Shared nix modules for my configurations.
feat: parameterize hardening/sshd.nix with infra.profiles.sshd
+44
-28
+44
-28
modules/nixos/hardening/sshd.nix
+44
-28
modules/nixos/hardening/sshd.nix
···
1
-
_: {
2
-
services.openssh = {
3
-
enable = true;
4
-
settings = {
5
-
PasswordAuthentication = false;
6
-
PermitEmptyPasswords = false;
7
-
PermitTunnel = false;
8
-
PermitRootLogin = "no";
9
-
UseDns = false;
10
-
KbdInteractiveAuthentication = false;
11
-
AllowTcpForwarding = true;
12
-
X11Forwarding = false;
13
-
MaxAuthTries = 3;
14
-
MaxSessions = 2;
15
-
ClientAliveInterval = 300;
16
-
ClientAliveCountMax = 0;
17
-
AllowAgentForwarding = false;
18
-
AllowStreamLocalForwarding = false;
19
-
AllowUsers = [ ];
20
-
TCPKeepAlive = false;
21
-
LogLevel = "VERBOSE";
1
+
{ config, lib, ... }:
2
+
{
3
+
options.infra.profiles.sshd = {
4
+
allowUsers = lib.mkOption {
5
+
type = lib.types.listOf lib.types.str;
6
+
default = [ "root" ];
7
+
description = "Users permitted to SSH in. Overrides hardening default.";
22
8
};
23
-
ports = [ 22023 ];
24
-
hostKeys = [
25
-
{
26
-
type = "ed25519";
27
-
path = "/etc/ssh/ssh_host_ed25519_key";
28
-
}
29
-
];
9
+
ports = lib.mkOption {
10
+
type = lib.types.listOf lib.types.port;
11
+
default = [ 22023 ];
12
+
description = "SSH listen ports.";
13
+
};
14
+
};
15
+
16
+
config = {
17
+
services.openssh = {
18
+
enable = true;
19
+
settings = {
20
+
PasswordAuthentication = false;
21
+
PermitEmptyPasswords = false;
22
+
PermitTunnel = false;
23
+
PermitRootLogin = "no";
24
+
UseDns = false;
25
+
KbdInteractiveAuthentication = false;
26
+
AllowTcpForwarding = true;
27
+
X11Forwarding = false;
28
+
MaxAuthTries = 3;
29
+
MaxSessions = 2;
30
+
ClientAliveInterval = 300;
31
+
ClientAliveCountMax = 0;
32
+
AllowAgentForwarding = false;
33
+
AllowStreamLocalForwarding = false;
34
+
AllowUsers = lib.mkForce config.infra.profiles.sshd.allowUsers;
35
+
TCPKeepAlive = false;
36
+
LogLevel = "VERBOSE";
37
+
};
38
+
ports = config.infra.profiles.sshd.ports;
39
+
hostKeys = [
40
+
{
41
+
type = "ed25519";
42
+
path = "/etc/ssh/ssh_host_ed25519_key";
43
+
}
44
+
];
45
+
};
30
46
};
31
47
}