]>
Commit | Line | Data |
---|---|---|
1 | { lib, pkgs, config, mylibs, myconfig, ... }: | |
2 | { | |
3 | config = { | |
4 | networking.firewall.allowedTCPPorts = [ 22 ]; | |
5 | ||
6 | services.openssh.extraConfig = '' | |
7 | AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys | |
8 | AuthorizedKeysCommandUser nobody | |
9 | ''; | |
10 | ||
11 | secrets.keys = [{ | |
12 | dest = "ssh-ldap"; | |
13 | user = "nobody"; | |
14 | group = "nogroup"; | |
15 | permissions = "0400"; | |
16 | text = myconfig.env.sshd.ldap.password; | |
17 | }]; | |
18 | system.activationScripts.sshd = { | |
19 | deps = [ "secrets" ]; | |
20 | text = '' | |
21 | install -Dm400 -o nobody -g nogroup -T /var/secrets/ssh-ldap /etc/ssh/ldap_password | |
22 | ''; | |
23 | }; | |
24 | # ssh is strict about parent directory having correct rights, don't | |
25 | # move it in the nix store. | |
26 | environment.etc."ssh/ldap_authorized_keys" = let | |
27 | ldap_authorized_keys = | |
28 | mylibs.wrap { | |
29 | name = "ldap_authorized_keys"; | |
30 | file = ./ldap_authorized_keys.sh; | |
31 | paths = [ pkgs.which pkgs.gitolite pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ]; | |
32 | }; | |
33 | in { | |
34 | enable = true; | |
35 | mode = "0755"; | |
36 | user = "root"; | |
37 | source = ldap_authorized_keys; | |
38 | }; | |
39 | }; | |
40 | } |