ctucx.git: nixfiles

machines/stasicontainer: add luks-unlocking via ssh

diff --git a/machines/stasicontainer/configuration.nix b/machines/stasicontainer/configuration.nix
@@ -49,6 +49,25 @@
     ];
 
     initrd.availableKernelModules = [ "i915" ];
+
+    initrd.network = {
+      enable = true;
+      ssh    = {
+        enable         = true;
+        port           = 22;
+        hostKeys       = [ /etc/ssh/ssh_host_rsa_key ];
+        authorizedKeys = with lib; concatLists (mapAttrsToList (name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else []) config.users.users);
+      };
+
+      postCommands = ''
+        ip link set dev ens3 up
+
+        ip addr add 195.39.246.42/28 dev ens3
+        ip route add default via 195.39.246.41 dev ens3 onlink
+        echo 'cryptsetup-askpass' >> /root/.profile
+      '';
+    };
+
   };
 
   networking = {