diff options
Diffstat (limited to 'os/srv/ssh.nix')
| -rw-r--r-- | os/srv/ssh.nix | 52 |
1 files changed, 33 insertions, 19 deletions
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix index ec39bbd..d36df00 100644 --- a/os/srv/ssh.nix +++ b/os/srv/ssh.nix @@ -13,7 +13,7 @@ in server = { enable = lib.mkEnableOption "enables the ssh server module"; enableInitrd = lib.mkEnableOption "enables ssh access during initrd"; - enableWireguard = lib.mkEnableOption "only allows connections from wireguard"; + microvm.enable = lib.mkEnableOption "enables ssh for microvms"; }; client = { enable = lib.mkEnableOption "enables the ssh client module"; @@ -27,6 +27,24 @@ in services.openssh = { enable = true; + listenAddresses = [ + { + addr = "127.0.0.1"; + port = 22; + } + { + addr = config.os.core.network.lan.ip; + port = 22; + } + { + addr = config.os.core.network.wg.ip; + port = 22; + } + { + addr = config.os.core.network.hs.ip; + port = 22; + } + ]; hostKeys = [ { path = "/etc/ssh/ssh_host_ed25519_key"; @@ -36,17 +54,27 @@ in settings = { PasswordAuthentication = false; KbdInteractiveAuthentication = false; - PermitRootLogin = "no"; + PermitRootLogin = if cfg.server.microvm.enable then "prohibit-password" else "no"; PubkeyAcceptedAlgorithms = "ssh-ed25519"; }; }; - users.users.${username}.openssh.authorizedKeys.keys = [ + users.users = ( + lib.optionalAttrs (username != "" && username != null) { + ${username}.openssh.authorizedKeys.keys = [ + "${keys.main} adikro@disroot.org" + ]; + } + ); + }) + + (lib.mkIf (cfg.server.enable && cfg.server.microvm.enable) { + users.users.root.openssh.authorizedKeys.keys = [ "${keys.main} adikro@disroot.org" ]; - }) + (lib.mkIf (cfg.server.enable && cfg.server.enableInitrd) { assertions = [ { @@ -75,13 +103,6 @@ in kernelParams = [ "ip=dhcp" ]; }; }) - (lib.mkIf (cfg.server.enable && cfg.server.enableWireguard) { - services.openssh.listenAddresses = [ - { - addr = "10.255.0.1"; - } - ]; - }) (lib.mkIf cfg.client.enable { programs.ssh.startAgent = true; @@ -89,6 +110,7 @@ in }) (lib.mkIf (cfg.client.enable && cfg.client.createAliases) { + # TODO use hjem programs.ssh.extraConfig = '' Host github.com codeberg.org IdentityFile /home/${username}/.ssh/main_id_ed25519.pub @@ -98,14 +120,6 @@ in Host oci HostName 130.162.223.123 User opc - - Host bibus - HostName bibus.top - User opc - - Host bibus-local - HostName 10.255.0.1 - user opc ''; systemd.tmpfiles.rules = [ "d /home/${username}/.ssh 0700 ${username} users - -" |