Add ssh configuration

nixos/modules/default.nix

@@ -8,6 +8,7 @@ in {
     ./audio.nix
     ./desktop.nix
     ./yubikey.nix
+    ./ssh.nix
   ];
 
   options.kevin = {
@@ -21,14 +22,15 @@ in {
     ({
       nixpkgs.config.allowUnfree = true;
       i18n.defaultLocale = "en_US.UTF-8";
-      
+      kevin.ssh.server.enable = true;     
+ 
       console = {
         font = "Lat2-Terminus16";
         keyMap = "de";
       };
 
-      services.xserver.layout = "de";
-      
+      services.xserver.layout = "de";   
+   
       environment.systemPackages = with pkgs; [
         vim
         wget
@@ -77,6 +79,7 @@ in {
         description = "Kevin Kandlbinder";
         extraGroups = [ "wheel" "docker" "dialout" ]; 
       };
+      kevin.ssh.authorized.kevin = true;
     })
     (mkIf (cfg.defaults == "laptop") {
       kevin.power.mode = "laptop";

nixos/modules/networking.nix

@@ -6,6 +6,7 @@ in {
   options.kevin.networking = {
     enable = mkEnableOption "kevins networking";
     avahi.enable = mkEnableOption "avahi";
+    ssh.enable = mkEnableOption "ssh";
     firewall.wireguard = mkEnableOption "wireguard exceptions";
     firewall.syncthing = mkEnableOption "syncthing exceptions";
   };
@@ -24,6 +25,17 @@ in {
  
       networking.firewall.allowedUDPPorts = [ 5353 ];
     })
+    (mkIf cfg.ssh.enable {
+      services.openssh = {
+        enable = true;
+        # require public key authentication for better security
+        passwordAuthentication = false;
+        kbdInteractiveAuthentication = false;
+        #permitRootLogin = "yes";
+      };
+      
+      networking.firewall.allowedTCPPorts = [ 22 ];
+    })
     (mkIf cfg.firewall.wireguard {
       networking.firewall = {
         # if packets are still dropped, they will show up in dmesg

nixos/modules/ssh.nix

@@ -0,0 +1,21 @@
+{ lib, pkgs, config, ... }:
+with lib;                      
+let
+  cfg = config.kevin.ssh;
+in {
+  options.kevin.ssh = {
+    server.enable = mkEnableOption "kevins ssh";
+    authorized.kevin = mkEnableOption "set authorized for kevin";
+  };
+
+  config = mkMerge [
+    (mkIf cfg.server.enable {
+      kevin.networking.ssh.enable = true;
+    })
+    (mkIf cfg.authorized.kevin {
+      users.users."kevin".openssh.authorizedKeys.keyFiles = [
+        /etc/nixos/ssh/kevin/authorized_keys
+      ];
+    })
+  ];
+}