nixops/modules/ssh/default.nix

   1 { lib, pkgs, config, mylibs, myconfig, ... }:
   2 {
   3   config = {
   4     networking.firewall.allowedTCPPorts = [ 22 ];
   5
   6     services.openssh.extraConfig = ''
   7       AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
   8       AuthorizedKeysCommandUser nobody
   9       '';
  10
  11     deployment.keys = {
  12       ssh-ldap = {
  13         user = "nobody";
  14         group = "nobody";
  15         permissions = "0400";
  16         text = myconfig.env.sshd.ldap.password;
  17       };
  18     };
  19     system.activationScripts.sshd = ''
  20       install -Dm400 -o nobody -g nobody -T /run/keys/ssh-ldap /etc/ssh/ldap_password
  21       '';
  22     # ssh is strict about parent directory having correct rights, don't
  23     # move it in the nix store.
  24     environment.etc."ssh/ldap_authorized_keys" = let
  25       ldap_authorized_keys =
  26         mylibs.wrap {
  27           name = "ldap_authorized_keys";
  28           file = ./ldap_authorized_keys.sh;
  29           paths = [ pkgs.which pkgs.gitolite pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
  30         };
  31     in {
  32       enable = true;
  33       mode = "0755";
  34       user = "root";
  35       source = ldap_authorized_keys;
  36     };
  37   };
  38 }