Emelie Graven
90eb0c3708
The entire file structure has been reorganised into stable and unstable to separate deployments running on either channel. A `mail` host running Simple Nix Mailserver has also been added for testing to see if it's a good alternative to soverin as well as SMTP for other services.
25 lines
681 B
Nix
25 lines
681 B
Nix
{ ... }:
|
|
{
|
|
services.openssh = {
|
|
enable = true;
|
|
permitRootLogin = "no";
|
|
passwordAuthentication = false;
|
|
challengeResponseAuthentication = false;
|
|
hostKeys = [ { "path" = "/etc/ssh/ssh_host_ed25519_key"; "type" = "ed25519"; } ];
|
|
kexAlgorithms = [ "curve25519-sha256" "curve25519-sha256@libssh.org" ];
|
|
macs = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512-etm@openssh.com" "umac-128-etm@openssh.com" ];
|
|
};
|
|
|
|
programs.ssh.knownHosts = {
|
|
despondos = {
|
|
hostNames = [ "despondos.nao.sh" ];
|
|
publicKeyFile = ../data/pubkeys/despondos_host_ed25519_key.pub;
|
|
};
|
|
};
|
|
|
|
services.sshguard = {
|
|
enable = true;
|
|
blocktime = 300;
|
|
};
|
|
}
|