kevin/dotfiles
1
0
Fork 0
mirror of https://github.com/Unkn0wnCat/dotfiles.git synced 2025-05-30 23:06:10 +02:00
Code Issues Projects Releases Wiki Activity

Add ssh configuration

Browse source
This commit is contained in:
Kevin Kandlbinder 2022-12-21 13:50:22 +01:00
parent a46d297fc7
commit 2e48cc8833
5 changed files with 49 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nixos/install.sh
View file

@ -12,10 +12,15 @@ DIR=$( cd -P "$( dirname "$SOURCE" )" >/dev/null 2>&1 && pwd )
echo "Installing NixOS modules..."
if [ -d /etc/nixos/modules ]; then
echo "Directory /etc/nixos/modules exists - exiting."
exit 2
echo "Directory /etc/nixos/modules exists - skipping."
else
sudo ln -s $DIR/modules /etc/nixos/modules || echo "Could not link modules"
fi
sudo ln -s $DIR/modules /etc/nixos/modules
if [ -d /etc/nixos/ssh ]; then
echo "Directory /etc/nixos/ssh exists - skipping."
else
sudo ln -s $DIR/../ssh /etc/nixos/ssh || echo "Could not link ssh assets"
fi
echo "Done."

3
nixos/modules/default.nix
View file

@ -8,6 +8,7 @@ in {
./audio.nix
./desktop.nix
./yubikey.nix
./ssh.nix
];
options.kevin = {
@ -21,6 +22,7 @@ in {
({
nixpkgs.config.allowUnfree = true;
i18n.defaultLocale = "en_US.UTF-8";
kevin.ssh.server.enable = true;
console = {
font = "Lat2-Terminus16";
@ -77,6 +79,7 @@ in {
description = "Kevin Kandlbinder";
extraGroups = [ "wheel" "docker" "dialout" ];
};
kevin.ssh.authorized.kevin = true;
})
(mkIf (cfg.defaults == "laptop") {
kevin.power.mode = "laptop";

12
nixos/modules/networking.nix
View file

@ -6,6 +6,7 @@ in {
options.kevin.networking = {
enable = mkEnableOption "kevins networking";
avahi.enable = mkEnableOption "avahi";
ssh.enable = mkEnableOption "ssh";
firewall.wireguard = mkEnableOption "wireguard exceptions";
firewall.syncthing = mkEnableOption "syncthing exceptions";
};
@ -24,6 +25,17 @@ in {
networking.firewall.allowedUDPPorts = [ 5353 ];
})
(mkIf cfg.ssh.enable {
services.openssh = {
enable = true;
# require public key authentication for better security
passwordAuthentication = false;
kbdInteractiveAuthentication = false;
#permitRootLogin = "yes";
};
networking.firewall.allowedTCPPorts = [ 22 ];
})
(mkIf cfg.firewall.wireguard {
networking.firewall = {
# if packets are still dropped, they will show up in dmesg

21
nixos/modules/ssh.nix Normal file
View file

@ -0,0 +1,21 @@
{ lib, pkgs, config, ... }:
with lib;
let
cfg = config.kevin.ssh;
in {
options.kevin.ssh = {
server.enable = mkEnableOption "kevins ssh";
authorized.kevin = mkEnableOption "set authorized for kevin";
};
config = mkMerge [
(mkIf cfg.server.enable {
kevin.networking.ssh.enable = true;
})
(mkIf cfg.authorized.kevin {
users.users."kevin".openssh.authorizedKeys.keyFiles = [
/etc/nixos/ssh/kevin/authorized_keys
];
})
];
}

2
ssh/kevin/authorized_keys Normal file
View file

@ -0,0 +1,2 @@
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCdy62Rfguq7ROHYM278gXq81niSHt1vWPypedyOnHVsATy15JWOmyln4H6xo9GeA7Sp/6QarSjn0fRHPMM/4jvRV960eyHs0yQGjLe8OPA2lKvZpKsWiVczQlcoeWahkEjp6SNwyc7eHg31rOH+TSAJ846jz/HKpq5YY/jcswttDzx/u1XeXqlJZ9CStyEw7von6vtDkH7bkUW6BurhQSts4p3VlXTMZmpg51Ur5orgxojro0Mmp5Sai3i4GVBQWp00r4WHnw/qme+c3RQPcSwwToLKCip+7HALVm7J6SrGUhmPlEiTvCglcI+jWn37wXxS1Mxd2+YdSkxVzdbxAReNSsA49H7QqfbmwltpAV02qSG7B7a8aa/l6UVXFE54U/ZSg/0vBJeT2noBv1g9F6VYZezE7GD2HcHGS73eZuK3cklL8ih5GTqniEk/opnma3v5BA1X8RPsLOd8LnjIA71Jzl5mwhDEbJdN2iTNE9UaqiCdXPPWESmrgRUdPEDvEk= kevin@kevin-tp-l580
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFB0N+8UFxknoCQvp5N2UPL7BiRlAPz8TguysufpcOqw kevin@kevin-PC