@@ -2,13 +2,20 @@
   user ? throw "user argument is required",
   home ? throw "home argument is required",
 }:
-{ ... }:
+{ inputs, system, ... }:
+let
+  selfPkgs = inputs.self.packages.${system};
+in
 {
-  home-manager.users.${user}.programs.ssh.matchBlocks = {
-    "cldlgn.fyi.sas.com" = {
-      inherit user;
-      hostname = "cldlgn.fyi.sas.com";
-      identityFile = "${home}/.ssh/ssh_sas_ed25519_key";
+  home-manager.users.${user}.programs.ssh = {
+    matchBlocks = {
+      "cldlgn.fyi.sas.com" = {
+        inherit user;
+        hostname = "cldlgn.fyi.sas.com";
+        identityFile = "${home}/.ssh/ssh_sas_ed25519_key";
+      };
     };
+
+    userKnownHostsFiles = with selfPkgs; [ ssh-known-hosts-sas-cldlgn ];
   };
 }

hosts/installer/default.nix

@@ -1,8 +1,6 @@
 { config, inputs, ... }:
 {
   imports = [
-    ../../lib
-
     inputs.disko.nixosModules.disko
     ./format.nix
 

hosts/installer/users/nick/configs/console/git/default.nix

@@ -2,7 +2,15 @@
   user ? throw "user argument is required",
   home ? throw "home argument is required",
 }:
-{ ... }:
+{
+  inputs,
+  lib,
+  system,
+  ...
+}:
+let
+  selfPkgs = inputs.self.packages.${system};
+in
 {
   home-manager.users.${user} = {
     sops.secrets = {
@@ -17,12 +25,16 @@
       };
     };
 
-    programs.ssh.matchBlocks = {
-      "github.com" = {
-        hostname = "github.com";
-        user = "git";
-        identityFile = "${home}/.ssh/ssh_personal_ed25519_key";
+    programs.ssh = {
+      matchBlocks = {
+        "github.com" = {
+          hostname = "github.com";
+          user = "git";
+          identityFile = "${home}/.ssh/ssh_personal_ed25519_key";
+        };
       };
+
+      userKnownHostsFiles = with selfPkgs; [ ssh-known-hosts-github ];
     };
   };
 }