SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 15:11:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

nebula/sshd: Only allow key auth

Browse source
This commit is contained in:
SebastianStork 2026-01-07 20:40:09 +01:00
parent 2f4a83a906
commit 72ed799826
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
6 changed files with 57 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

23
modules/system/services/nebula/sshd.nix
View file

@ -1,4 +1,9 @@
{ config, lib, ... }:
{
config,
self,
lib,
...
}:
let
cfg = config.custom.services.nebula.node;
in
@ -25,13 +30,18 @@ in
addr = cfg.address;
inherit (cfg.sshd) port;
};
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
};
};
nebula.networks.mesh.firewall.inbound =
config.custom.services.nebula.peers
|> lib.filter (node: node.isClient)
|> lib.map (nebula: {
port = "22";
inherit (cfg.sshd) port;
proto = "tcp";
host = nebula.name;
});
@ -41,5 +51,14 @@ in
requires = [ "nebula@mesh.service" ];
after = [ "nebula@mesh.service" ];
};
users.users.seb.openssh.authorizedKeys.keyFiles =
self.nixosConfigurations
|> lib.filterAttrs (name: _: name != config.networking.hostName)
|> lib.attrValues
|> lib.filter (value: value.config |> lib.hasAttr "home-manager")
|> lib.map (value: value.config.home-manager.users.seb.custom.programs.ssh)
|> lib.filter (ssh: ssh.enable)
|> lib.map (ssh: ssh.publicKeyPath);
};
}