blob: 48263693b5015f0e2b53d25ed17c719ef20f51c1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
{
config,
lib,
hosts,
...
}: let
cfg = config.collinux.services.sshd;
pure = x: [x];
authorizedKeys =
hosts
|> builtins.mapAttrs (_: data: data.user_pubkey or null)
|> builtins.attrValues
|> builtins.filter (x: x != null);
in {
config = lib.mkIf cfg.enable {
services.openssh = {
enable = true;
allowSFTP = true;
hostKeys = pure {
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
};
listenAddresses = pure {
addr = "0.0.0.0";
port = cfg.port;
};
settings = {
PermitRootLogin = "yes";
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PubkeyAuthentication = true;
};
};
users.users = {
${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys;
root.openssh.authorizedKeys.keys = authorizedKeys;
};
systemd.services.openssh = {
after = ["network-online.target"];
wants = ["network-online.target"];
};
};
}
|
