120 lines
2.9 KiB
Nix
120 lines
2.9 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
enabled = config.mod.ssh.enable;
|
|
|
|
authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
|
|
rootSSHKeyPath = "/etc/ssh";
|
|
in
|
|
{
|
|
options = {
|
|
mod.ssh = {
|
|
enable = lib.mkEnableOption "enable ssh module";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf enabled {
|
|
home-manager.users.alex = {
|
|
programs.ssh = {
|
|
enable = true;
|
|
|
|
matchBlocks = {
|
|
"git.ppp.pm" = {
|
|
hostname = "git.ppp.pm";
|
|
identityFile = "/home/alex/.ssh/alex.tadpole-git.ppp.pm";
|
|
};
|
|
|
|
"codeberg.org" = {
|
|
hostname = "codeberg.org";
|
|
identityFile = "/home/alex/.ssh/alex.tadpole-codeberg.org";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
environment.etc."ssh/authorized_keys_command" = {
|
|
mode = "0755";
|
|
text = ''
|
|
#!${pkgs.bash}/bin/bash
|
|
for file in ${authorizedKeysPath}/*; do
|
|
${pkgs.coreutils}/bin/cat "$file"
|
|
done
|
|
'';
|
|
};
|
|
|
|
services = {
|
|
openssh = {
|
|
enable = true;
|
|
ports = [ 1122 ];
|
|
|
|
hostKeys = [
|
|
{
|
|
path = "${rootSSHKeyPath}/root.tadpole";
|
|
type = "ed25519";
|
|
}
|
|
];
|
|
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
KbdInteractiveAuthentication = false;
|
|
};
|
|
|
|
authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
|
|
authorizedKeysCommandUser = "root";
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
firewall = {
|
|
allowedTCPPorts = [ 1122 ];
|
|
};
|
|
};
|
|
|
|
age.secrets = {
|
|
"root.tadpole" = {
|
|
file = ../../../../secrets/tadpole/root.tadpole.age;
|
|
path = "${rootSSHKeyPath}/root.tadpole";
|
|
};
|
|
"root.tadpole.pub" = {
|
|
file = ../../../../secrets/tadpole/root.tadpole.pub.age;
|
|
path = "${rootSSHKeyPath}/root.tadpole.pub";
|
|
};
|
|
|
|
"alex.pinwheel-tadpole.pub" = {
|
|
file = ../../../../secrets/pinwheel/alex.pinwheel-tadpole.pub.age;
|
|
path = "${authorizedKeysPath}/alex.pinwheel-tadpole.pub";
|
|
};
|
|
|
|
"alex.tadpole-git.ppp.pm" = {
|
|
file = ../../../../secrets/tadpole/alex.tadpole-git.ppp.pm.age;
|
|
path = "/home/alex/.ssh/alex.tadpole-git.ppp.pm";
|
|
owner = "alex";
|
|
group = "users";
|
|
};
|
|
"alex.tadpole-git.ppp.pm.pub" = {
|
|
file = ../../../../secrets/tadpole/alex.tadpole-git.ppp.pm.pub.age;
|
|
path = "/home/alex/.ssh/alex.tadpole-git.ppp.pm.pub";
|
|
owner = "alex";
|
|
group = "users";
|
|
};
|
|
|
|
"alex.tadpole-codeberg.org" = {
|
|
file = ../../../../secrets/tadpole/alex.tadpole-codeberg.org.age;
|
|
path = "/home/alex/.ssh/alex.tadpole-codeberg.org";
|
|
owner = "alex";
|
|
group = "users";
|
|
};
|
|
"alex.tadpole-codeberg.org.pub" = {
|
|
file = ../../../../secrets/tadpole/alex.tadpole-codeberg.org.pub.age;
|
|
path = "/home/alex/.ssh/alex.tadpole-codeberg.org.pub";
|
|
owner = "alex";
|
|
group = "users";
|
|
};
|
|
};
|
|
};
|
|
}
|