Infinidoge/universe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

global/security: move ssh config to global/ssh

Browse source
This commit is contained in:
Infinidoge 2024-05-12 00:01:53 -04:00
parent 6a561560c9
commit 1e67729be0
Signed by: Infinidoge
SSH key fingerprint: SHA256:GT2StvPQMMfFHyiiFJymQxfTG/z6EWLJ6NWItf5K5sA
2 changed files with 29 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

26
modules/global/security.nix
View file

@ -34,32 +34,6 @@ with lib;
# Allow non-root users to allow other users to access mount point # Allow non-root users to allow other users to access mount point
programs.fuse.userAllowOther = mkDefault true; programs.fuse.userAllowOther = mkDefault true;
# For rage encryption, all hosts need a ssh key pair
services.openssh = {
enable = true;
openFirewall = mkDefault true;
settings = {
X11Forwarding = mkDefault false;
GatewayPorts = mkDefault "yes";
};
hostKeys = mkDefault [{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}];
};
programs.ssh = {
extraConfig = with config.common; ''
Host rsync.net
Hostname ${rsyncnet.host}
User ${rsyncnet.user}
Host admin.rsync.net
Hostname ${rsyncnet.host}
User ${rsyncnet.account}
'';
};
services.nginx = { services.nginx = {
statusPage = true; statusPage = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;

29
modules/global/ssh.nix Normal file
View file

@ -0,0 +1,29 @@
{ config, lib, ... }:
with lib;
{
# For rage encryption, all hosts need a ssh key pair
services.openssh = {
enable = true;
openFirewall = mkDefault true;
settings = {
X11Forwarding = mkDefault false;
GatewayPorts = mkDefault "yes";
};
hostKeys = mkDefault [{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}];
};
programs.ssh = {
extraConfig = with config.common; ''
Host rsync.net
Hostname ${rsyncnet.host}
User ${rsyncnet.user}
Host admin.rsync.net
Hostname ${rsyncnet.host}
User ${rsyncnet.account}
'';
};
}