Dustin C. Hatch
647cdb8346
Installing packages on the host system via `rpm-ostree` is _insanely_ slow, especially on Raspberry Pi devices. The main reason I chose to go that route for managing the SSH host certificates was to avoid having to maintain the systemd units in multiple places. I think the trade-off is worth it, though; bringing up a new Raspberry Pi is significantly faster, by 15+ minutes, if we do not have to wait for `rpm-ostree` at all.
23 lines
614 B
Plaintext
23 lines
614 B
Plaintext
[Unit]
|
|
Description=Request %I SSH Host Certificate
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
Before=ssh-host-certs.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
|
|
[Container]
|
|
Image=git.pyrocufflink.net/containerimages/sshca-cli
|
|
Pull=newer
|
|
EnvironmentFile=/etc/sysconfig/ssh-host-cert-sign
|
|
Exec=host sign --output /etc/ssh/ssh_host_%I_key-cert.pub /etc/ssh/ssh_host_%I_key.pub
|
|
Volume=/etc/ssh:/etc/ssh:rw
|
|
Volume=/sys/firmware:/sys/firmware:ro
|
|
Volume=/sys/class/dmi/id:/sys/class/dmi/id:ro
|
|
Network=host
|
|
SecurityLabelDisable=yes
|
|
ContainerName=%p-%i
|
|
PodmanArgs=--uts=host
|
|
PodmanArgs=--security-opt=unmask=/sys/firmware
|