dotfiles/modules/nixos/services/sshd.nix

50 lines
1.2 KiB
Nix
Raw Normal View History

2024-01-10 04:11:11 +00:00
# SSHD service for allowing SSH access to my machines.
2024-04-20 13:42:06 +00:00
{
config,
pkgs,
lib,
...
}:
{
2022-09-20 11:50:45 +00:00
options = {
2024-03-24 17:16:20 +00:00
publicKeys = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str);
2022-09-20 11:50:45 +00:00
description = "Public SSH key authorized for this system.";
default = null;
2022-09-20 11:50:45 +00:00
};
permitRootLogin = lib.mkOption {
type = lib.types.str;
description = "Root login settings.";
default = "no";
};
2022-09-20 11:50:45 +00:00
};
config = lib.mkIf config.services.openssh.enable {
services.openssh = {
ports = [ 22 ];
allowSFTP = true;
settings = {
GatewayPorts = "no";
X11Forwarding = false;
PasswordAuthentication = false;
PermitRootLogin = config.permitRootLogin;
2023-01-21 14:29:03 +00:00
};
};
2022-09-20 11:50:45 +00:00
2024-04-20 13:42:06 +00:00
users.users.${config.user}.openssh.authorizedKeys.keys = lib.mkIf (
config.publicKeys != null
) config.publicKeys;
2022-10-13 23:40:30 +00:00
# Implement a simple fail2ban service for sshd
services.sshguard.enable = true;
2022-11-03 12:51:51 +00:00
# Add terminfo for SSH from popular terminal emulators
# Fix: terminfo now installs contour, which is broken on ARM
# - https://github.com/NixOS/nixpkgs/pull/253334
# - Will disable until fixed
environment.enableAllTerminfo = pkgs.stdenv.isLinux && pkgs.stdenv.isx86_64;
};
2022-09-20 11:50:45 +00:00
}