138 lines
3.5 KiB
Nix
138 lines
3.5 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
enabled = config.mod.ssh.enable;
|
|
|
|
authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
|
|
rootSSHKeyPath = "/etc/ssh";
|
|
in
|
|
{
|
|
options = {
|
|
mod.ssh = {
|
|
enable = lib.mkEnableOption "enable ssh module";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf enabled {
|
|
home-manager.users.alex = {
|
|
programs.ssh = {
|
|
enable = true;
|
|
enableDefaultConfig = false;
|
|
|
|
settings = {
|
|
"manatee" = {
|
|
HostName = "manatee";
|
|
User = "alex";
|
|
IdentityFile = "/home/alex/.ssh/alex.backwards-manatee";
|
|
Port = 1122;
|
|
};
|
|
|
|
"git.ppp.pm" = {
|
|
HostName = "git.ppp.pm";
|
|
IdentityFile = "/home/alex/.ssh/alex.backwards-git.ppp.pm";
|
|
};
|
|
|
|
"*" = {
|
|
ForwardAgent = false;
|
|
AddKeysToAgent = "no";
|
|
Compression = false;
|
|
ServerAliveInterval = 0;
|
|
ServerAliveCountMax = 3;
|
|
HashKnownHosts = false;
|
|
UserKnownHostsFile = "~/.ssh/known_hosts";
|
|
ControlMaster = "no";
|
|
ControlPath = "~/.ssh/master-%r@%n:%p";
|
|
ControlPersist = "no";
|
|
};
|
|
};
|
|
};
|
|
|
|
home.packages = [ pkgs.sshfs ];
|
|
};
|
|
|
|
environment.etc."ssh/authorized_keys_command" = {
|
|
mode = "0755";
|
|
text = ''
|
|
#!${pkgs.bash}/bin/bash
|
|
for file in ${authorizedKeysPath}/*; do
|
|
${pkgs.coreutils}/bin/cat "$file"
|
|
done
|
|
'';
|
|
};
|
|
|
|
services = {
|
|
openssh = {
|
|
enable = true;
|
|
ports = [ 1122 ];
|
|
|
|
hostKeys = [
|
|
{
|
|
path = "${rootSSHKeyPath}/root.backwards";
|
|
type = "ed25519";
|
|
}
|
|
];
|
|
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
KbdInteractiveAuthentication = false;
|
|
};
|
|
|
|
authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
|
|
authorizedKeysCommandUser = "root";
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
firewall = {
|
|
allowedTCPPorts = [ 1122 ];
|
|
};
|
|
};
|
|
|
|
age.secrets = {
|
|
"root.backwards" = {
|
|
file = ../../../../secrets/backwards/root.backwards.age;
|
|
path = "${rootSSHKeyPath}/root.backwards";
|
|
};
|
|
"root.backwards.pub" = {
|
|
file = ../../../../secrets/backwards/root.backwards.pub.age;
|
|
path = "${rootSSHKeyPath}/root.backwards.pub";
|
|
};
|
|
|
|
"alex.backwards-manatee" = {
|
|
file = ../../../../secrets/backwards/alex.backwards-manatee.age;
|
|
path = "/home/alex/.ssh/alex.backwards-manatee";
|
|
owner = "alex";
|
|
group = "users";
|
|
};
|
|
"alex.backwards-manatee.pub" = {
|
|
file = ../../../../secrets/backwards/alex.backwards-manatee.pub.age;
|
|
path = "/home/alex/.ssh/alex.backwards-manatee.pub";
|
|
owner = "alex";
|
|
group = "users";
|
|
};
|
|
|
|
"alex.pinwheel-backwards.pub" = {
|
|
file = ../../../../secrets/pinwheel/alex.pinwheel-backwards.pub.age;
|
|
path = "${authorizedKeysPath}/alex.pinwheel-backwards.pub";
|
|
};
|
|
|
|
"alex.backwards-git.ppp.pm" = {
|
|
file = ../../../../secrets/backwards/alex.backwards-git.ppp.pm.age;
|
|
path = "/home/alex/.ssh/alex.backwards-git.ppp.pm";
|
|
owner = "alex";
|
|
group = "users";
|
|
};
|
|
"alex.backwards-git.ppp.pm.pub" = {
|
|
file = ../../../../secrets/backwards/alex.backwards-git.ppp.pm.pub.age;
|
|
path = "/home/alex/.ssh/alex.backwards-git.ppp.pm.pub";
|
|
owner = "alex";
|
|
group = "users";
|
|
};
|
|
};
|
|
};
|
|
}
|