hosts/losurdo/ssh.nix

   1 { pkgs, lib, config, hosts, ... }:
   2 {
   3   services.openssh = {
   4     openFirewall = true;
   5     settings.X11Forwarding = true;
   6   };
   7   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
   8     "host.key:${ssh/host.key.cred}"
   9   ];
  10   programs.ssh = {
  11     extraConfig = ''
  12     '';
  13   };
  14
  15   boot.initrd.network.ssh = {
  16     enable = true;
  17     port = 2222;
  18     authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
  19     hostKeys = [ "/root/initrd/ssh.key" ];
  20     extraConfig = ''
  21     '';
  22   };
  23
  24   systemd.services.ssh-mermet-reverse = {
  25     after = [ "network-online.target" ];
  26     wantedBy = [ "multi-user.target" ];
  27     serviceConfig = {
  28       Type = "simple";
  29       # Require services.openssh.gatewayPorts = "clientspecified";
  30       # on the target.
  31       ExecStart = ''${pkgs.openssh}/bin/ssh -v -g -N -T \
  32       -o ServerAliveInterval=10 \
  33       -o ExitOnForwardFailure=yes \
  34       -R *:10022:localhost:22 \
  35       ${hosts.mermet._module.args.ipv4}
  36     '';
  37       Restart = "always";
  38       RestartSec = "5s";
  39     };
  40   };
  41   services.upnpc.enable = true;
  42   services.upnpc.redirections =
  43     [
  44       {
  45         description = "SSH";
  46         externalPort = 22;
  47         protocol = "TCP";
  48         duration = 30 * 60;
  49         service.wantedBy = [ "sshd.service" ];
  50         service.partOf = [ "sshd.service" ];
  51       }
  52       { description = "Mosh"; externalPort = 60000; protocol = "UDP"; duration = 30 * 60; service.wantedBy = [ "sshd.service" ]; }
  53       { description = "Mosh"; externalPort = 60001; protocol = "UDP"; duration = 30 * 60; service.wantedBy = [ "sshd.service" ]; }
  54       { description = "Mosh"; externalPort = 60002; protocol = "UDP"; duration = 30 * 60; service.wantedBy = [ "sshd.service" ]; }
  55       { description = "Mosh"; externalPort = 60003; protocol = "UDP"; duration = 30 * 60; service.wantedBy = [ "sshd.service" ]; }
  56     ] ++ [
  57       {
  58         description = "SSH (boot)";
  59         externalPort = 2222;
  60         protocol = "TCP";
  61         duration = 0;
  62         service.wantedBy = [ "sshd.service" ];
  63       }
  64     ];
  65 }