SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-22 04:34:25 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Create networking abstraction on top of nebula

Browse source
This commit is contained in:
SebastianStork 2026-01-11 19:13:30 +01:00
parent 6804112df6
commit 252abe9443
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
15 changed files with 223 additions and 165 deletions
Download patch file Download diff file Expand all files Collapse all files

58
modules/system/services/nebula/sshd.nix
View file

@ -1,58 +0,0 @@
{
config,
self,
lib,
...
}:
let
cfg = config.custom.services.nebula.node;
in
{
options.custom.services.nebula.node.sshd.enable = lib.mkEnableOption "" // {
default = true;
};
config = lib.mkIf (cfg.enable && cfg.sshd.enable) {
meta.ports.tcp = [ 22 ];
services = {
openssh = {
enable = true;
openFirewall = false;
ports = [ ];
listenAddresses = lib.singleton {
addr = cfg.address;
port = 22;
};
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
};
};
nebula.networks.mesh.firewall.inbound =
config.custom.services.nebula.peers
|> lib.filter (node: node.isClient)
|> lib.map (nebula: {
port = 22;
proto = "tcp";
host = nebula.name;
});
};
systemd.services.sshd = {
requires = [ "nebula@mesh.service" ];
after = [ "nebula@mesh.service" ];
};
users.users.seb.openssh.authorizedKeys.keyFiles =
self.nixosConfigurations
|> lib.filterAttrs (name: _: name != config.networking.hostName)
|> lib.attrValues
|> lib.filter (value: value.config |> lib.hasAttr "home-manager")
|> lib.map (value: value.config.home-manager.users.seb.custom.programs.ssh)
|> lib.filter (ssh: ssh.enable)
|> lib.map (ssh: ssh.publicKeyPath);
};
}