hosts/mermet/networking/ssh.nix

   1 { config, ... }:
   2 {
   3   networking.nftables.ruleset = ''
   4     table inet filter {
   5       chain input-net {
   6         tcp dport 10022 counter accept comment "SSH (reverse to losurdo)"
   7       }
   8     }
   9   '';
  10   services.openssh = {
  11     gatewayPorts = "clientspecified";
  12     openFirewall = true;
  13   };
  14   boot.initrd.network.ssh = {
  15     enable = true;
  16     # To prevent ssh from freaking out because a different host key is used,
  17     # a different port for dropbear is useful
  18     # (assuming the same host has also a normal sshd running)
  19     port = 2222;
  20     authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
  21     hostKeys = [ "/root/initrd/ssh.key" ];
  22   };
  23   boot.initrd.network = {
  24     enable = true;
  25     # This will automatically load the zfs password prompt on login
  26     # and kill the other prompt so boot can continue
  27     # The pkill zfs kills the zfs load-key from the console
  28     # allowing the boot to continue.
  29     postCommands = ''
  30       echo >>/root/.profile "zfs load-key rpool && pkill zfs"
  31     '';
  32   };
  33 }