Spring Cleaning

- create new module, `system`, that consumes the `boot` module and takes
in the more system-interested services from the `services` module
- touch up left over services (which are more self-hosting interested)
- touch up yo and yoshi configs

1 files changed, 96 insertions, 0 deletions

diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix
new file mode 100644
index 0000000..c0c8c30
--- /dev/null
+++ b/modules/services/nixos/openssh.nix
@@ -0,0 +1,96 @@
+{
+  config,
+  lib,
+  pkgs,
+  hosts,
+  ...
+}: let
+  cfg = config.collinux.services.sshd;
+
+  anyAttr = attr: cfg.portConfig |> builtins.map (x: x.${attr} != null) |> builtins.any (x: x);
+  anyOTP = cfg.portConfig |> builtins.map (x: x.otp == true) |> builtins.any (x: x);
+
+  authorizedKeys =
+    hosts
+    |> builtins.mapAttrs (_: data: data.user_pubkey or null)
+    |> builtins.attrValues
+    |> builtins.filter (x: x != null);
+in {
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = cfg.portConfig |> builtins.map (x: x.port);
+
+    services.openssh = {
+      enable = true;
+      allowSFTP = false;
+
+      hostKeys = [
+        {
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          type = "ed25519";
+        }
+      ];
+
+      listenAddresses =
+        cfg.portConfig
+        |> builtins.map (x: {
+          addr = "0.0.0.0";
+          port = x.port;
+        });
+
+      # Lock down everything by default
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+        PubkeyAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        AllowAgentForwarding = false;
+      };
+
+      extraConfig =
+        cfg.portConfig
+        |> builtins.map (x:
+          lib.concatStringsSep "\n" [
+            "Match LocalPort ${toString x.port}"
+            (
+              if x.otp
+              then ''
+                ChallengeResponseAuthentication yes
+                PubkeyAuthentication yes
+                KbdInteractiveAuthentication yes
+                AuthenticationMethods publickey,keyboard-interactive:pam
+              ''
+              else ''
+                PubkeyAuthentication yes
+                AuthenticationMethods publickey
+              ''
+            )
+            (lib.optionalString x.rootLogin "PermitRootLogin yes")
+          ])
+        |> lib.concatStringsSep "\n\n";
+    };
+
+    security.pam.services = lib.optionalAttrs anyOTP {
+      login.googleAuthenticator.enable = true;
+
+      sshd.text = ''
+        account required pam_unix.so
+
+        auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so nullok no_increment_hotp
+        auth sufficient pam_permit.so
+
+        session required pam_env.so conffile=/etc/pam/environment readenv=0
+        session required pam_unix.so
+        session required pam_loginuid.so
+        session optional ${pkgs.systemd}/lib/security/pam_systemd.so
+      '';
+    };
+
+    users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys;
+    users.users."root".openssh.authorizedKeys.keys = lib.mkIf (anyAttr "rootLogin") authorizedKeys;
+
+    systemd.services."openssh" = {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+  };
+}