Typo
Allow building hetzner-bootstrap on any host
add deployment.targetPort option
Disable nixops-keys.service if there are no keys

Otherwise, when a machine is rebooted outside of NixOps, services like
httpd won't get started because they'll wait forever on keys.target.
Merge pull request #190 from shlevy/hetzner-from-osx

Allow building hetzner-bootstrap on any host
Update examples
Merge pull request #191 from iElectric/targetPort

add deployment.targetPort option
Per Eelco's suggestion, use first configured SSH port as default for deployment.targetPort.
Support Amazon EBS SSD disks (http://aws.amazon.com/blogs/aws/new-ssd-backed-elastic-block-storage/).
add placement group
Merge pull request #199 from dguibert/dg/placement-group

add placement group
Use GNU stat (BSD stat doesn't support -c).
echo -n is not sh-compatible

Fixes #203
Allow users in group "keys" to access /run/keys.

This makes it at least possible to access the keys directory if a
particular service is in the keys group, which has been introduced by
NixOS/nixpkgs@4ab5646417e3cc606281f71027c12ddced8b65b4.

However, to let specific users access a particular key, you still need
to work around it by adding an additional systemd service that sets the
right permissions. But at least with this we should have some
consistency with what is actually done in <nixpkgs>.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Turn "keys" option into an attrset of attrsets.

This now provides options for each key and also converts old style
string-only keys into the new format while emitting a warning.

At the moment only the "text" option is actually supported.

For applying the keys for string-values the permissions attribute is set
to "0600" instead of the default value "0640" in keyOptionsType in order
to correctly replicate the old behaviour even when we implement
permissions and ownership.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
MachineState: Implement permissions for keys.

This however only implements setting permissions if "storeKeysOnMachine" is
set to false right now, because if the value is set to true the keys are
symlinked from the store and we actually have to find a way to control
permisions on it, which for the store is only possible if NixOS/nix#8 is
implemented.

Also, this ensures that the key filename is properly escaped.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix keyOptionsType submodule type.

First, forgot about specifying options.* and even if it would be there,
the option values wouldn't be merged because keyType was not properly
inheriting the merge function from keyOptionsType.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Use 0600 as the default permissions.

Only using this for legacy options could introduce unexpected behaviour
when switching to the new configuration if the user just appends a .text
to its configuration values and could possibly lead to services that
refuse to work, especially when it comes to OpenSSH.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix eval if storeKeysOnMachine is true.

This currently only fixes evaluation but actually doesn't apply the
correct permissions on the key files because they're just links to world
readable files in the Nix store.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix description of storeKeysOnMachine.

As storeKeysOnMachine no longer is true by default (7ae4b27), we
shouldn't say so in the description. Especially because the default
value is already shown in the generated manual along with the
description.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>