Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add var.ssh_options to pass additional SSH options to nixos-rebuild #427

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

threddast
Copy link

This PR adds a Terraform input variable named ssh_options to nixos-rebuild (and to the rebuild part of nixos-anywhere)

The problem I'm trying to solve is being able to use gcloud compute ssh to rebuild NixOS. gcloud compute ssh is a wrapper around ssh that sets a bunch of ssh options to connect to a GCP VM, even if there is no direct connection to it.

Example usage:

module "deploy" {
  source       = "github.com/nix-community/nixos-anywhere//terraform/nixos-rebuild"
  nixos_system = module.system-build.result.out
  target_host = "target"
  ssh_options = {
    IdentityFile          = "/home/user/.ssh/google_compute_engine"
    CheckHostIP           = "no"
    HashKnownHosts        = "no"
    HostKeyAlias          = "compute.123456789"
    IdentitiesOnly        = "yes"
    StrictHostKeyChecking = "yes"
    UserKnownHostsFile    = "/home/user/.ssh/google_compute_known_hosts"
    ProxyCommand          = "/nix/store/nrzkzg0if8p9ak18070x8mj6clbcvdm7-python3-3.11.9-env/bin/python -S /nix/store/lann7mq6gpyl7q3d3hq6d93jr69pgm0v-google-cloud-sdk-475.0.0/google-cloud-sdk/lib/gcloud.py compute start-iap-tunnel test-vm %p --listen-on-stdin --project=my-project --zone=europe-west4-a --verbosity=warning"
    ProxyUseFdpass        = "no"
  }
}

I'm using a file to pass the SSH options because of this bug in Nix: NixOS/nix#5181. The content of NIX_SSHOPTS is passed to this tokenizer which splits by spaces and doesn't take quoted substrings into account.
This means that something like NIX_SSHOPTS='-o ProxyCommand="my-ssh-command foo bar"' wont't work unless the tokenizer is changed upstream.
The disadvantage of passing options as a file is that it will break the terraform module for people relying on their .ssh/config, unless they copy the ssh options from .ssh/config to the terraform module. I understand this might be too much of a downside and we might want to change the tokenizer instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant