feat(apply): automatically add SSH host keys if automatic confirmation is enabled

Author: water-sucks

cmd/apply/apply.go

@@ -253,6 +253,16 @@ func applyMain(cmd *cobra.Command, opts *cmdOpts.ApplyOpts) error {
 		}
 	}()
 
+	needsConfirmation := !opts.AlwaysConfirm && !cfg.Confirmation.Always
+
+	// If no confirmation is needed, then manually override the host
+	// key verification type so that host keys can always be added to
+	// known_hosts.
+	hostKeyVerification := cfg.SSH.HostKeyVerification
+	if hostKeyVerification == settings.HostKeyVerificationAsk && !needsConfirmation {
+		hostKeyVerification = settings.HostKeyVerificationAcceptNew
+	}
+
 	var targetHost system.System
 
 	if opts.TargetHost != "" {
@@ -261,7 +271,7 @@ func applyMain(cmd *cobra.Command, opts *cmdOpts.ApplyOpts) error {
 		var sshCfg *system.SSHConfig
 		sshCfg, err = system.NewSSHConfig(stopCtx, opts.TargetHost, log, system.SSHConfigOptions{
 			AgentManager:        sshAgent,
-			HostKeyVerification: cfg.SSH.HostKeyVerification,
+			HostKeyVerification: hostKeyVerification,
 			KnownHostsFiles:     cfg.SSH.KnownHostsFiles,
 			PrivateKeyCmd:       cfg.SSH.PrivateKeyCmd,
 		})
@@ -335,7 +345,7 @@ func applyMain(cmd *cobra.Command, opts *cmdOpts.ApplyOpts) error {
 		var sshCfg *system.SSHConfig
 		sshCfg, err = system.NewSSHConfig(stopCtx, opts.BuildHost, log, system.SSHConfigOptions{
 			AgentManager:        sshAgent,
-			HostKeyVerification: cfg.SSH.HostKeyVerification,
+			HostKeyVerification: hostKeyVerification,
 			KnownHostsFiles:     cfg.SSH.KnownHostsFiles,
 			PrivateKeyCmd:       cfg.SSH.PrivateKeyCmd,
 		})

internal/settings/settings.go

@@ -374,6 +374,7 @@ This requires the 'nix-command' experimental feature to be enabled in the Nix co
 		Short: "Policy on what action to take with unknown host keys",
 		Long: "What action to take when an unknown host key is encountered." +
 			" By default, this will mimic OpenSSH behavior and ask interactively, if possible." +
+			" If `confirmation.always` is set, then 'ask' will be overridden to 'accept-new'." +
 			" If turned off, then known_hosts will not be modified and man-in-the-middle attacks" +
 			" may be possible. Mostly a direct equivalent OpenSSH `StrictHostKeyChecking` setting.",
 	},