aboutsummaryrefslogtreecommitdiff
path: root/modules/private/ssh/default.nix
diff options
context:
space:
mode:
Diffstat (limited to 'modules/private/ssh/default.nix')
-rw-r--r--modules/private/ssh/default.nix59
1 files changed, 56 insertions, 3 deletions
diff --git a/modules/private/ssh/default.nix b/modules/private/ssh/default.nix
index beedaff..d4c1ab3 100644
--- a/modules/private/ssh/default.nix
+++ b/modules/private/ssh/default.nix
@@ -1,7 +1,50 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let
3 cfg = config.myServices.ssh;
4in
2{ 5{
6 options.myServices.ssh = let
7 module = lib.types.submodule {
8 options = {
9 snippet = lib.mkOption {
10 type = lib.types.lines;
11 description = ''
12 Snippet to use
13 '';
14 };
15 dependencies = lib.mkOption {
16 type = lib.types.listOf lib.types.package;
17 default = [];
18 description = ''
19 Dependencies of the package
20 '';
21 };
22 };
23 };
24 in {
25 predefinedModules = lib.mkOption {
26 type = lib.types.attrsOf module;
27 default = {
28 regular = {
29 snippet = builtins.readFile ./ldap_regular.sh;
30 };
31 };
32 readOnly = true;
33 description = ''
34 Predefined modules
35 '';
36 };
37 modules = lib.mkOption {
38 type = lib.types.listOf module;
39 default = [];
40 description = ''
41 List of modules to enable
42 '';
43 };
44 };
3 config = { 45 config = {
4 networking.firewall.allowedTCPPorts = [ 22 ]; 46 networking.firewall.allowedTCPPorts = [ 22 ];
47 } // (lib.mkIf (builtins.length cfg.modules > 0) {
5 48
6 services.openssh.extraConfig = '' 49 services.openssh.extraConfig = ''
7 AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys 50 AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys
@@ -24,11 +67,21 @@
24 # ssh is strict about parent directory having correct rights, don't 67 # ssh is strict about parent directory having correct rights, don't
25 # move it in the nix store. 68 # move it in the nix store.
26 environment.etc."ssh/ldap_authorized_keys" = let 69 environment.etc."ssh/ldap_authorized_keys" = let
70 deps = lib.lists.unique (
71 [ pkgs.which pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ]
72 ++ lib.flatten (map (v: v.dependencies) cfg.modules)
73 );
74 fullScript = pkgs.runCommand "ldap_authorized_keys" {
75 snippets = builtins.concatStringsSep "\n" (map (v: v.snippet) cfg.modules);
76 } ''
77 substituteAll ${./ldap_authorized_keys.sh} $out
78 chmod a+x $out
79 '';
27 ldap_authorized_keys = 80 ldap_authorized_keys =
28 pkgs.mylibs.wrap { 81 pkgs.mylibs.wrap {
29 name = "ldap_authorized_keys"; 82 name = "ldap_authorized_keys";
30 file = ./ldap_authorized_keys.sh; 83 file = fullScript;
31 paths = [ pkgs.which pkgs.gitolite pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ]; 84 paths = deps;
32 }; 85 };
33 in { 86 in {
34 enable = true; 87 enable = true;
@@ -36,5 +89,5 @@
36 user = "root"; 89 user = "root";
37 source = ldap_authorized_keys; 90 source = ldap_authorized_keys;
38 }; 91 };
39 }; 92 });
40} 93}