diff options
| -rw-r--r-- | hosts/ganymede/config.nix | 15 | ||||
| -rw-r--r-- | modules/services/nixos/ssh.nix | 9 |
2 files changed, 7 insertions, 17 deletions
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 4a412b4..e44e4a8 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -9,11 +9,6 @@ }; "caddy-env".file = ./caddy-env.age; - - "wg-key" = { - file = ./ganymede-wg-key.age; - owner = "systemd-network"; - }; }; terminal = { @@ -40,10 +35,6 @@ gateway = "192.168.50.1"; }; }; - # tailscale = { - # enable = true; - # tailnet = "collinux.tailnet"; - # }; sshd = { enable = true; bind_host = "0.0.0.0"; @@ -61,12 +52,6 @@ bind_host = "127.0.0.1"; root_url = "ganymede.collinux.tailnet:8010"; }; - - # headscale = { - # enable = true; - # root_url = "headscale.williamsfam.us.com"; - # caddy.enable = true; - # }; }; }; }; diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix index cfe7883..7868a31 100644 --- a/modules/services/nixos/ssh.nix +++ b/modules/services/nixos/ssh.nix @@ -8,7 +8,6 @@ in { config = lib.mkIf cfg.enable { services.openssh = { enable = true; - openFirewall = false; hostKeys = [ { path = "/etc/ssh/ssh_host_ed25519_key"; @@ -24,9 +23,15 @@ in { ]; settings = { - PermitRootLogin = "prohibit-password"; + PermitRootLogin = "prohibit-password"; # deploy-rs uses root account PasswordAuthentication = false; }; + + knownHosts = { + "mercury".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN"; + "jupiter".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8"; + "ganymede".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9"; + }; }; systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable { |