AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: sane ssh defaults

Browse Source
This commit is contained in:
Dmitriy Kholkin 2025-03-10 18:30:20 +03:00
parent 05db810079
commit 73c86aa500
Signed by: AtaraxiaDev
GPG Key ID: FD266B810DF48DF2
2 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
modules/nixos/roles/default.nix
View File

@ -33,6 +33,7 @@ in
baseRole = { baseRole = {
ataraxia.defaults.lix.enable = mkDefault true; ataraxia.defaults.lix.enable = mkDefault true;
ataraxia.defaults.nix.enable = mkDefault true; ataraxia.defaults.nix.enable = mkDefault true;
ataraxia.defaults.ssh.enable = mkDefault true;
persist.enable = mkDefault true; persist.enable = mkDefault true;

27
modules/nixos/ssh/default.nix Normal file
View File

@ -0,0 +1,27 @@
{ config, lib, ... }:
let
inherit (lib) mkIf mkEnableOption mkOption;
inherit (lib.types) listOf int;
cfg = config.ataraxia.defaults.ssh;
in
{
options.ataraxia.defaults.ssh = {
enable = mkEnableOption "Root on zfs";
ports = mkOption {
type = listOf int;
default = [ 22 ];
description = "OpenSSH ports to listen";
};
};
config = mkIf cfg.enable {
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.PermitRootLogin = "no";
settings.X11Forwarding = false;
extraConfig = "StreamLocalBindUnlink yes";
ports = cfg.ports;
};
};
}