services: openssh: Extensions provide extra authorized keys.

* gnu/services/ssh.scm (extend-openssh-authorized-keys): New procedure.
(openssh-service-type)[compose, extend]: New fields.
* doc/guix.texi (Networking Services): Document the extension.
This commit is contained in:
Ludovic Courtès 2017-07-30 16:03:43 +02:00
parent 4892eb7c6a
commit 1398a43816
No known key found for this signature in database
GPG key ID: 090B11993D9AEBB5
2 changed files with 22 additions and 0 deletions

View file

@ -10210,6 +10210,15 @@ shell daemon, @command{sshd}. Its value must be an
@end example
See below for details about @code{openssh-configuration}.
This service can be extended with extra authorized keys, as in this
example:
@example
(service-extension openssh-service-type
(const `(("charlie"
,(local-file "charlie.pub")))))
@end example
@end deffn
@deftp {Data Type} openssh-configuration
@ -10303,6 +10312,9 @@ keys. For example:
registers the specified public keys for user accounts @code{rekado},
@code{chris}, and @code{root}.
Additional authorized keys can be specified @i{via}
@code{service-extension}.
Note that this does @emph{not} interfere with the use of
@file{~/.ssh/authorized_keys}.
@end table

View file

@ -29,6 +29,7 @@ (define-module (gnu services ssh)
#:use-module (guix gexp)
#:use-module (guix records)
#:use-module (guix modules)
#:use-module (srfi srfi-1)
#:use-module (srfi srfi-26)
#:use-module (ice-9 match)
#:export (lsh-configuration
@ -450,6 +451,13 @@ (define (openssh-pam-services config)
#:allow-empty-passwords?
(openssh-configuration-allow-empty-passwords? config))))
(define (extend-openssh-authorized-keys config keys)
"Extend CONFIG with the extra authorized keys listed in KEYS."
(openssh-configuration
(inherit config)
(authorized-keys
(append (openssh-authorized-keys config) keys))))
(define openssh-service-type
(service-type (name 'openssh)
(extensions
@ -461,6 +469,8 @@ (define openssh-service-type
openssh-activation)
(service-extension account-service-type
(const %openssh-accounts))))
(compose concatenate)
(extend extend-openssh-authorized-keys)
(default-value (openssh-configuration))))