Emma Thorpe
e42f368d72
The daemon enable and the firewall port were duplicated in each sshd host (T400, Mac Pro, RPi5). Move both into modules/ssh.nix so importing it both hardens and enables sshd; drop the per-host copies. No build change: the three hosts evaluate to identical derivations. Closes #51
15 lines
490 B
Nix
15 lines
490 B
Nix
# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
|
|
# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
|
|
# registry (modules/users.nix), not here.
|
|
{ ... }:
|
|
{
|
|
services.openssh.enable = true;
|
|
networking.firewall.allowedTCPPorts = [ 22 ];
|
|
|
|
services.openssh.settings = {
|
|
PasswordAuthentication = false; # keys only
|
|
KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
|
|
PermitRootLogin = "no";
|
|
};
|
|
}
|