]>
Commit | Line | Data |
---|---|---|
7e6f1fb4 IB |
1 | { lib, pkgs, config, mylibs, myconfig, ... }: |
2 | { | |
3 | config = { | |
4 | networking.firewall.allowedTCPPorts = [ 22 ]; | |
5 | ||
6 | services.openssh.extraConfig = '' | |
7 | AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys | |
8 | AuthorizedKeysCommandUser nobody | |
9 | ''; | |
10 | ||
ea7bf00c IB |
11 | deployment.keys = { |
12 | ssh-ldap = { | |
13 | user = "nobody"; | |
14 | group = "nobody"; | |
15 | permissions = "0400"; | |
16 | text = myconfig.env.sshd.ldap.password; | |
17 | }; | |
18 | }; | |
19 | system.activationScripts.sshd = '' | |
20 | install -Dm400 -o nobody -g nobody -T /run/keys/ssh-ldap /etc/ssh/ldap_password | |
21 | ''; | |
22 | # ssh is strict about parent directory having correct rights, don't | |
23 | # move it in the nix store. | |
7e6f1fb4 IB |
24 | environment.etc."ssh/ldap_authorized_keys" = let |
25 | ldap_authorized_keys = | |
26 | mylibs.wrap { | |
27 | name = "ldap_authorized_keys"; | |
28 | file = ./ldap_authorized_keys.sh; | |
ea7bf00c | 29 | paths = [ pkgs.which pkgs.gitolite pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ]; |
7e6f1fb4 IB |
30 | }; |
31 | in { | |
32 | enable = true; | |
33 | mode = "0755"; | |
34 | user = "root"; | |
35 | source = ldap_authorized_keys; | |
36 | }; | |
37 | }; | |
38 | } |