dotfiles/modules/nixos/services/sshd.nix

38 lines
995 B
Nix
Raw Normal View History

2022-09-20 11:50:45 +00:00
{ config, pkgs, lib, ... }: {
options = {
publicKey = lib.mkOption {
2023-01-21 14:29:03 +00:00
type = lib.types.nullOr lib.types.str;
2022-09-20 11:50:45 +00:00
description = "Public SSH key authorized for this system.";
};
permitRootLogin = lib.mkOption {
type = lib.types.str;
description = "Root login settings.";
default = "no";
};
2022-09-20 11:50:45 +00:00
};
2023-01-21 14:29:03 +00:00
config = lib.mkIf
(pkgs.stdenv.isLinux && !config.wsl.enable && config.publicKey != null) {
services.openssh = {
enable = true;
ports = [ 22 ];
passwordAuthentication = false;
gatewayPorts = "no";
forwardX11 = false;
allowSFTP = true;
permitRootLogin = config.permitRootLogin;
};
2022-09-20 11:50:45 +00:00
2023-01-21 14:29:03 +00:00
users.users.${config.user}.openssh.authorizedKeys.keys =
[ config.publicKey ];
2022-10-13 23:40:30 +00:00
2023-01-21 14:29:03 +00:00
# Implement a simple fail2ban service for sshd
services.sshguard.enable = true;
2022-11-03 12:51:51 +00:00
2023-01-21 14:29:03 +00:00
# Add terminfo for SSH from popular terminal emulators
environment.enableAllTerminfo = true;
};
2022-09-20 11:50:45 +00:00
}