71 lines
1.9 KiB
Nix
71 lines
1.9 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
with lib;
|
|
let
|
|
cfg = config.services.ssh-tunnel;
|
|
in
|
|
{
|
|
options.services.ssh-tunnel = {
|
|
enable = mkEnableOption "SSH tunneling service";
|
|
|
|
server = mkOption {
|
|
type = with types; uniq string;
|
|
default = null;
|
|
description = "The SSH server to connect for port forwarding";
|
|
};
|
|
|
|
requiredBy = mkOption {
|
|
type = types.list;
|
|
default = [ ];
|
|
description = "List of systemd services that require the SSH tunnels";
|
|
};
|
|
|
|
forwards = mkOption {
|
|
type = types.submodule {
|
|
options = {
|
|
dynamic = mkOption {
|
|
type = types.list;
|
|
default = [ ];
|
|
description = "List of dynamic ports to open through the ssh tunnel. See ssh(1) for ``-D``";
|
|
};
|
|
local = mkOption {
|
|
type = types.list;
|
|
default = [ ];
|
|
description = "List of local ports to open throgh the ssh tunnel. See ssh(1) for ``-L``";
|
|
};
|
|
remote = mkOption {
|
|
type = types.list;
|
|
default = [ ];
|
|
description = "List of remote ports to open throgh the ssh tunnel. See ssh(1) for ``-R``";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
config.systemd.services.ssh-tunnel = mkIf cf.enable (
|
|
let
|
|
mkParams = flag: concatMapStringsSep " " (x: "${flag} x");
|
|
|
|
dynamic = mkParams "-D" cfg.forwards.dynamic;
|
|
local = mkParams "-L" cfg.forwards.local;
|
|
remote = mkParams "-R" cfg.forwards.remote;
|
|
|
|
options = mkParams "-o" (mapAttrsToList (n: v: "${n}=${v}") {
|
|
ServerAliveInterval = 60;
|
|
ExitOnForwardFailure = "yes";
|
|
KbdInteractiveAuthentication = "no";
|
|
});
|
|
in
|
|
{
|
|
script = ''
|
|
${pkgs.openssh}/bin/ssh ${cfg.server} -NTn \
|
|
${options} ${dynamic} ${local} ${remote}
|
|
'';
|
|
requiredBy = cfg.requiredBy;
|
|
serviceConfig = {
|
|
RestartSec = 5;
|
|
Restart = "always";
|
|
};
|
|
}
|
|
);
|
|
}
|