initial testing

flake.nix

@@ -49,10 +49,12 @@
       # Use nixpkgs-fmt for 'nix fmt'
       formatter = forAllSystems (system: nixpkgs.legacyPackages."${system}".nixpkgs-fmt);
 
+      nixosModules = import ./nixos/modules/nixos;
+
       nixosConfigurations =
         let
           defaultModules =
-            # (builtins.attrValues nixosModules) ++
+            (builtins.attrValues nixosModules) ++
             [
               sops-nix.nixosModules.sops
             ];

nixos/hosts/common/nixos/default.nix

@@ -10,7 +10,7 @@
       #inputs.sops-nix.nixosModules.sops
       ./locale.nix
       ./nix.nix
-      ./openssh.nix
+      # ./openssh.nix
       ./packages.nix
     ]
     ++ (builtins.attrValues { });

nixos/hosts/nixosvm/default.nix

@@ -29,6 +29,7 @@
 
   networking.hostName = "nixosvm"; # Define your hostname.
 
+  modules.services.openssh = true;
 
   # Pick only one of the below networking options.
   # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

nixos/modules/nixos/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./system
+  ];
+}

nixos/modules/nixos/system/defaut.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./openssh.nix
+  ];
+}

nixos/modules/nixos/system/openssh.nix

@@ -0,0 +1,40 @@
+{ lib
+, config
+, ...
+}:
+let
+  cfg = config.modules.services.openssh;
+in
+{
+  options.modules.services.openssh = {
+    enable = lib.mkEnableOption "openssh";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      # TODO: Enable this when option becomes available
+      # Don't allow home-directory authorized_keys
+      # authorizedKeysFiles = lib.mkForce ["/etc/ssh/authorized_keys.d/%u"];
+      settings = {
+        # Harden
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        # Automatically remove stale sockets
+        StreamLocalBindUnlink = "yes";
+        # Allow forwarding ports to everywhere
+        GatewayPorts = "clientspecified";
+      };
+    };
+
+    # Passwordless sudo when SSH'ing with keys
+    security.pam.enableSSHAgentAuth = true;
+    # TODO: Enable this when option becomes available
+    # security.pam.sshAgentAuth = {
+    #   enable = true;
+    #   authorizedKeysFiles = [
+    #     "/etc/ssh/authorized_keys.d/%u"
+    #   ];
+    # };
+  };
+}