tailscale: Disable ssh for all hosts

hosts/desktop/default.nix

@@ -26,10 +26,7 @@
     services = {
       gc.enable = true;
       sound.enable = true;
-      tailscale = {
-        enable = true;
-        ssh.enable = true;
-      };
+      tailscale.enable = true;
       nebula.node = {
         enable = true;
         address = "10.254.250.1";

hosts/laptop/default.nix

@@ -29,10 +29,7 @@
       wlan.enable = true;
       bluetooth.enable = true;
       sound.enable = true;
-      tailscale = {
-        enable = true;
-        ssh.enable = true;
-      };
+      tailscale.enable = true;
       nebula.node = {
         enable = true;
         address = "10.254.250.3";

hosts/vps-monitor/default.nix

@@ -21,10 +21,7 @@
     boot.loader.grub.enable = true;
 
     services = {
-      tailscale = {
-        enable = true;
-        ssh.enable = true;
-      };
+      tailscale.enable = true;
 
       nebula.node = {
         enable = true;

hosts/vps-private/default.nix

@@ -27,7 +27,6 @@
       services = {
         tailscale = {
           enable = true;
-          ssh.enable = true;
           exitNode.enable = true;
         };
 

hosts/vps-public/default.nix

@@ -21,10 +21,7 @@
     boot.loader.systemd-boot.enable = true;
 
     services = {
-      tailscale = {
-        enable = true;
-        ssh.enable = true;
-      };
+      tailscale.enable = true;
 
       nebula.node = {
         enable = true;

modules/home/programs/git.nix

@@ -39,15 +39,11 @@
         };
       };
 
-      ssh = {
-        enable = true;
-        enableDefaultConfig = false;
-        matchBlocks =
-          config.custom.sops.secrets.ssh-key
-          |> lib.mapAttrs (name: _: { identityFile = config.sops.secrets."ssh-key/${name}".path; });
-      };
-
       lazygit.enable = true;
+
+      ssh.matchBlocks =
+        config.custom.sops.secrets.ssh-key
+        |> lib.mapAttrs (name: _: { identityFile = config.sops.secrets."ssh-key/${name}".path; });
     };
   };
 }

modules/home/programs/ssh.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  self,
+  lib,
+  ...
+}@moduleArgs:
+let
+  cfg = config.custom.programs.ssh;
+in
+{
+  options.custom.programs.ssh = {
+    enable = lib.mkEnableOption "";
+    hostName = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = moduleArgs.osConfig.networking.hostName or "";
+    };
+    publicKeyPath = lib.mkOption {
+      type = lib.types.path;
+      default = "${self}/users/${config.home.username}/@${cfg.hostName}/keys/ssh.pub";
+    };
+  };
+
+  config = lib.mkIf config.custom.programs.ssh.enable {
+    programs.ssh = {
+      enable = true;
+      enableDefaultConfig = false;
+    };
+  };
+}

modules/home/sops.nix

@@ -7,36 +7,35 @@
 }@moduleArgs:
 let
   cfg = config.custom.sops;
-
-  absoluteSecretsPath = "${self}/${cfg.secretsFile}";
 in
 {
   imports = [ inputs.sops.homeManagerModules.sops ];
 
   options.custom.sops = {
     enable = lib.mkEnableOption "";
-    agePublicKey = lib.mkOption {
-      type = lib.types.nonEmptyStr;
-      default = "";
-    };
     hostName = lib.mkOption {
       type = lib.types.nonEmptyStr;
       default = moduleArgs.osConfig.networking.hostName or "";
     };
-    secretsFile = lib.mkOption {
+    agePublicKey = lib.mkOption {
       type = lib.types.nonEmptyStr;
-      default = "users/${config.home.username}/@${cfg.hostName}/secrets.json";
+      default =
+        "${self}/users/${config.home.username}/@${cfg.hostName}/keys/age.pub" |> lib.readFile |> lib.trim;
+    };
+    secretsFile = lib.mkOption {
+      type = lib.types.path;
+      default = "${self}/users/${config.home.username}/@${cfg.hostName}/secrets.json";
     };
     secrets = lib.mkOption {
       type = lib.types.anything;
-      default = absoluteSecretsPath |> lib.readFile |> lib.strings.fromJSON;
+      default = cfg.secretsFile |> lib.readFile |> lib.strings.fromJSON;
     };
   };
 
