From ebacb741a7f834bbd48c94b655136bd8f284ffd8 Mon Sep 17 00:00:00 2001
From: Freya Murphy <freya@freyacat.org>
Date: Sun, 22 Jun 2025 15:35:40 -0400
Subject: add sshd

---
 programs/ssh/default.nix | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

(limited to 'programs/ssh')

diff --git a/programs/ssh/default.nix b/programs/ssh/default.nix
index 4c9b418..b6ecb1d 100644
--- a/programs/ssh/default.nix
+++ b/programs/ssh/default.nix
@@ -3,10 +3,43 @@
   lib,
   ...
 }: {
+  # ssh config
   home-manager.users.${config.user} = {
     programs.ssh = {
       enable = true;
       extraConfig = lib.fileContents ./config;
     };
   };
+
+  # sshd
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      UseDns = true;
+      X11Forwarding = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # allow ssh port
+  networking.firewall.allowedTCPPorts = [22];
+
+  # ban evil
+  services.fail2ban = {
+    enable = true;
+    ignoreIP = [
+      # freyanet
+      "10.0.0.0/14"
+    ];
+  };
+
+  # add authorized keys
+  users.users.${config.user} = {
+    openssh.authorizedKeys.keyFiles = [
+      ../../files/keys/ssh.pub
+    ];
+  };
 }
-- 
cgit v1.2.3-freya