liminix/modules/ssh/ssh.nix

{
  liminix
, dropbear
, lib
, watch-ssh-keys
}:
{
  address,
  allowLocalPortForward,
  allowPasswordLogin,
  allowPasswordLoginForRoot,
  allowRemoteConnectionToForwardedPorts,
  allowRemotePortForward,
  allowRoot,
  authorizedKeys,
  port,
  extraConfig
}:
let
  name = "sshd";
  inherit (builtins) toString typeOf;
  inherit (liminix.services) longrun;
  inherit (lib) concatStringsSep mapAttrs mapAttrsToList;
  keydir = "/run/${name}/authorized_keys";
  options =
    [
      "-e" #  pass environment to child
      "-E" #  log to stderr
      "-R" #  create hostkeys if needed
      "-P /run/dropbear.pid"
      "-F" #  don't fork into background
    ] ++
    (lib.optional (! allowRoot) "-w") ++
    (lib.optional (! allowPasswordLogin) "-s") ++
    (lib.optional (! allowPasswordLoginForRoot) "-g") ++
    (lib.optional (! allowLocalPortForward) "-j") ++
    (lib.optional (! allowRemotePortForward) "-k") ++
    (lib.optional (! allowRemoteConnectionToForwardedPorts) "-a") ++
    (lib.optionals (authorizedKeys != null) ["-U" "${keydir}/%n"]) ++
    [(if address != null
      then "-p ${address}:${toString port}"
      else "-p ${toString port}")] ++
    [extraConfig];
  isKeyservice = typeOf authorizedKeys == "lambda";
  authKeysConcat =
    if authorizedKeys != null && !isKeyservice
    then mapAttrs
      (n : v : concatStringsSep "\\n" v)
      authorizedKeys
    else {};
  keyservice = longrun {
    name = "${name}-watch-keys";
    run = ''
      mkdir -p ${keydir}
      exec ${watch-ssh-keys}/bin/watch-ssh-keys -d ${keydir} ${authorizedKeys "service"} ${authorizedKeys "path"}
    '';
    dependencies = [ (authorizedKeys "service") ] ;
  };
in
longrun {
  inherit name;
  # we need /run/dropbear to point to hostkey storage, as that
  # pathname is hardcoded into the binary.
  # env -i clears the environment so we don't pass anything weird to
  # ssh sessions
  run = ''
    ln -s $(mkstate dropbear) /run
    mkdir -p /run/${name}/authorized_keys
    ${concatStringsSep "\n"
      (mapAttrsToList
        (n : v : "echo -e '${v}' > /run/${name}/authorized_keys/${n} ")
        authKeysConcat
      )
     }
    . /etc/profile # sets PATH but do we need this?  it's the same file as ashrc
    exec env -i ENV=/etc/ashrc PATH=$PATH ${dropbear}/bin/dropbear ${concatStringsSep " " options}
  '';
  dependencies = lib.optional isKeyservice keyservice;
}