qenya/nixfiles
1
0
Fork 0
Code Issues 4 Pull requests Activity Actions

Modularise nginx and openssh config

Browse source
This commit is contained in:
Katherina Walshe-Grey 2024-06-05 19:26:05 +01:00
parent b83c95b8b6
commit 4eac965b88
3 changed files with 60 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

20
services/openssh.nix Normal file
View file

@ -0,0 +1,20 @@
{ config, lib, pkgs, ... }:
{
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "no";
};
};
services.fail2ban.enable = true;
networking.firewall.allowedTCPPorts = [ 22 ];
# Allow remote root login only from home network
# TODO: Find a less hacky way of doing remote deployment
users.users.root.openssh.authorizedKeys.keys = config.users.users.qenya.openssh.authorizedKeys.keys;
services.openssh.extraConfig = "Match Address 45.14.17.200\n PermitRootLogin prohibit-password";
}