1 { lib, pkgs, config, ... }:
3 cfg = config.myServices.ssh;
6 options.myServices.ssh = let
7 module = lib.types.submodule {
9 snippet = lib.mkOption {
10 type = lib.types.lines;
15 dependencies = lib.mkOption {
16 type = lib.types.listOf lib.types.package;
19 Dependencies of the package
25 predefinedModules = lib.mkOption {
26 type = lib.types.attrsOf module;
29 snippet = builtins.readFile ./ldap_regular.sh;
37 modules = lib.mkOption {
38 type = lib.types.listOf module;
41 List of modules to enable
46 networking.firewall.allowedTCPPorts = [ 22 ];
47 } // (lib.mkIf (builtins.length cfg.modules > 0) {
49 services.openssh.extraConfig = ''
50 AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys
51 AuthorizedKeysCommandUser nobody
59 text = config.myEnv.sshd.ldap.password;
61 system.activationScripts.sshd = {
64 install -Dm400 -o nobody -g nogroup -T /var/secrets/ssh-ldap /etc/ssh/ldap_password
67 # ssh is strict about parent directory having correct rights, don't
68 # move it in the nix store.
69 environment.etc."ssh/ldap_authorized_keys" = let
70 deps = lib.lists.unique (
71 [ pkgs.which pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ]
72 ++ lib.flatten (map (v: v.dependencies) cfg.modules)
74 fullScript = pkgs.runCommand "ldap_authorized_keys" {
75 snippets = builtins.concatStringsSep "\n" (map (v: v.snippet) cfg.modules);
77 substituteAll ${./ldap_authorized_keys.sh} $out
80 ldap_authorized_keys = pkgs.runCommand "ldap_authorized_keys" {
81 buildInputs = [ pkgs.makeWrapper ];
83 makeWrapper "${fullScript}" "$out" --prefix PATH : ${lib.makeBinPath deps}
89 source = ldap_authorized_keys;