Socheat socheatsok78

Native Secure Enclave backed ssh keys on MacOS

It turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys! This replaces projects like https://github.com/maxgoedjen/secretive

There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support to ssh by implementing PKCS11Provider interface. However since recently it also implements SecurityKeyProivder which supports loading keys directly from the secure enclave! SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to your Secure Enclave instead!

Okay, I've got a need to build Firefox from source, and I'd like to do that on a remote machine, and then copy build result back to my laptop. With Nix, using bastion host. I'll note details of my successful adventure.

Setup & Sources of knowledge

Here's the list of resources I've used actively:

https://nixos.wiki/wiki/Distributed_build
https://nixos.org/nix/manual/#conf-trusted-substituters and various other configuration parameters
https://github.com/NixOS/nixpkgs/blob/release-19.09/nixos/modules/services/misc/nix-daemon.nix which contains mappings from Nix config names to NixOS config names (damn, they are different!)

Here's my setup:

Automatically trust all existing Homebrew tap you have added:

brew tap | grep -v "homebrew/" | xargs -I {} brew trust {}

Nginx TLS SNI routing, based on subdomain pattern

Nginx can be configured to route to a backend, based on the server's domain name, which is included in the SSL/TLS handshake (Server Name Indication, SNI).
This works for http upstream servers, but also for other protocols, that can be secured with TLS.

prerequisites

at least nginx 1.15.9 to use variables in ssl_certificate and ssl_certificate_key.
check nginx -V for the following:
```
...
TLS SNI support enabled
```

	#!/usr/bin/env bash

	# This software is freely available under the Apache 2.0 license.
	# Full license available here: https://www.apache.org/licenses/LICENSE-2.0.txt

	set -o errexit
	set -o nounset
	set -o pipefail

	# Retry a command on a particular exit code, up to a max number of attempts,

	system.activationScripts.applications.text = let
	env = pkgs.buildEnv {
	name = "system-applications";
	paths = config.environment.systemPackages;
	pathsToLink = "/Applications";
	};
	in
	pkgs.lib.mkForce ''
	# Set up applications.
	echo "setting up /Applications..." >&2

	/**
	* A backward-compatible for FileReader: readAsBinaryString() method
	* @param arrayBuffer {ArrayBuffer}
	* @see https://developer.mozilla.org/en-US/docs/Web/API/FileReader/readAsBinaryString
	*/
	function readAsBinaryString (arrayBuffer) {
	const binary = []
	const arrayBufferView = new Uint8Array(arrayBuffer)
	for (let i = 0; i < arrayBufferView.length; i++) {
	binary.push(String.fromCharCode(arrayBufferView[i]))

	#!/bin/bash

	# Script is needed because my default firewall rules are messed up and after
	# every restart, docker containers can't make connections to the host, notably
	# preventing debuggers like xdebug from attaching.

	# If networking fails in your containers but works in others, rm and re-create the
	# docker network that container is bound to.

	set -euo pipefail

	#!/bin/bash
	set -e
	exec docker run --rm -it -v $(pwd):/pangolin --workdir /pangolin alpine sh -c "wget -O installer \"https://github.com/fosrl/pangolin/releases/download/1.3.1/installer_linux_$(uname -m \| sed 's/x86_64/amd64/;s/aarch64/arm64/')\" && chmod +x ./installer && ./installer"