nix configuration should consume ssh key facts

[sarcasticadmin]

Description

We currently are defining the ssh key and user configuration in nixos without consuming facts/keys. It would be better to consume them from facts so that they are all defined and updated in one place.

Acceptance Criteria

• facts/keys is utilized to define user ssh keys

[nixinator]

What you thinking on this, a script that converts facts/keys to ssh.nix or something?

I maybe able to get the builds to fetch directly from github if need, and fall back to a local copy if the github 'is not available'.

all the details are here.

here are some idea's to lick this problem.

https://discourse.nixos.org/t/fetching-ssh-public-keys/12076/7

[owendelong]

Since it should be updating not only the authorized keys files, but also creating user accounts and updating sudoers, I suspect ssh.nix might not be the right solution. 

[sarcasticadmin]

@kylerisse has already done some work previously on this. Im going to assign the issue to him and have him put in a PR accordingly. Its not anything terribly difficult since we already have the keys in facts/keys.

[sarcasticadmin]

@kylerisse did some really good discovery in #1071

Some topics to discuss here from the above issue:

• longer term solution for the 3 overlapping categories
• Whose got super-user on switches and root on APs

Additionally, its probably worth considering having a ssh-cert(s) installed on the various ssh daemons so we can grant people access for the show with granularity: https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Certificate-based_Authentication#Limiting_User_Certificates

[owendelong]

Kyle and I discussed this during the show. Our general consensus was to create facts/keys/upload and facts/keys/ directories. Users would put their keys in facts/keys/upload and then we would symlink those key files into the appropriate directories. (e.g. switch_superuser, switch_operator, switch_readonly, server_sudo, server_user, etc.)

I'd have to modify the PERL code for the switch configuration to parse out the new directory structure and create the appropriate user classes, but that wouldn't be a lot of work.