define simple shared network with mdns for local hosts

3 files changed, 140 insertions, 38 deletions

diff --git a/modules/dns.nix b/modules/dns.nix
deleted file mode 100644
index 0632fa9..0000000
--- a/modules/dns.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib)
-    mkDefault
-    ;
-
-  quad9 = [
-    "9.9.9.9#dns.quad9.net"
-    "149.112.112.112#dns.quad9.net"
-    "2620:fe::fe#dns.quad9.net"
-    "2620:fe::9#dns.quad9.net"
-  ];
-
-  cloudflare = [
-    "1.1.1.1#one.one.one.one"
-    "1.0.0.1#one.one.one.one"
-    "2606:4700:4700::1111#one.one.one.one"
-    "2606:4700:4700::1001#one.one.one.one"
-  ];
-in
-{
-
-  networking.nameservers = mkDefault quad9;
-
-  services.resolved = {
-    enable = true;
-    llmnr = "false";
-    dnssec = "false";
-    dnsovertls = mkDefault "opportunistic";
-    fallbackDns = quad9 ++ cloudflare;
-    extraConfig = ''
-      MulticastDNS=yes
-    '';
-  };
-
-  # Allow mDNS resolution
-  networking.firewall.allowedTCPPorts = [ 5353 ];
-}
diff --git a/modules/network.nix b/modules/network.nix
new file mode 100644
index 0000000..790d159
--- /dev/null
+++ b/modules/network.nix
@@ -0,0 +1,68 @@
+{ config, lib, ... }:
+let
+  cfg = config.depot.net;
+  inherit (lib)
+    mkOption
+    types
+    ;
+
+  quad9 = [
+    "9.9.9.9#dns.quad9.net"
+    "149.112.112.112#dns.quad9.net"
+    "2620:fe::fe#dns.quad9.net"
+    "2620:fe::9#dns.quad9.net"
+  ];
+
+  cloudflare = [
+    "1.1.1.1#one.one.one.one"
+    "1.0.0.1#one.one.one.one"
+    "2606:4700:4700::1111#one.one.one.one"
+    "2606:4700:4700::1001#one.one.one.one"
+  ];
+
+in
+{
+  imports = [
+    ./sshd.nix
+  ];
+
+  options.depot.net = {
+    v6Token = mkOption {
+      type = types.str;
+      default = "eui64";
+      description = "Token for global v6 address, defaults to eui64";
+    };
+  };
+
+  config = {
+    # networkd handles this
+    networking.useDHCP = false;
+
+    systemd.network.enable = true;
+    systemd.network.networks = {
+      "10-base" = {
+        matchConfig = {
+          Name = "*";
+          Type = "ether";
+        };
+
+        ipv6AcceptRAConfig.Token = cfg.v6Token;
+
+        networkConfig = {
+          DHCP = "ipv4";
+          UseDomains = true;
+
+          # Enable MDNS resolve/publish over this network
+          MulticastDNS = true;
+        };
+      };
+    };
+
+    networking.firewall.allowedUDPPorts = [ 5353 ];
+
+    services.resolved = {
+      enable = true;
+      settings.Resolve.FallBackDNS = quad9 ++ cloudflare;
+    };
+  };
+}
diff --git a/modules/sshd.nix b/modules/sshd.nix
new file mode 100644
index 0000000..86fea58
--- /dev/null
+++ b/modules/sshd.nix
@@ -0,0 +1,72 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.depot.net.sshd;
+  inherit (lib)
+    mkOption
+    mkDefault
+    mkIf
+    types
+    ;
+in
+{
+  options.depot.net.sshd = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable hardened SSH service.";
+    };
+    publish = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Publish SSH service over mDNS.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      startWhenNeeded = true;
+      openFirewall = true;
+      hostKeys = lib.singleton {
+        path = "/persist/certs/ssh/ssh_host_ed25519_key";
+        type = "ed25519";
+      };
+      settings = {
+        UsePAM = false;
+        X11Forwarding = false;
+        PermitRootLogin = "prohibit-password";
+        PasswordAuthentication = mkDefault false;
+        # Ciphers = [ "chacha20-poly1305@openssh.com" ];
+        # Macs = [ "hmac-sha2-512-etm@openssh.com" ];
+        # KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
+      };
+      sftpServerExecutable = "internal-sftp";
+      sftpFlags = [
+        "-f AUTHPRIV"
+        "-l INFO"
+      ];
+      # extraConfig =
+      #   let
+      #     pubkeyTypes = lib.strings.concatStringsSep "," [
+      #       "sk-ssh-ed25519-cert-v01@openssh.com"
+      #       "ssh-ed25519-cert-v01@openssh.com"
+      #       "ssh-ed25519"
+      #     ];
+      #   in
+      #   "PubkeyAcceptedKeyTypes ${pubkeyTypes}";
+    };
+
+    environment.etc."systemd/dnssd/ssh.dnssd".text = mkIf cfg.publish ''
+      [Service]
+      Name=%H
+      Type=_ssh._tcp
+      Port=22
+      TxtText=hello world
+    '';
+  };
+}