liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

default.nix (2277B)

      1 ## Secure Shell
      2 ## ============
      3 ##
      4 ## Provide SSH service using Dropbear
      5 
      6 {
      7   lib,
      8   pkgs,
      9   config,
     10   ...
     11 }:
     12 let
     13   inherit (lib) mkOption types;
     14   inherit (pkgs) liminix;
     15   inherit (pkgs.pseudofile) dir file;
     16   mkBoolOption =
     17     description:
     18     mkOption {
     19       type = types.bool;
     20       inherit description;
     21       default = true;
     22     };
     23 
     24 in
     25 {
     26   options = {
     27     system.service.ssh = mkOption {
     28       type = liminix.lib.types.serviceDefn;
     29     };
     30   };
     31   config.programs.busybox.options.FEATURE_FANCY_ECHO = "y";
     32   config.filesystem = dir {
     33     etc = dir {
     34       shells = {
     35         file = "/bin/sh\n";
     36       };
     37     };
     38   };
     39   config.system.service = {
     40     ssh = config.system.callService ./ssh.nix {
     41       address = mkOption {
     42         type = types.nullOr types.str;
     43         default = null;
     44         description = "Listen on specified address";
     45         example = "127.0.0.1";
     46       };
     47       port = mkOption {
     48         type = types.port;
     49         default = 22;
     50         description = "Listen on specified TCP port";
     51       };
     52       allowRoot = mkBoolOption "Allow root to login";
     53       allowPasswordLogin = mkBoolOption "Allow login using password (disable for public key auth only)";
     54       allowPasswordLoginForRoot = mkBoolOption "Allow root to login using password (disable for public key auth only)";
     55       allowLocalPortForward = mkBoolOption "Enable local port forwarding";
     56       allowRemotePortForward = mkBoolOption "Enable remote port forwarding";
     57       allowRemoteConnectionToForwardedPorts = mkOption {
     58         type = types.bool;
     59         default = false;
     60         description = "Allow remote hosts to connect to local forwarded ports (by default they are bound to loopback)";
     61       };
     62       authorizedKeys = mkOption {
     63         type = types.nullOr (liminix.lib.types.replacable (types.attrsOf (types.listOf types.nonEmptyStr)));
     64         example = {
     65           root = [ "ssh-rsa AAAAB3N...aZaZ" ];
     66           alice = [ "ssh-rsa AAAAB3N...qS4r" ];
     67           bob = [ ];
     68         };
     69         default = null;
     70         description = "Authorized SSH public keys for each username. If this optin is provided it overrides any keys found in /home/{username}/.ssh";
     71       };
     72       extraConfig = mkOption {
     73         type = types.separatedString " ";
     74         default = "";
     75       };
     76     };
     77   };
     78 }