nixos/hosts/common/optional/openssh.nix

36 lines
888 B
Nix
Raw Permalink Normal View History

2024-05-12 19:58:55 +01:00
{ lib, config, ... }:
let
sshPort = 22;
2024-05-25 18:34:37 +01:00
hasOptinPersistence = config.environment.persistence ? "/persist";
2024-05-25 16:31:51 +01:00
2024-05-12 19:58:55 +01:00
in
{
services.openssh = {
enable = true;
ports = [ sshPort ];
2024-06-22 14:37:19 +01:00
authorizedKeysFiles = lib.mkForce [ "/etc/ssh/authorized_keys.d/%u" ];
2024-05-22 17:23:17 +01:00
hostKeys = [{
path = "${lib.optionalString hasOptinPersistence "/persist"}/etc/ssh/ssh_host_ed25519_key";
2024-05-22 17:23:17 +01:00
type = "ed25519";
}];
2024-05-12 19:58:55 +01:00
settings = {
2024-05-22 17:23:17 +01:00
PasswordAuthentication = false;
2024-05-12 19:58:55 +01:00
PermitRootLogin = "no";
2024-05-22 17:23:17 +01:00
PubKeyAuthentication = "yes";
2024-05-12 19:58:55 +01:00
StreamLocalBindUnlink = "yes";
2024-05-22 17:23:17 +01:00
UsePAM = true;
2024-05-12 19:58:55 +01:00
};
};
2024-05-22 17:23:17 +01:00
security.pam = {
sshAgentAuth.enable = true;
};
2024-05-23 10:48:00 +01:00
programs.ssh.extraConfig = ''
Host git.bitlab21.com
IdentitiesOnly yes
StrictHostKeyChecking no
IdentityFile /etc/ssh/deploy_key-ssh-ed25519
'';
2024-05-12 19:58:55 +01:00
networking.firewall.allowedTCPPorts = [ sshPort ];
}