The top-level `programs.ssh` options such as `forwardAgent`,
`serverAliveInterval`, and `controlPath` were deprecated in 25.11.
Remove their aliases ahead of the 26.11 release; set the native
directives under `programs.ssh.settings."*"` instead.
The `enableDefaultConfig` default and the newer `matchBlocks`
compatibility are unchanged.
Setting a removed option now fails with an error that explains what
to do instead.
The RFC 42 settings option derives the Host/Match line from the
attribute name. That makes it impossible to express headers that carry
Nix string context (e.g. Match exec referring to a store path), and
forces long computed patterns into attribute names where a stable
logical name would be nicer for dag ordering.
Add an explicit `header` option on each block that defaults to the
attribute name (with the existing Host/Match prefix detection), and
have the legacy matchBlocks shim populate it instead of the
__hmSshBlockHeader internal.
Add programs.ssh.settings as a freeform DAG for OpenSSH client configuration blocks. Render Host and Match blocks directly from the new settings option while preserving ordering support.
Render known ssh_config comma-list directives from Nix lists as single comma-separated lines and known space-list directives as single whitespace-separated lines. This keeps directives like KexAlgorithms, Ciphers, MACs, HostKeyAlgorithms, ProxyJump, SendEnv, GlobalKnownHostsFile, and PermitRemoteOpen from being emitted as duplicate directives where OpenSSH may only use the first value.
Migrate legacy matchBlocks into settings, keep root SSH option redirects pointed at the new option names, and hide the deprecated matchBlocks option from generated docs.
Update SSH tests, docs references, and news coverage for the new option.
A first step towards refactoring the module.
Unfortunately the config is not consistent in using comma-separated
values or repeated keys for lists, since the user can always add commas
by themselves, we should default to repeated keys in the generator.
Reduce maintenance burden and increase efficiency by automatically
importing modules following a specific convention.
Co-authored-by: awwpotato <awwpotato@voidq.com>
Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
These (and the `*MD` functions apart from `literalMD`) are now no-ops
in nixpkgs and serve no purpose other than to add additional noise and
potentially mislead people into thinking unmarked DocBook documentation
will still be accepted.
Note that if backporting changes including documentation to 23.05,
the `mdDoc` calls will need to be re-added.
To reproduce this commit, run:
$ NIX_PATH=nixpkgs=flake:nixpkgs/e7e69199f0372364a6106a1e735f68604f4c5a25 \
nix shell nixpkgs#coreutils \
-c find . -name '*.nix' \
-exec nix run -- github:emilazy/nix-doc-munge/98dadf1f77351c2ba5dcb709a2a171d655f15099 \
--strip {} +
$ ./format
This process was automated by [my fork of `nix-doc-munge`]. All
conversions were automatically checked to produce the same DocBook
result when converted back, modulo minor typographical/formatting
differences on the acceptable-to-desirable spectrum.
To reproduce this commit, run:
$ NIX_PATH=nixpkgs=flake:nixpkgs/e7e69199f0372364a6106a1e735f68604f4c5a25 \
nix shell nixpkgs#coreutils \
-c find . -name '*.nix' \
-exec nix run -- github:emilazy/nix-doc-munge/98dadf1f77351c2ba5dcb709a2a171d655f15099 \
{} +
$ ./format
[my fork of `nix-doc-munge`]: https://github.com/emilazy/nix-doc-munge/tree/home-manager
Make use of the recently added nullable `mkPackageOption` feature
to disable installing an SSH client by default: most people should use
the client provided by their system.
* ssh: add generic Match support for matchBlocks
Introduce conservative support for actual `Match`
blocks in ssh config.
"Conservative" means this PR doesn'tt try to process
the `match` expression and simply uses it as a string
provided by the user.
If set, `match` has precedence over `host` meaning
if both are set, `match` is used and `host` is ignored.
* Add news entry
Attempting to build a flake configuration using `ssh.remoteForwards' results in
evaluation errors when `port' is undefined, as `!(entry ? port)' evaluates to
false. This was verified in the nix repl, and also occurs for `nix flake
check'.
Set optional attrs in `bindOptions' and `forwardModule' to `null' by default
and adjust the assertion to check for `null' instead of attr definitions.
This switches the type of `matchBlocks` from `loaOf` to `listOrDagOf`.
The former has been deprecated in Nixpkgs. The latter allows
dependencies between entries to be expressed using the DAG functions.
Instead of using the hostname `%h`, which can be changed by the
~/.ssh/config file, use the commandline-given hostname `%n`.
This allows to alias a host with different hostnames, which then point
to different configurations. A common use-case for this is if you have
multiple accounts on github with each access to different private repos:
Host github.com
IdentitiesOnly yes
User git
IdentityFile ~/.ssh/id_rsa
Host customer.github.com
IdentitiesOnly yes
User git
IdentityFile ~/.ssh/customer
HostName github.com
Without this change, if a connection was established with the first
github.com alias, then the user would try to pull a repo from the second
account, ssh would re-use the SSH connection which doesn't have access
to that repository.
This is needed to support overriding these options inside match
blocks. A new option `programs.ssh.extraOptionOverrides` has been
added to allow global overrides.
