Jan/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: Jan:ec3d9e6049ee02c7957b0a8c0fe7fdd199a7821f
Branches Tags
Jan:main
Jan:disko
...
compare: Jan:0cf53a97cf67da1bcdba10119cd6999dff36f554
Branches Tags
Jan:main
Jan:disko

2 Commits
ec3d9e6049 ... 0cf53a97cf

Author SHA1 Message Date
Jan-Bulthuis
0cf53a97cf Restricted SSH access 2025-05-30 16:15:52 +02:00
Jan-Bulthuis
46fe5b8056 Set local password 2025-05-30 16:15:42 +02:00
2 changed files with 22 additions and 15 deletions
Show Stats Expand all files Collapse all files

33
modules/nixos/ssh.nix
View File

@ -9,19 +9,24 @@ in
enable = mkEnableOption "ssh"; enable = mkEnableOption "ssh";
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.openssh.enable = true; services.openssh = {
# TODO: Is this default configuration secure? enable = true;
settings = {
services.openssh.hostKeys = mkIf (config.modules.impermanence.enable) [ PasswordAuthentication = false;
{ KbdInteractiveAuthentication = false;
type = "ed25519"; PermitRootLogin = "no";
path = "/persist/system/etc/ssh/ssh_host_ed25519_key"; };
} hostKeys = mkIf (config.modules.impermanence.enable) [
{ {
type = "rsa"; type = "ed25519";
bits = 4096; path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
path = "/persist/system/etc/ssh/ssh_host_rsa_key"; }
} {
]; type = "rsa";
bits = 4096;
path = "/persist/system/etc/ssh/ssh_host_rsa_key";
}
];
};
}; };
} }

4
profiles/nixos/vm.nix
View File

@ -33,7 +33,8 @@ in
}; };
# Local user # Local user
sops.secrets."ssh-keys/admin-pub" = { }; modules.secrets.secrets."ssh-keys/admin-pub" = { };
modules.secrets.secrets."passwords/local-hashed".neededForUsers = true;
services.getty.autologinUser = "local"; services.getty.autologinUser = "local";
security.sudo.extraRules = [ security.sudo.extraRules = [
{ {
@ -43,6 +44,7 @@ in
]; ];
users.mutableUsers = false; users.mutableUsers = false;
users.users.local = { users.users.local = {
hashedPasswordFile = config.sops.secrets."passwords/local-hashed".path;
extraGroups = [ "wheel" ]; extraGroups = [ "wheel" ];
openssh.authorizedKeys.keyFiles = [ openssh.authorizedKeys.keyFiles = [
config.sops.secrets."ssh-keys/admin-pub".path config.sops.secrets."ssh-keys/admin-pub".path