me
/
guix
Archived
1
0
Fork 0
Code

services: secret-service: Do not generate SSH and Guix key pairs. 

The justification about the order of activation snippets given in the
comment had been obsolete since
39e3b4b7ce.

Lately, running the activation snippets for "ssh-keygen -A" and "guix
archive --generate-key" would take a little bit too long, thereby
preventing the childhurd from starting on time.

* gnu/services/virtualization.scm (secret-service-operating-system):
Clear 'generate-host-keys?' and 'generate-substitute-key?'.
master
Ludovic Courtès 2022-03-10 23:10:02 +01:00
parent 0691ab6779
commit 2bac6ea177
No known key found for this signature in database
GPG Key ID: 090B11993D9AEBB5
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
gnu/services/virtualization.scm
View File

@ -946,12 +946,20 @@ can only be accessed by their host.")))
that will be listening to receive secret keys on port 1004, TCP."
(operating-system
(inherit os)
;; Arrange so that the secret service activation snippet shows up before
;; the OpenSSH and Guix activation snippets. That way, we receive OpenSSH
;; and Guix keys before the activation snippets try to generate fresh keys
;; for nothing.
(services (append (operating-system-user-services os)
(list (service secret-service-type 1004))))))
(services
;; Turn off SSH and Guix key generation that normally happens during
;; activation: that requires entropy and thus takes time during boot, and
;; those keys are going to be overwritten by secrets received from the
;; host anyway.
(cons (service secret-service-type 1004)
(modify-services (operating-system-user-services os)
(openssh-service-type
config => (openssh-configuration
(inherit config)
(generate-host-keys? #f)))
(guix-service-type
config => (guix-configuration
(generate-substitute-key? #f))))))))
;;;