Cleanup xnet module and add baseline modules

With these changes, the xnet module is useable as a system builder. At
this point, it is still undecided whether all configuration will be
generalized into this module, rather than keeping mini-modules local to
the machine they will run on.

3 files changed, 50 insertions, 132 deletions

diff --git a/modules/xnet/net/default.nix b/modules/xnet/net/default.nix
index 143f189..2255f53 100644
--- a/modules/xnet/net/default.nix
+++ b/modules/xnet/net/default.nix
@@ -5,6 +5,10 @@ let
   prefix = "10.26.4";
 in
 {
+  imports = [
+    ./sshd.nix
+  ];
+
   options.xnet.net = {
     interface = mkOption {
       type = types.str;
@@ -17,12 +21,6 @@ in
       description = "Final octet for xnet address.";
       example = 4;
     };
-
-    sshd = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Enable hardened SSH service.";
-    };
   };
 
   # TODO:
@@ -42,28 +40,5 @@ in
         prefixLength = 24;
       }];
     };
-
-    services.openssh = {
-      enable = cfg.sshd;
-      startWhenNeeded = true;
-      settings = {
-        X11Forwarding = false;
-        UsePAM = false;
-        PermitRootLogin = "prohibit-password";
-      };
-      extraConfig =
-        let
-          p = [
-            "sk-ssh-ed25519-cert-v01@openssh.com"
-            "ssh-ed25519-cert-v01@openssh.com"
-            "ssh-ed25519"
-          ];
-        in
-        "PubkeyAcceptedKeyTypes ${lib.strings.concatStringsSep "," p}";
-      hostKeys = [{
-        path = "/certs/ssh/ssh_host_ed25519_key";
-        type = "ed25519";
-      }];
-    };
   };
 }
diff --git a/modules/xnet/net/sshd.nix b/modules/xnet/net/sshd.nix
new file mode 100644
index 0000000..ef225db
--- /dev/null
+++ b/modules/xnet/net/sshd.nix
@@ -0,0 +1,46 @@
+{ config, lib, ... }:
+let
+  cfg = config.xnet.net.sshd;
+  inherit (lib) mkOption mkIf types;
+in
+{
+  options.xnet.net.sshd = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable hardened SSH service.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      startWhenNeeded = true;
+      openFirewall = true;
+      hostKeys = [{
+        path = "/persist/certs/ssh/ssh_host_ed25519_key";
+        type = "ed25519";
+      }];
+      settings = {
+        UsePAM = true;
+        X11Forwarding = false;
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+        Ciphers = [ "chacha20-poly1305@openssh.com" ];
+        Macs = [ "hmac-sha2-512-etm@openssh.com" ];
+        KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
+      };
+      sftpServerExecutable = "internal-sftp";
+      sftpFlags = [ "-f AUTHPRIV" "-l INFO" ];
+      extraConfig =
+        let
+          pubkeyTypes = lib.strings.concatStringsSep "," [
+            "sk-ssh-ed25519-cert-v01@openssh.com"
+            "ssh-ed25519-cert-v01@openssh.com"
+            "ssh-ed25519"
+          ];
+        in
+        "PubkeyAcceptedKeyTypes ${pubkeyTypes}";
+    };
+  };
+}
diff --git a/modules/xnet/net/vpn-gateway.nix b/modules/xnet/net/vpn-gateway.nix
deleted file mode 100644
index d26ced1..0000000
--- a/modules/xnet/net/vpn-gateway.nix
+++ /dev/null
@@ -1,103 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.xnet.net.vpnGateway;
-  inherit (lib) mkOption mkIf types;
-
-  iface = "enp2s0";
-  fwmark = "0x1";
-  ip = "192.168.2.113";
-  vpn = {
-    iface = "wg0";
-    endpoint = "149.88.22.129:51820";
-    addr = "10.69.70.71/32";
-    peers = [
-
-    ];
-  };
-in
-
-{
-  # options.xnet.net.vpnGateway = {
-  #   interface = mkOption {
-  #     type = types.str;
-  #     description = "Interface to forward VPN routed packets to internet";
-  #   };
-  #
-  #   vpn = types.subModule {
-  #     interface = mkOption {
-  #       type = types.str;
-  #       default = "wg0";
-  #       description = "Name of VPN interface.";
-  #     };
-  #
-  #     endpoint = mkOption {
-  #       type = types.str;
-  #       description = "ip:port of the VPN endpoint.";
-  #     };
-  #
-  #     addr = mkOption {
-  #       type = types.str;
-  #       description = "Address of the VPN interface.";
-  #     };
-  #
-  #     privateKeyFile = mkOption {
-  #       type = types.str;
-  #       description = "Path to private key.";
-  #     };
-  #
-  #     peers = types.listOf types.subModule {
-  #
-  #     };
-  #   };
-
-  boot.kernel.sysctl = {
-    "net.ipv4.ip_forward" = 1;
-    "net.ipv6.conf.all.forwarding" = 1;
-  };
-
-  networking = {
-    wg-quick.interfaces."${vpn.iface}" = {
-      address = [ vpn.addr ];
-      privateKeyFile = "/certs/wg/private.key";
-
-      peers = [{
-        publicKey = "yxyntWsANEwxeR0pOPNAcfWY7zEVICZe9G+GxortzEY=";
-        allowedIPs = [ "0.0.0.0/0" ];
-        endpoint = "149.88.22.129:51820";
-        persistentKeepalive = 25;
-      }];
-    };
-
-    nat = {
-      enable = true;
-      externalInterface = "wg0";
-      internalInterfaces = [ "enp2s0" ];
-    };
-
-    firewall = {
-      extraCommands = ''
-        # Create a new routing table for forwarded traffic
-        echo "200 vpn" >> /etc/iproute2/rt_tables
-
-        # Mark packets from other hosts
-        iptables -t mangle -A PREROUTING -i enp2s0 ! -s 192.168.1.113 -j MARK --set-mark 0x1
-
-        # Route marked packets through WireGuard
-        ip rule add fwmark 0x1 table vpn
-        ip route add default dev wg0 table vpn
-
-        # Allow forwarding
-        iptables -A FORWARD -i enp2s0 -o wg0 -j ACCEPT
-        iptables -A FORWARD -i wg0 -o enp2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-
-        # NAT only forwarded traffic
-        iptables -t nat -A POSTROUTING -o wg0 ! -s 192.168.1.113 -j MASQUERADE
-      '';
-
-      extraStopCommands = ''
-        ip rule del fwmark 0x1 table vpn 2>/dev/null || true
-        ip route flush table vpn 2>/dev/null || true
-      '';
-    };
-  };
-}