diff options
| -rw-r--r-- | modules/dns.nix | 38 | ||||
| -rw-r--r-- | modules/network.nix | 68 | ||||
| -rw-r--r-- | modules/sshd.nix | 72 |
3 files changed, 140 insertions, 38 deletions
diff --git a/modules/dns.nix b/modules/dns.nix deleted file mode 100644 index 0632fa9..0000000 --- a/modules/dns.nix +++ /dev/null @@ -1,38 +0,0 @@ -{ lib, ... }: -let - inherit (lib) - mkDefault - ; - - quad9 = [ - "9.9.9.9#dns.quad9.net" - "149.112.112.112#dns.quad9.net" - "2620:fe::fe#dns.quad9.net" - "2620:fe::9#dns.quad9.net" - ]; - - cloudflare = [ - "1.1.1.1#one.one.one.one" - "1.0.0.1#one.one.one.one" - "2606:4700:4700::1111#one.one.one.one" - "2606:4700:4700::1001#one.one.one.one" - ]; -in -{ - - networking.nameservers = mkDefault quad9; - - services.resolved = { - enable = true; - llmnr = "false"; - dnssec = "false"; - dnsovertls = mkDefault "opportunistic"; - fallbackDns = quad9 ++ cloudflare; - extraConfig = '' - MulticastDNS=yes - ''; - }; - - # Allow mDNS resolution - networking.firewall.allowedTCPPorts = [ 5353 ]; -} diff --git a/modules/network.nix b/modules/network.nix new file mode 100644 index 0000000..790d159 --- /dev/null +++ b/modules/network.nix @@ -0,0 +1,68 @@ +{ config, lib, ... }: +let + cfg = config.depot.net; + inherit (lib) + mkOption + types + ; + + quad9 = [ + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + "2620:fe::fe#dns.quad9.net" + "2620:fe::9#dns.quad9.net" + ]; + + cloudflare = [ + "1.1.1.1#one.one.one.one" + "1.0.0.1#one.one.one.one" + "2606:4700:4700::1111#one.one.one.one" + "2606:4700:4700::1001#one.one.one.one" + ]; + +in +{ + imports = [ + ./sshd.nix + ]; + + options.depot.net = { + v6Token = mkOption { + type = types.str; + default = "eui64"; + description = "Token for global v6 address, defaults to eui64"; + }; + }; + + config = { + # networkd handles this + networking.useDHCP = false; + + systemd.network.enable = true; + systemd.network.networks = { + "10-base" = { + matchConfig = { + Name = "*"; + Type = "ether"; + }; + + ipv6AcceptRAConfig.Token = cfg.v6Token; + + networkConfig = { + DHCP = "ipv4"; + UseDomains = true; + + # Enable MDNS resolve/publish over this network + MulticastDNS = true; + }; + }; + }; + + networking.firewall.allowedUDPPorts = [ 5353 ]; + + services.resolved = { + enable = true; + settings.Resolve.FallBackDNS = quad9 ++ cloudflare; + }; + }; +} diff --git a/modules/sshd.nix b/modules/sshd.nix new file mode 100644 index 0000000..86fea58 --- /dev/null +++ b/modules/sshd.nix @@ -0,0 +1,72 @@ +{ + config, + lib, + ... +}: + +let + cfg = config.depot.net.sshd; + inherit (lib) + mkOption + mkDefault + mkIf + types + ; +in +{ + options.depot.net.sshd = { + enable = mkOption { + type = types.bool; + default = false; + description = "Enable hardened SSH service."; + }; + publish = mkOption { + type = types.bool; + default = false; + description = "Publish SSH service over mDNS."; + }; + }; + + config = mkIf cfg.enable { + services.openssh = { + enable = true; + startWhenNeeded = true; + openFirewall = true; + hostKeys = lib.singleton { + path = "/persist/certs/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + }; + settings = { + UsePAM = false; + X11Forwarding = false; + PermitRootLogin = "prohibit-password"; + PasswordAuthentication = mkDefault false; + # Ciphers = [ "chacha20-poly1305@openssh.com" ]; + # Macs = [ "hmac-sha2-512-etm@openssh.com" ]; + # KexAlgorithms = [ "curve25519-sha256@libssh.org" ]; + }; + sftpServerExecutable = "internal-sftp"; + sftpFlags = [ + "-f AUTHPRIV" + "-l INFO" + ]; + # extraConfig = + # let + # pubkeyTypes = lib.strings.concatStringsSep "," [ + # "sk-ssh-ed25519-cert-v01@openssh.com" + # "ssh-ed25519-cert-v01@openssh.com" + # "ssh-ed25519" + # ]; + # in + # "PubkeyAcceptedKeyTypes ${pubkeyTypes}"; + }; + + environment.etc."systemd/dnssd/ssh.dnssd".text = mkIf cfg.publish '' + [Service] + Name=%H + Type=_ssh._tcp + Port=22 + TxtText=hello world + ''; + }; +} |