moved ssh and tailscale to srv, revamped netwroking modules

1 files changed, 55 insertions, 0 deletions

diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix
new file mode 100644
index 0000000..089fb32
--- /dev/null
+++ b/os/srv/ssh.nix
@@ -0,0 +1,55 @@
+{
+  config,
+  lib,
+  username,
+  ...
+}:
+let
+  cfg = config.os.srv.ssh;
+  keys = {
+    main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4";
+    oci = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgWmRbNTP/kcaZ8JNV1boVTZ/FQVV4qP/9eTKL9buzDvz9HJdgyWmbCiVZicNSert31IRdWOF/wm1sFjZ48nSkGDHbrnc//MPSdHULTx+kMES/NW9SZwwpaquFIJClrObysxrFYBAqweD+DJ3bp451WIymBs7lRBMNKPgoHBpJ5WN2CfIQjl60Jqnli7ML5seCsrquPEemcMPr1TFPmrFCbirzgDVkzCLL5kOowSD2uprtSA08fFm/pZ6nZh6KTQaEgPO4zR9tK+NQ46oCynWwBTI7JOPB4/LtIOiC5TjEUrkXZ/sJzpCBiNPYSRI8RWnAD0N/uVFJ4EYPUKLO2C/d";
+  };
+in
+{
+  options.os.srv.ssh.enable = lib.mkEnableOption "enables ssh server setup";
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+
+    programs.ssh.startAgent = true;
+    services.gnome.gcr-ssh-agent.enable = false;
+
+    users.users.${username}.openssh.authorizedKeys.keys = [ "${keys.main} adikro@disroot.org" ];
+
+    environment.etc."ssh/allowed_signers".text = "adikro@disroot.org ${keys.main}";
+    home-manager.users.${username} = {
+      programs.ssh = {
+        enable = true;
+        enableDefaultConfig = false;
+
+        matchBlocks = {
+          "github.com codeberg.org" = {
+            identityFile = "~/.ssh/main_id_ed25519.pub";
+            identitiesOnly = true;
+            user = "git";
+          };
+          "oci" = {
+            hostname = "130.162.223.123";
+            user = "opc";
+          };
+        };
+      };
+      home.file = {
+        ".ssh/main_id_ed25519.pub".text = keys.main;
+        ".ssh/oci.pub".text = keys.oci;
+      };
+    };
+  };
+}