initial testing

This commit is contained in:
truxnell 2024-03-23 10:57:18 +11:00
parent 908f866b8a
commit c7c690d7b8
6 changed files with 55 additions and 2 deletions

View file

@ -49,10 +49,12 @@
# Use nixpkgs-fmt for 'nix fmt'
formatter = forAllSystems (system: nixpkgs.legacyPackages."${system}".nixpkgs-fmt);
nixosModules = import ./nixos/modules/nixos;
nixosConfigurations =
let
defaultModules =
# (builtins.attrValues nixosModules) ++
(builtins.attrValues nixosModules) ++
[
sops-nix.nixosModules.sops
];

View file

@ -10,7 +10,7 @@
#inputs.sops-nix.nixosModules.sops
./locale.nix
./nix.nix
./openssh.nix
# ./openssh.nix
./packages.nix
]
++ (builtins.attrValues { });

View file

@ -29,6 +29,7 @@
networking.hostName = "nixosvm"; # Define your hostname.
modules.services.openssh = true;
# Pick only one of the below networking options.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.

View file

@ -0,0 +1,5 @@
{
imports = [
./system
];
}

View file

@ -0,0 +1,5 @@
{
imports = [
./openssh.nix
];
}

View file

@ -0,0 +1,40 @@
{ lib
, config
, ...
}:
let
cfg = config.modules.services.openssh;
in
{
options.modules.services.openssh = {
enable = lib.mkEnableOption "openssh";
};
config = lib.mkIf cfg.enable {
services.openssh = {
enable = true;
# TODO: Enable this when option becomes available
# Don't allow home-directory authorized_keys
# authorizedKeysFiles = lib.mkForce ["/etc/ssh/authorized_keys.d/%u"];
settings = {
# Harden
PasswordAuthentication = false;
PermitRootLogin = "no";
# Automatically remove stale sockets
StreamLocalBindUnlink = "yes";
# Allow forwarding ports to everywhere
GatewayPorts = "clientspecified";
};
};
# Passwordless sudo when SSH'ing with keys
security.pam.enableSSHAgentAuth = true;
# TODO: Enable this when option becomes available
# security.pam.sshAgentAuth = {
# enable = true;
# authorizedKeysFiles = [
# "/etc/ssh/authorized_keys.d/%u"
# ];
# };
};
}