all repos — nixfiles @ 5a15aa56f6c28df5f763d674d56c3050c35e47a5

System and user configuration, managed by nix and home-manager

centralise SSH server configuration and differentiate by role

Alin
commit

5a15aa56f6c28df5f763d674d56c3050c35e47a5

parent

10d7d263581b192f7cc53f9b959c638cb035e7e2

9 files changed, 40 insertions(+), 42 deletions(-)

changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -75,19 +75,6 @@ ];
 
   # Initial empty root password for easy login:
   users.users.root.initialHashedPassword = "";
-  services.openssh = {
-    enable = true;
-    settings = {
-      AcceptEnv = [
-        "LANG"
-        "LC_*"
-        "TERM_PROGRAM"
-      ];
-    };
-  };
-  services.sshguard = {
-    enable = true;
-  };
   programs.ssh.extraConfig = ''
     Host ${domain} git.${domain}
       Hostname git.${domain}
M system/hosts/nano.nix → system/hosts/nano.nix
@@ -17,6 +17,7 @@ in
 {
   imports = [
     ../roles/server.nix
+    ../roles/local-access.nix
   ];
   age.secrets = {
     dyndns.file = ../../secrets/dyndns.age;

@@ -207,8 +208,6 @@ LLMNR = false
       MulticastDNS = true
     '';
   };
-
-  services.openssh.openFirewall = false;
 
   services.dnsmasq = {
     enable = dnsmasqEnable;
M system/hosts/prefect.nix → system/hosts/prefect.nix
@@ -26,6 +26,9 @@ ../settings/programs/shell.nix
     ../settings/programs/docker.nix
     ../settings/dev.nix
     ../settings/gaming.nix
+
+    ../roles/desktop.nix
+    ../roles/local-access.nix
   ];
 
   virtualisation.vmVariant = {

@@ -123,17 +126,6 @@ ];
 
   services.xserver = {
     xautolock.enable = pkgs.lib.mkForce false;
-  };
-
-  services.openssh = {
-    enable = true;
-    openFirewall = false;
-    startWhenNeeded = true;
-  };
-  systemd.services."ssh-no-sleep@" = {
-    bindsTo = [ "sshd@%i.service" ];
-    wantedBy = [ "sshd@.service" ];
-    serviceConfig.ExecStart = "${pkgs.systemd}/bin/systemd-inhibit --mode block --what sleep --who 'ssh session '%I --why 'session still active' ${pkgs.coreutils}/bin/sleep infinity";
   };
 
   networking = {
M system/hosts/r5s.nix → system/hosts/r5s.nix
@@ -51,8 +51,6 @@ MulticastDNS = true;
     };
   };
 
-  services.openssh.openFirewall = true;
-
   services.tailscale = {
     enable = true;
   };
M system/hosts/smrk.nix → system/hosts/smrk.nix
@@ -27,20 +27,6 @@ nixpkgs-review
     nix-output-monitor
   ];
 
-  services.openssh = {
-    enable = true;
-    settings = {
-      AcceptEnv = [
-        "LANG"
-        "LC_*"
-        "TERM_PROGRAM"
-      ];
-    };
-  };
-  services.sshguard = {
-    enable = true;
-  };
-
   programs.htop = {
     enable = true;
     settings = {
A system/roles/desktop.nix
@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./base.nix
+  ];
+
+  services.openssh.startWhenNeeded = true;
+  systemd.services."ssh-no-sleep@" = {
+    bindsTo = [ "sshd@%i.service" ];
+    wantedBy = [ "sshd@.service" ];
+    serviceConfig.ExecStart = "${pkgs.systemd}/bin/systemd-inhibit --mode block --what sleep --who 'ssh session '%I --why 'session still active' ${pkgs.coreutils}/bin/sleep infinity";
+  };
+}
A system/roles/local-access.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.openssh.openFirewall = false;
+}
M system/roles/server.nix → system/roles/server.nix
@@ -7,6 +7,7 @@ ../settings/configuration/locale.nix
 
     ../settings/services/tailscale.nix
     ../settings/services/caddy.nix
+    ../settings/services/ssh.nix
 
     ./base.nix
   ];

@@ -16,5 +17,9 @@ useRoutingFeatures = "both";
     extraSetFlags = [
       "--advertise-exit-node"
     ];
+  };
+
+  services.sshguard = {
+    enable = true;
   };
 }
A system/settings/services/ssh.nix
@@ -0,0 +1,14 @@
+# configuration shared between desktop and server roles
+{ ... }:
+{
+  services.openssh = {
+    enable = true;
+    settings = {
+      AcceptEnv = [
+        "LANG"
+        "LC_*"
+        "TERM_PROGRAM"
+      ];
+    };
+  };
+}