forked from KptltD00M/nixy
KptltD00M
5082521524
- Introduced `default-creds` module for managing default credentials with Umami integration. - Added `fail2ban` module for brute-force attack protection with configurable ban times. - Created `firewall` module to enable and configure basic firewall settings. - Implemented `gitea` module for self-hosted Git service with PostgreSQL backend. - Developed `glance` module for a customizable dashboard with various widgets and themes. - Added `iknowyou` module for a self-hosted password manager with production and demo environments. - Introduced `kernel-hardening` module for enhancing kernel security settings. - Created `mazanoke` module for a simple web application with Nginx integration. - Added `mealie` module for a self-hosted meal planning application. - Implemented `stirling-pdf` module for PDF generation service. - Developed `umami` module for self-hosted analytics with secret management. - Added `ssh` module for secure SSH configuration with user restrictions. - Introduced `nixy` theme for a customized aesthetic experience across services.
38 lines
1023 B
Nix
38 lines
1023 B
Nix
# SSH configuration
|
|
{config, ...}: let
|
|
username = config.var.username;
|
|
in {
|
|
services.openssh = {
|
|
enable = true;
|
|
ports = [22];
|
|
openFirewall = true;
|
|
settings = {
|
|
PermitRootLogin = "no";
|
|
PasswordAuthentication = false;
|
|
AllowUsers = [username];
|
|
MaxAuthTries = 3;
|
|
LoginGraceTime = 20;
|
|
X11Forwarding = false;
|
|
AllowAgentForwarding = false;
|
|
AllowTcpForwarding = false;
|
|
ClientAliveInterval = 300;
|
|
ClientAliveCountMax = 2;
|
|
KexAlgorithms = [
|
|
"curve25519-sha256"
|
|
"curve25519-sha256@libssh.org"
|
|
];
|
|
Ciphers = [
|
|
"chacha20-poly1305@openssh.com"
|
|
"aes256-gcm@openssh.com"
|
|
];
|
|
};
|
|
};
|
|
|
|
# Add my public SSH key to my user
|
|
users.users."${username}".openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPG9SE80ZyBcXZK/f5ypSKudaM5Jo3XtQikCnGo0jI5E hadi@nixy"
|
|
];
|
|
|
|
services.cloudflared.tunnels."${config.var.tunnelId}".ingress."ssh.${config.var.domain}" = "ssh://localhost:22";
|
|
}
|