ssh: fix ssh login with new yubi keys fido2

users/b12f/default.nix

@@ -12,6 +12,7 @@ in {
     ./home.nix
     ./session-variables.nix
     ./u2f.nix
+    ./ssh.nix
     ./concepts-and-training.nix
     ./ehex.nix
     ./email
@@ -40,7 +41,7 @@ in {
           "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmiF8ndGhnx2YAWbPDq14fftAwcJ0xnjJIVTotI12OO4SPX/SwH5Yp8C8Kf002qN9FbFmaONzq3s8TYpej13JubhfsQywNuFKZuZvJeHzmOwxsANW86RVrWT0WZmYx9a/a1TF9rPQpibDVt60wX8yLdExaJc5F1SvIIuyz1kxYpz36wItfR6hcwoLGh1emFCmfCpebJmp3hsrMDTTtTW/YNhyeSZW74ckyvZyjCYtRCJ8uF0ZmOSKRdillv4Ztg8MsUubGn+vaMl6V6x/QuDuehEPoM/3wBx9o22nf+QVbk7S1PC8EdT/K5vskn4/pfR7mDCyQOq1hB4w4Oyn0dsfX pi@ssrtc"
           "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDwyNsGCMuyI9x2IxYEbYIL6oYsEfe1wqhHaRxSnK9oc10ge1LJni5o7g6XgryoQpCD9YenImcCxwkKblmlLQ2327uoVC2PUo07li1uT0eIPk0TQoxwp6besFs7/LEzZlgWQsc3gkEXmjk/E0mu0U6z2fkqciJ/ZxWYt9fLP6jBG47U9878rSaZ7k7Ilv6oRA3suArH189k1nerk/tonS4EWXeHZxHh/Eu0tqwmxN/6+g2GicYn6b+MbFQVdQAkctqT5Yz9USm9UKzbaAuZ799u0dJzagHm9JJZOr8r11ENtAkY9kAzRzm3u/ACiSdVzyLdjAK6m0dIPhp3OhedzuHiI6/wRll60tYtQTH1XwUpVbtir3+DT+jwZgO1zH3yL4iNh79kuUo+UEg1ZmGkSZRzSS2vb5qr0J5aSJmCd5sNB7a01PTtSlQPOqSF9PB+UmcLDF7JoKFub0KT/gRZ5neZkXTYQ/Y05qtaaFVlOVISijnm+sLUvKBv6OW8oYXIHBk= b12f@chocolatebar"
           "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEST9eyAY3nzGYNnqDYfWHu+89LZsOjyKHMqCFvtP7vrgB7F7JbbECjdjAXEOfPDSCVwtMMpq8JJXeRMjpsD0rw= @b12f Yubi Backup"
-          "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKOpBCq5YqEVi4sKAZHk82luuf+DSvsPeRxsHYTVPJdZAAAACHNzaDpiMTJm yubi@464"
+          "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHUbowjUtBiOPWi+TCHGToFwIsMDY6s7IRev6buVVdWxAAAACHNzaDpiMTJm yubi@464"
           "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDyxaJNw0jXREOzQfa0E2RQE/xLD/VddDldbdSmS8uf9AAAACHNzaDpiMTJm yubi@485"
         ];
       };

users/b12f/home.nix

@@ -9,127 +9,13 @@ with lib; let
   psCfg = config.pub-solar;
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 in {
-  age.secrets."id_ed25519_sk-464" = {
-    file = "${flake.self}/secrets/id_ed25519_sk-464.age";
-    mode = "400";
-    owner = psCfg.user.name;
-    path = "/home/${psCfg.user.name}/.ssh/id_ed25519_sk-464";
-  };
-
-  age.secrets."id_ed25519_sk-485" = {
-    file = "${flake.self}/secrets/id_ed25519_sk-485.age";
-    mode = "400";
-    owner = psCfg.user.name;
-    path = "/home/${psCfg.user.name}/.ssh/id_ed25519_sk-485";
-  };
-
   home-manager.users."${psCfg.user.name}" = {
     home.packages = [
       pkgs.zoom-us
     ];
 
