1 files changed, 73 insertions, 38 deletions
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix
index 089fb32..2c7a4ac 100644
--- a/os/srv/ssh.nix
+++ b/os/srv/ssh.nix
@@ -6,50 +6,85 @@
 }:
 let
   cfg = config.os.srv.ssh;
-  keys = {
-    main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4";
-    oci = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgWmRbNTP/kcaZ8JNV1boVTZ/FQVV4qP/9eTKL9buzDvz9HJdgyWmbCiVZicNSert31IRdWOF/wm1sFjZ48nSkGDHbrnc//MPSdHULTx+kMES/NW9SZwwpaquFIJClrObysxrFYBAqweD+DJ3bp451WIymBs7lRBMNKPgoHBpJ5WN2CfIQjl60Jqnli7ML5seCsrquPEemcMPr1TFPmrFCbirzgDVkzCLL5kOowSD2uprtSA08fFm/pZ6nZh6KTQaEgPO4zR9tK+NQ46oCynWwBTI7JOPB4/LtIOiC5TjEUrkXZ/sJzpCBiNPYSRI8RWnAD0N/uVFJ4EYPUKLO2C/d";
-  };
+  keys.main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4";
 in
 {
-  options.os.srv.ssh.enable = lib.mkEnableOption "enables ssh server setup";
-
-  config = lib.mkIf cfg.enable {
-    services.openssh = {
-      enable = true;
-      settings = {
-        PasswordAuthentication = false;
-        KbdInteractiveAuthentication = false;
-      };
+  options.os.srv.ssh = {
+    server = {
+      enable = lib.mkEnableOption "enables the ssh server module";
+      enableWireguard = lib.mkEnableOption "only allows connections from wireguard";
     };
+    client = {
+      enable = lib.mkEnableOption "enables the ssh client module";
+      createAliases = lib.mkEnableOption "enables system-wide SSH shortcuts";
+    };
+    enableSigning = lib.mkEnableOption "enables signing git commits with ssh keys";
+  };
 
-    programs.ssh.startAgent = true;
-    services.gnome.gcr-ssh-agent.enable = false;
-
-    users.users.${username}.openssh.authorizedKeys.keys = [ "${keys.main} adikro@disroot.org" ];
-
-    environment.etc."ssh/allowed_signers".text = "adikro@disroot.org ${keys.main}";
-    home-manager.users.${username} = {
-      programs.ssh = {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.server.enable {
+      services.openssh = {
         enable = true;
-        enableDefaultConfig = false;
 
-        matchBlocks = {
-          "github.com codeberg.org" = {
-            identityFile = "~/.ssh/main_id_ed25519.pub";
-            identitiesOnly = true;
-            user = "git";
-          };
-          "oci" = {
-            hostname = "130.162.223.123";
-            user = "opc";
-          };
+        hostKeys = [
+          {
+            path = "/etc/ssh/ssh_host_ed25519_key";
+            type = "ed25519";
+          }
+        ];
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+          PermitRootLogin = "no";
+
+          PubkeyAcceptedAlgorithms = "ssh-ed25519";
         };
       };
-      home.file = {
-        ".ssh/main_id_ed25519.pub".text = keys.main;
-        ".ssh/oci.pub".text = keys.oci;
-      };
-    };
-  };
+
+      users.users.${username}.openssh.authorizedKeys.keys = [
+        "${keys.main} adikro@disroot.org"
+      ];
+    })
+    (lib.mkIf (cfg.server.enable && cfg.server.enableWireguard) {
+      services.openssh.listenAddresses = [
+        {
+          addr = "10.255.0.1";
+        }
+      ];
+    })
+
+    (lib.mkIf cfg.client.enable {
+      programs.ssh.startAgent = true;
+      services.gnome.gcr-ssh-agent.enable = false;
+    })
+
+    (lib.mkIf (cfg.client.enable && cfg.client.createAliases) {
+      programs.ssh.extraConfig = ''
+        Host github.com codeberg.org
+          IdentityFile /home/${username}/.ssh/main_id_ed25519.pub
+          IdentitiesOnly yes
+          User git
+
+        Host oci
+          HostName 130.162.223.123
+          User opc
+
+        Host bibus
+          HostName bibus.top
+          User opc
+
+        Host bibus-local
+          HostName 10.255.0.1
+          user opc
+      '';
+      systemd.tmpfiles.rules = [
+        "d /home/${username}/.ssh 0700 ${username} users - -"
+        "f /home/${username}/.ssh/main_id_ed25519.pub 0644 ${username} users - ${keys.main}"
+      ];
+    })
+
+    (lib.mkIf cfg.enableSigning {
+      environment.etc."ssh/allowed_signers".text = "adikro@disroot.org ${keys.main}";
+    })
+  ];
 }