mirror of
https://seed.radicle.dev/rad:z254T5p17bdFPmzfDojsdjo4HjpoZ.git
synced 2026-10-18 19:10:32 +08:00
34 lines
651 B
Nix
34 lines
651 B
Nix
{
|
|
pkgs,
|
|
config,
|
|
lib,
|
|
...
|
|
}: {
|
|
services = {
|
|
openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
};
|
|
|
|
hostKeys = [
|
|
{
|
|
path = "/etc/ssh/ssh_host_ed25519_key";
|
|
type = "ed25519";
|
|
}
|
|
];
|
|
};
|
|
|
|
sshguard.enable = true;
|
|
};
|
|
|
|
sops = {
|
|
age.sshKeyPaths = map (x: x.path) config.services.openssh.hostKeys;
|
|
secrets = {
|
|
"ssh/key".sopsFile = ./sops/ssh.yaml;
|
|
};
|
|
};
|
|
|
|
environment.etc."ssh/ssh_host_ed25519_key.pub".text = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMXpC2X07TCIslR907omxrk6J+K3p0rGOMaJAHe1K2i3 ${config.networking.fqdn}";
|
|
}
|