modules/common/openssh.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

{
  config,
  lib,
  pkgs,
  ...
}:
with lib; let
  cfg = config.nixfiles.modules.openssh;
in {
  options.nixfiles.modules.openssh.client.enable =
    mkEnableOption "OpenSSH client";

  config = mkIf cfg.client.enable {
    hm = {
      home.packages = with pkgs; [
        mosh
        sshfs
        sshpass
      ];

      programs.ssh = {
        enable = true;

        hashKnownHosts = true;

        controlMaster = "auto";
        controlPersist = "24H";

        serverAliveCountMax = 30;
        serverAliveInterval = 60;

        matchBlocks = let
          mkBlock = name: {
            hostname ? name,
            port ? 22022, # NOTE This is not the default OpenSSH port.
            user ? my.username,
            identityFile ? "${config.my.home}/.ssh/${my.username}_${my.ssh.type}",
            extraAttrs ? {},
          }:
            nameValuePair name ({inherit hostname port user identityFile;}
              // extraAttrs);

          internalServers =
            mapAttrs' mkBlock
            (mapAttrs (name: _: {
                hostname = "${name}.${my.domain.shire}";
              }) (filterAttrs (_: attr:
                hasAttr "wireguard" attr
                && attr.isHeadless)
              my.configurations));
        in
          internalServers
          // (mapAttrs' mkBlock {
            gitolite = {
              user = "git";
              hostname = "git.${my.domain.shire}";
            };
          });
      };
    };
  };
}