initial commit

modules/ssh.nix

@@ -0,0 +1,28 @@
+{ lib, config, ... }:
+{
+  options.ssh = {
+    disable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = "disable ssh conifguration";
+    };
+    keys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      # A list of my keys so I can access my servers. This also allows me into
+      # root on every system using this module.
+      default = [
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJUvmBJcNTniRgcFj36vWVTlJHEL5JS8wAst65Tx+mLpD69QxGsaXU/xvluX7xl+gnAKM2mZrG8oGPCBxsug1VytHLthUHlDqSPa/iSLwHq2KoUlSMvLR6iVzZiBLc+x8+jXyDL0QE4cEPKSbKsPBqSwMyWVZLy3dpG4WuOhD6MkJ9+hsHvzfHR67bNkl8zuB2ghj4TiUHgW47JBSXaIEXzevDiVUfhH/bZV2UFXaAcl2UesqcEX5BS1/w0RrHpDZN6NZFjdu76ltXw9zR8qwSihHOaw0HOpN3ikw87ENE15DqEDBcC9bl+xklMfbGj3vgGitj3W7VfbUFwabyTb/M7e8e5jZlZ2Jdyx31xnoxSV2Mb2j+ZRVvzux4S4If5EJtkiR1i/fxjIS3Uf4lDa4lGy1lqKTDjrkuDYA2xoh+eA5PgLUFw1h1sROzerqarmVZAfyuvqnzO82xE39ea8zK9PeenVGjXn+USC1+ueGPvtlhmeKvIUUugNp3g2rciKM= squibid@vrooom"
+      ];
+    };
+  };
+
+  config = lib.mkIf (!config.ssh.disable) {
+    services.sshguard.enable = true;
+    services.openssh = {
+      enable = true;
+      settings.PasswordAuthentication = false;
+    };
+
+    users.users.root.openssh.authorizedKeys.keys = config.ssh.keys;
+  };
+}