Skip to content

GitHub 認証・署名を Secure Enclave SSH キーに移行 #56

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
thinceller-hermes wants to merge 1 commit into from
Closed

GitHub 認証・署名を Secure Enclave SSH キーに移行 #56

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions home-manager/programs/fish/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@
{
imports = [ ./common.nix ];

# Secure Enclave に格納した SSH キーを認証・署名に使うためのプロバイダー。
home.sessionVariables.SSH_SK_PROVIDER = "/usr/lib/ssh-keychain.dylib";

programs.fish = {
functions = {
scc = {
Expand Down
18 changes: 16 additions & 2 deletions home-manager/programs/git/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,18 @@

programs.gpg.enable = true;

# Secure Enclave に格納した SSH キーを git commit 署名に使う。
# キーハンドルファイルは各 Mac で `sc_auth create-ctk-identity`
# を使って生成する必要がある。
home.file.".local/bin/ssh-sign" = {
executable = true;
text = ''
#!/bin/sh
export SSH_SK_PROVIDER=/usr/lib/ssh-keychain.dylib
exec /usr/bin/ssh-keygen "$@"
'';
};

# Cloudflare Access (Forgejo CLI) の Service Token を含む git の include ファイルを
# sops で暗号化して管理する。home-manager の activation で復号され、
# ~/.config/git/cloudflare-access.gitconfig に symlink される。
Expand All @@ -17,7 +29,9 @@
programs.git = {
signing = {
format = "ssh";
key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILQwsbXl/1tHIdW/f+fZE7TJArqzvmbbaUsdKRFPoyZB";
# Secure Enclave 内の SSH キーハンドルを指す。
# 対応する公開鍵は ~/.ssh/id_github_se.pub に置く。
key = "~/.ssh/id_github_se";
signByDefault = true;
};
settings = {
Expand All @@ -36,7 +50,7 @@
};
gpg = {
ssh = {
program = "/Applications/1Password.app/Contents/MacOS/op-ssh-sign";
program = "${config.home.homeDirectory}/.local/bin/ssh-sign";
};
};
# forgejo.thinceller.dev (Forgejo) は Cloudflare Access で保護されているので、
Expand Down
12 changes: 11 additions & 1 deletion home-manager/programs/ssh/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,14 +18,24 @@

# settings は freeform で OpenSSH のディレクティブ名を直接キーに使う (旧 matchBlocks)。
settings = {
# GitHub は Secure Enclave に格納した SSH キーで認証・署名する。
# キーハンドルファイルは各 Mac で作成する必要がある。
"github.com" = {
HostName = "github.com";
User = "git";
IdentityFile = "~/.ssh/id_github_se";
IdentitiesOnly = "yes";
IdentityAgent = "none";
};

# admin 主経路: Tailscale (MagicDNS で tailnet IP に解決)。
# Tailscale SSH なので鍵認証は tailscaled が処理 (IdentityFile 不要)。
"oberon" = {
HostName = "oberon";
User = "thinceller";
ServerAliveInterval = 60;
};
# fallback: cloudflared 経由 (Tailscale 故障時 / 経路系 deploy 時)。
# fallback: cloudflared 経路 (Tailscale 故障時 / 経路系 deploy 時)。
"oberon-cf" = {
HostName = "oberon.thinceller.dev";
User = "thinceller";
Expand Down