diff options
| author | adikro <adikro@disroot.org> | 2025-12-26 21:23:54 +0100 |
|---|---|---|
| committer | adikro <adikro@disroot.org> | 2025-12-26 21:23:54 +0100 |
| commit | 57bf6c7c1cbd8c51f358d8837704e567a487d547 (patch) | |
| tree | c8a587b50eeaad1707376092519b799b9e15b480 | |
| parent | db44d490d1b6e25212a5bd7cd0f3a390cf394b55 (diff) | |
moved ssh key, improved firewall settings for tailscale
| -rw-r--r-- | os/core/ssh.nix | 15 | ||||
| -rw-r--r-- | os/core/users.nix | 3 |
2 files changed, 8 insertions, 10 deletions
diff --git a/os/core/ssh.nix b/os/core/ssh.nix index 032bb44..b2cf411 100644 --- a/os/core/ssh.nix +++ b/os/core/ssh.nix @@ -1,11 +1,14 @@ -{ config, lib, pkgs, ... }: +{ config, lib, pkgs, username, ... }: let cfg = config.os.core.ssh; in { options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup"; config = lib.mkIf cfg.enable { - services.tailscale.enable = true; + services.tailscale = { + enable = true; + openFirewall = true; + }; services.openssh = { enable = true; @@ -18,10 +21,8 @@ in enableSSHSupport = true; pinentryPackage = pkgs.pinentry-curses; }; - - networking.firewall = { - trustedInterfaces = [ "tailscale0" ]; - allowedUDPPorts = [ 41641 ]; - }; + users.users.${username}.openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdQ7yU6kYnqM0zNQZC4M+lKLaNSmWHNvmxGy6mQ3wAXhgZbm1YzXF7/oirx1y8JQhukEkdF0ftSVw9DuZEoVwIOhGkJfFJwoWWdB8xZ215EZjqU3RczcMjI+SeyUMAzNdU84rF+lYF3NLHrdzLv98bq6S1W8a6w8+ofl7WZtDcdwOn5XMc9JV0YBuZj41mKgU7rzVOq61zRiCPsKhCIc/1MVPgHxVT4pN7j9eG0dgLKMluZY9BfnOf3SopcbfxFpPWVFNGN18RKQY7LbJ26FBRhGZQMwMYoHsN+cm0pY1Pw3uJ04volBtEk5Wj1czran1hobaKw9FL/N+g/VN7Ye5r20qyoKUmQZdl/b7E/xA6DpI5R1keW6t8uv/PK2BmjTY1E46tni6uwwywnikP05dsUghcVMWgd3bKQ+9zLyV0bIwlcmk+Ep9A6h0TIl5w/fsuUlHOGSWngeLN0CbRIcNmSOD1k8TpCJeCCVK39QSY+bu3Wite3ygH4jWTx4ofcZM/eoXUhg5fNymdtZYkurW8dps1JE6pj6ORgC0yY8QJCrMri3Ouzdwa/54zJwGQq+kV8EinEP+P5X8088bnS5SpShYKoWmQOAmtMSuIA8AWj6miIVVmZhz16FxnzbI+qOUMuhpdv6EDQtwfJLF+12ASinKMQvlOM3V9XwW13jBBnQ==" + ]; }; } diff --git a/os/core/users.nix b/os/core/users.nix index 7ef4f9a..9ce0e2d 100644 --- a/os/core/users.nix +++ b/os/core/users.nix @@ -9,9 +9,6 @@ in users.users.adam = { isNormalUser = true; shell = pkgs.fish; - openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdQ7yU6kYnqM0zNQZC4M+lKLaNSmWHNvmxGy6mQ3wAXhgZbm1YzXF7/oirx1y8JQhukEkdF0ftSVw9DuZEoVwIOhGkJfFJwoWWdB8xZ215EZjqU3RczcMjI+SeyUMAzNdU84rF+lYF3NLHrdzLv98bq6S1W8a6w8+ofl7WZtDcdwOn5XMc9JV0YBuZj41mKgU7rzVOq61zRiCPsKhCIc/1MVPgHxVT4pN7j9eG0dgLKMluZY9BfnOf3SopcbfxFpPWVFNGN18RKQY7LbJ26FBRhGZQMwMYoHsN+cm0pY1Pw3uJ04volBtEk5Wj1czran1hobaKw9FL/N+g/VN7Ye5r20qyoKUmQZdl/b7E/xA6DpI5R1keW6t8uv/PK2BmjTY1E46tni6uwwywnikP05dsUghcVMWgd3bKQ+9zLyV0bIwlcmk+Ep9A6h0TIl5w/fsuUlHOGSWngeLN0CbRIcNmSOD1k8TpCJeCCVK39QSY+bu3Wite3ygH4jWTx4ofcZM/eoXUhg5fNymdtZYkurW8dps1JE6pj6ORgC0yY8QJCrMri3Ouzdwa/54zJwGQq+kV8EinEP+P5X8088bnS5SpShYKoWmQOAmtMSuIA8AWj6miIVVmZhz16FxnzbI+qOUMuhpdv6EDQtwfJLF+12ASinKMQvlOM3V9XwW13jBBnQ==" - ]; extraGroups = lib.mkMerge [ [ "wheel" ] |