   config = lib.mkIf cfg.enable {
     sops = {
       age.sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ];
-      defaultSopsFile = absoluteSecretsPath;
+      defaultSopsFile = cfg.secretsFile;
     };
   };
 }

modules/system/services/nebula/sshd.nix

@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  self,
+  lib,
+  ...
+}:
 let
   cfg = config.custom.services.nebula.node;
 in
@@ -25,13 +30,18 @@ in
           addr = cfg.address;
           inherit (cfg.sshd) port;
         };
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+          PermitRootLogin = "no";
+        };
       };
 
       nebula.networks.mesh.firewall.inbound =
         config.custom.services.nebula.peers
         |> lib.filter (node: node.isClient)
         |> lib.map (nebula: {
-          port = "22";
+          inherit (cfg.sshd) port;
           proto = "tcp";
           host = nebula.name;
         });
@@ -41,5 +51,14 @@ in
       requires = [ "nebula@mesh.service" ];
       after = [ "nebula@mesh.service" ];
     };
+
+    users.users.seb.openssh.authorizedKeys.keyFiles =
+      self.nixosConfigurations
+      |> lib.filterAttrs (name: _: name != config.networking.hostName)
+      |> lib.attrValues
+      |> lib.filter (value: value.config |> lib.hasAttr "home-manager")
+      |> lib.map (value: value.config.home-manager.users.seb.custom.programs.ssh)
+      |> lib.filter (ssh: ssh.enable)
+      |> lib.map (ssh: ssh.publicKeyPath);
   };
 }

users/seb/@desktop/home.nix

@@ -3,10 +3,7 @@ _: {
 
   home.stateVersion = "23.11";
 
-  custom = {
-    sops.agePublicKey = "age1p32cyzakxtcx346ej82ftln4r2aw2pcuazq3583s85nzsan4ygqsj32hjf";
-    theme = "dark";
-  };
+  custom.theme = "dark";
 
   wayland.windowManager.hyprland.settings.monitor = [ "DP-1,2560x1440@180,0x0,1" ];
 }

users/seb/@desktop/keys/age.pub

@@ -0,0 +1 @@
+age1p32cyzakxtcx346ej82ftln4r2aw2pcuazq3583s85nzsan4ygqsj32hjf

users/seb/@desktop/keys/ssh.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBUORYC3AvTPQmtUEApTa9DvHoJy4mjuQy8abSjCcDd seb@desktop

users/seb/@laptop/home.nix

@@ -4,7 +4,6 @@ _: {
   home.stateVersion = "24.11";
 
   custom = {
-    sops.agePublicKey = "age190mf9wx4ct7qvne3ly9j3cj9740z5wnfhsl6vsc5wtfyc5pueuas9hnjtr";
     theme = "light";
     programs.brightnessctl.enable = true;
   };

users/seb/@laptop/keys/age.pub

@@ -0,0 +1 @@
+age190mf9wx4ct7qvne3ly9j3cj9740z5wnfhsl6vsc5wtfyc5pueuas9hnjtr

users/seb/@laptop/keys/ssh.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID1WFOdZCvfb1ZRycBGK0x+3viQpkkl6CQ3cV/Mf3gAJ seb@laptop

users/seb/home.nix

@@ -27,6 +27,7 @@
         aliases.enable = true;
         direnv.enable = true;
       };
+      ssh.enable = true;
       git.enable = true;
       kitty.enable = true;
       vscode.enable = true;