jasmine/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

WIP: SSH configuration restructure

Browse source 
Backup of SSH reorganization changes for future reference.
This commit is contained in:
♥ Minnie ♥ 2025-10-07 20:58:09 +08:00
parent a6fa8866ac
commit acab920858
Signed by: jasmine
GPG key ID: 8563E358D4E8040E
7 changed files with 43 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nixos/common/global/ssh.nix
View file

@ -1,12 +0,0 @@
{...}: {
services.openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
LogLevel = "VERBOSE";
};
ports = [22];
openFirewall = true;
};
}

3
nixos/common/global/ssh/borgbase_hosts Normal file
View file

@ -0,0 +1,3 @@
r7ag7x1w.repo.borgbase.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMS3185JdDy7ffnr0nLWqVy8FaAQeVh1QYUSiNpW5ESq
r7ag7x1w.repo.borgbase.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwHsO5g7kAEpqcK4bpHCUKYV1cKCUNwVEVsDQyfj7N8L92E21n+aEhIX2Nh/kFs1W9D/pgsWQBAbco9e/ORuagHrO8hUQtbda5Z31PAo4eipwP17VQr5rF3seaJJNFV72v89PGwMOWQwvoJte+yngC6PYGKJ+w63SRtflihAmf4xa5Tci/f6jbX6t32m2F3bnephVzQO6anGXvGPR8QYQXzSu/27+LaKnLd2Kugb1Ytbo0+6kioa60HWejIZ/mCrCHXYpi0jAllaYEuAsTqFWf/OFUHrKWwRAJD0TV43O1++vLlxY85oQxIgc4oUbm93dXmDBssrTnqqq2jqonteUr
r7ag7x1w.repo.borgbase.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOstKfBbwVOYQh3J7X4nzd6/VYgLfaucP9z5n4cpSzcZAOKGh6jH8e1mhQ4YupthlsdPKyFFZ3pKo4mTaRRuiJo=

43
nixos/common/global/ssh/default.nix Normal file
View file

@ -0,0 +1,43 @@
{inputs, ...}: {
# SSH server configuration
services.openssh = {
enable = true;
settings = {
PermitRootLogin = "no"; # Disable root login for security
PasswordAuthentication = false; # Require key-based authentication
LogLevel = "VERBOSE"; # Enhanced logging for security auditing
};
ports = [22]; # Standard SSH port
openFirewall = true; # Allow SSH through firewall
};
# Trusted host keys for internal infrastructure
programs.ssh.knownHosts = {
# Desktop workstation (fuchsia)
"fuchsia-ed25519" = {
hostNames = ["fuchsia"];
publicKeyFile = "${inputs.self}/nixos/fuchsia/ssh_host_ed25519_key.pub";
};
"fuchsia-rsa" = {
hostNames = ["fuchsia"];
publicKeyFile = "${inputs.self}/nixos/fuchsia/ssh_host_rsa_key.pub";
};
# Server (viridian)
"viridian-ed25519" = {
hostNames = ["viridian"];
publicKeyFile = "${inputs.self}/nixos/viridian/ssh_host_ed25519_key.pub";
};
"viridian-rsa" = {
hostNames = ["viridian"];
publicKeyFile = "${inputs.self}/nixos/viridian/ssh_host_rsa_key.pub";
};
};
# External backup provider (BorgBase)
programs.ssh.knownHostsFiles = [
./borgbase_hosts
];
}