dotfiles/nixos/server-security.nix

33 lines
1,022 B
Nix
Raw Normal View History

2021-05-31 09:15:44 +01:00
{ config, pkgs, ... }:
2021-06-27 08:38:54 +01:00
let
authorizedKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5Ejx5CAPUfHVXi4GL4WmnZaG8eiiOmsW/a0o1bs1GF cyryl@foureighty"
2021-05-31 09:15:44 +01:00
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDN/2C59i+ucvSa9FLCHlVPJp0zebLOcw0+hnBYwy0cY cyryl@skinnyv"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwZ4M6lT2yzg8iarCzsLADAuXS4BUkLTt1+mKCECczk nix-builder@brix"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALNEUIxbENTdhSWzYupGFn/q+AGe0diBOTMyiZAmv7F nix-builder@vultr1"
];
2021-06-27 08:38:54 +01:00
in
{
imports = [
./security.nix
2021-05-31 09:15:44 +01:00
];
2021-06-27 08:38:54 +01:00
security.acme.email = "admin@cyplo.dev";
security.acme.acceptTerms = true;
services.fail2ban.enable = true;
services.openssh = {
enable = true;
permitRootLogin = "prohibit-password";
passwordAuthentication = false;
};
users.extraUsers.root.openssh.authorizedKeys.keys = authorizedKeys;
users.users.nix-builder = {
isNormalUser = true;
openssh.authorizedKeys.keys = authorizedKeys;
};
2021-05-31 09:15:44 +01:00
2021-06-27 08:38:54 +01:00
nix.trustedUsers = [ "root" "nix-builder" ];
}