hosts/losurdo/networking/ssh.nix

   1 { pkgs, lib, config, hosts, ... }:
   2 let
   3   inherit (config.security) gnupg;
   4   inherit (config.users) users;
   5 in
   6 {
   7 /* Wireguard is used instead
   8 systemd.services.ssh-mermet-reverse = {
   9   after = [ "network-online.target" ];
  10   wantedBy = [ "multi-user.target" ];
  11   serviceConfig = {
  12     Type = "simple";
  13     # Require services.openssh.gatewayPorts = "clientspecified";
  14     # on the target.
  15     ExecStart = ''${pkgs.openssh}/bin/ssh -v -g -N -T \
  16       -o ServerAliveInterval=10 \
  17       -o ExitOnForwardFailure=yes \
  18       -R *:10022:localhost:22 \
  19       ${hosts.mermet.extraArgs.ipv4}
  20     '';
  21     Restart = "always";
  22     RestartSec = "5s";
  23   };
  24 };
  25 */
  26 boot.initrd.network.ssh = {
  27   enable = true;
  28   port = 2222;
  29   authorizedKeys = users.root.openssh.authorizedKeys.keys;
  30   hostKeys = [ "/root/initrd/ssh.key" ];
  31   extraConfig = ''
  32   '';
  33 };
  34 services.openssh = {
  35   forwardX11 = true;
  36 };
  37 programs.ssh = {
  38   extraConfig = ''
  39     Compression = yes
  40   '';
  41 };
  42 services.upnpc.redirections =
  43   [
  44     { description = "SSH";
  45       externalPort = 22; protocol = "TCP"; duration = 30 * 60;
  46       service.wantedBy = ["sshd.service"];
  47       service.partOf   = ["sshd.service"];
  48     }
  49     { description = "Mosh"; externalPort = 60000; protocol = "UDP"; duration = 30 * 60; service.wantedBy = ["sshd.service"]; }
  50     { description = "Mosh"; externalPort = 60001; protocol = "UDP"; duration = 30 * 60; service.wantedBy = ["sshd.service"]; }
  51     { description = "Mosh"; externalPort = 60002; protocol = "UDP"; duration = 30 * 60; service.wantedBy = ["sshd.service"]; }
  52     { description = "Mosh"; externalPort = 60003; protocol = "UDP"; duration = 30 * 60; service.wantedBy = ["sshd.service"]; }
  53   ] ++ [
  54     { description = "SSH (boot)";
  55       externalPort = 2222; protocol = "TCP"; duration = 0;
  56       service.wantedBy = ["sshd.service"];
  57     }
  58   ];
  59 }