aboutsummaryrefslogtreecommitdiff
path: root/doc/manual/src/package-management/ssh-substituter.md
diff options
context:
space:
mode:
authorEelco Dolstra <edolstra@gmail.com>2020-07-31 15:43:25 +0200
committerEelco Dolstra <edolstra@gmail.com>2020-07-31 15:43:25 +0200
commit1d0a7b54fa330b041a720932ee4e05dcad1d2d5c (patch)
tree48627a3530e4d6d58c612864b2e99afb11a0a902 /doc/manual/src/package-management/ssh-substituter.md
parent0c94c176446bd9e9cb8c7e16fb7c6d88bb4e9a20 (diff)
Enable syntax highlighting
Diffstat (limited to 'doc/manual/src/package-management/ssh-substituter.md')
-rw-r--r--doc/manual/src/package-management/ssh-substituter.md20
1 files changed, 15 insertions, 5 deletions
diff --git a/doc/manual/src/package-management/ssh-substituter.md b/doc/manual/src/package-management/ssh-substituter.md
index 482844c7c..6e5e258bc 100644
--- a/doc/manual/src/package-management/ssh-substituter.md
+++ b/doc/manual/src/package-management/ssh-substituter.md
@@ -5,7 +5,9 @@ Nix store via SSH. For example, the following installs Firefox,
automatically fetching any store paths in Firefox’s closure if they are
available on the server `avalon`:
- $ nix-env -i firefox --substituters ssh://alice@avalon
+```console
+$ nix-env -i firefox --substituters ssh://alice@avalon
+```
This works similar to the binary cache substituter that Nix usually
uses, only using SSH instead of HTTP: if a store path `P` is needed, Nix
@@ -22,11 +24,17 @@ building from source.
You can also copy the closure of some store path, without installing it
into your profile, e.g.
- $ nix-store -r /nix/store/m85bxg…-firefox-34.0.5 --substituters ssh://alice@avalon
+```console
+$ nix-store -r /nix/store/m85bxg…-firefox-34.0.5 --substituters
+ssh://alice@avalon
+```
This is essentially equivalent to doing
- $ nix-copy-closure --from alice@avalon /nix/store/m85bxg…-firefox-34.0.5
+```console
+$ nix-copy-closure --from alice@avalon
+/nix/store/m85bxg…-firefox-34.0.5
+```
You can use SSH’s *forced command* feature to set up a restricted user
account for SSH substituter access, allowing read-only access to the
@@ -45,8 +53,10 @@ to `sshd_config` to restrict the user `nix-ssh`:
On NixOS, you can accomplish the same by adding the following to your
`configuration.nix`:
- nix.sshServe.enable = true;
- nix.sshServe.keys = [ "ssh-dss AAAAB3NzaC1k... bob@example.org" ];
+```nix
+nix.sshServe.enable = true;
+nix.sshServe.keys = [ "ssh-dss AAAAB3NzaC1k... bob@example.org" ];
+```
where the latter line lists the public keys of users that are allowed to
connect.