-    programs.ssh = {
-      enable = true;
-      matchBlocks = {
-        "*" = {
-          identityFile = [
-            "/home/${psCfg.user.name}/.ssh/id_ed25519_sk-464"
-            "/home/${psCfg.user.name}/.ssh/id_ed25519_sk-485"
-          ];
-        };
-
-        "git.pub.solar" = {
-          user = "gitea";
-        };
-
-        "aur.archlinux.org" = {
-          user = "aur";
-        };
-
-        "leavieler.art" = {
-          hostname = "web5svsvy.wh.hosting.zone";
-          user = "web5svsvy_cgzqa3";
-          port = 2244;
-        };
-
-        "benjaminbaedorf.eu" = {
-          hostname = "web5svsvy.wh.hosting.zone";
-          user = "web5svsvy_cgzqa3";
-          port = 2244;
-        };
-
-        "miom.space" = {
-          hostname = "web7dgkba.wh.hosting.zone";
-          user = "web7dgkba_c9em8f";
-          port = 2244;
-        };
-
-        "latenight.blue" = {
-          hostname = "latenight.blue";
-          user = "lnb";
-          extraOptions = {
-            MACs = "hmac-sha2-512-etm@openssh.com";
-          };
-        };
-
-        "blacktea.io" = {
-          hostname = "latenight.blue";
-          user = "lnb";
-          extraOptions = {
-            MACs = "hmac-sha2-512-etm@openssh.com";
-          };
-        };
-
-        "laurakirst.de" = {
-          hostname = "webj4bsux.wh.hosting.zone";
-          user = "webj4bsux_36qkrk";
-          port = 2244;
-        };
-
-        "lipperschwabe.design" = {
-          hostname = "webugit4m.wh.hosting.zone";
-          user = "webugit4m_snjhrn";
-          port = 2244;
-        };
-
-        "pie.local" = {
-          hostname = "pie.local";
-          user = "yule";
-        };
-
-        "pie.b12f.io" = {
-          user = "yule";
-        };
-
-        "frikandel-initrd.b12f.io" = {
-          user = "root";
-          port = 2222;
-        };
-
-        "frikandel.b12f.io" = {
-          user = "yule";
-        };
-
-        "droppie.b12f.io" = {
-          user = "yule";
-        };
-
-        "nachtigall.pub.solar" = {
-          user = "barkeeper";
-        };
-
-        "flora-6.pub.solar" = {
-          user = "barkeeper";
-        };
-      };
-    };
-
     programs.bash.initExtra = ''
       source ${config.age.secrets.b12f-env-secrets.path}
     '';
   };
-
-  programs.ssh.extraConfig = "
-    PubkeyAcceptedKeyTypes +ssh-rsa
-  ";
 }

users/b12f/ssh.nix

@@ -0,0 +1,126 @@
+{
+  config,
+  pkgs,
+  lib,
+  flake,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in {
+  age.secrets."id_ed25519_sk-464" = {
+    file = "${flake.self}/secrets/id_ed25519_sk-464.age";
+    mode = "400";
+    owner = psCfg.user.name;
+    path = "/home/${psCfg.user.name}/.ssh/id_ed25519_sk-464";
+  };
+
+  age.secrets."id_ed25519_sk-485" = {
+    file = "${flake.self}/secrets/id_ed25519_sk-485.age";
+    mode = "400";
+    owner = psCfg.user.name;
+    path = "/home/${psCfg.user.name}/.ssh/id_ed25519_sk-485";
+  };
+
+  home-manager.users."${psCfg.user.name}" = {
+    home.file.".ssh/id_ed25519_sk-464.pub".text = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHUbowjUtBiOPWi+TCHGToFwIsMDY6s7IRev6buVVdWxAAAACHNzaDpiMTJm yubi@464";
+    home.file.".ssh/id_ed25519_sk-485.pub".text = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDyxaJNw0jXREOzQfa0E2RQE/xLD/VddDldbdSmS8uf9AAAACHNzaDpiMTJm yubi@485";
+
+    programs.ssh = {
+      enable = true;
+      matchBlocks = {
+        "*" = {
+          identityFile = [
+            "/home/${psCfg.user.name}/.ssh/id_ed25519_sk-464"
+            "/home/${psCfg.user.name}/.ssh/id_ed25519_sk-485"
+          ];
+        };
+
+        "git.pub.solar" = {
+          user = "gitea";
+        };
+
+        "aur.archlinux.org" = {
+          user = "aur";
+        };
+
+        "leavieler.art" = {
+          hostname = "web5svsvy.wh.hosting.zone";
+          user = "web5svsvy_cgzqa3";
+          port = 2244;
+        };
+
+        "benjaminbaedorf.eu" = {
+          hostname = "web5svsvy.wh.hosting.zone";
+          user = "web5svsvy_cgzqa3";
+          port = 2244;
+        };
+
+        "miom.space" = {
+          hostname = "web7dgkba.wh.hosting.zone";
+          user = "web7dgkba_c9em8f";
+          port = 2244;
+        };
+
+        "latenight.blue" = {
+          hostname = "latenight.blue";
+          user = "lnb";
+          extraOptions = {
+            MACs = "hmac-sha2-512-etm@openssh.com";
+          };
+        };
+
+        "blacktea.io" = {
+          hostname = "latenight.blue";
+          user = "lnb";
+          extraOptions = {
+            MACs = "hmac-sha2-512-etm@openssh.com";
+          };
+        };
+
+        "laurakirst.de" = {
+          hostname = "webj4bsux.wh.hosting.zone";
+          user = "webj4bsux_36qkrk";
+          port = 2244;
+        };
+
+        "lipperschwabe.design" = {
+          hostname = "webugit4m.wh.hosting.zone";
+          user = "webugit4m_snjhrn";
+          port = 2244;
+        };
+
+        "pie.local" = {
+          hostname = "pie.local";
+          user = "yule";
+        };
+
+        "pie.b12f.io" = {
+          user = "yule";
+        };
+
+        "frikandel-initrd.b12f.io" = {
+          user = "root";
+          port = 2222;
+        };
+
+        "frikandel.b12f.io" = {
+          user = "yule";
+        };
+
+        "droppie.b12f.io" = {
+          user = "yule";
+        };
+
+        "nachtigall.pub.solar" = {
+          user = "barkeeper";
+        };
+
+        "flora-6.pub.solar" = {
+          user = "barkeeper";
+        };
+      };
+    };
+  };
+}