SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 12:51:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

nebula: Configure ssh server

Browse source
This commit is contained in:
SebastianStork 2026-01-01 23:46:15 +01:00
parent 94ac7bbca3
commit b4191c56aa
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
2 changed files with 39 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
modules/system/services/nebula/default.nix
View file

@ -61,11 +61,11 @@ in
};
sops.secrets."nebula/host-key" = {
owner = config.users.users.nebula-main.name;
restartUnits = [ "nebula@main.service" ];
owner = config.users.users.nebula-mesh.name;
restartUnits = [ "nebula@mesh.service" ];
};
services.nebula.networks.main = {
services.nebula.networks.mesh = {
enable = true;
ca = ./ca.crt;
@ -106,5 +106,7 @@ in
logging.level = "warning";
};
};
networking.firewall.trustedInterfaces = [ "nebula.mesh" ];
};
}

34
modules/system/services/nebula/sshd.nix Normal file
View file

@ -0,0 +1,34 @@
{ config, lib, ... }:
let
cfg = config.custom.services.nebula.node;
in
{
options.custom.services.nebula.node.sshd = {
enable = lib.mkEnableOption "" // {
default = true;
};
port = lib.mkOption {
type = lib.types.port;
default = 22;
};
};
config = lib.mkIf (cfg.enable && cfg.sshd.enable) {
meta.ports.tcp = [ cfg.sshd.port ];
services.openssh = {
enable = true;
openFirewall = false;
ports = [ ];
listenAddresses = lib.singleton {
addr = cfg.address;
inherit (cfg.sshd) port;
};
};
systemd.services.sshd = {
requires = [ "nebula@mesh.service" ];
after = [ "nebula@mesh.service" ];
};
};
}