feat(ssh): add enable option

home/hosts/andromache/default.nix

@@ -59,6 +59,7 @@
   shell.bash.aliases.lang-js = true;
   shell.bash.addBinToPath = true;
   audio.enable = true;
+  ssh.enable = true;
   music.enable = true;
   terminal.enable = true;
   devenv.enable = true;

home/hosts/astyanax/default.nix

@@ -56,6 +56,7 @@
   shell.bash.addBinToPath = true;
   my.yubikey.enable = true;
   audio.enable = true;
+  ssh.enable = true;
   music.enable = true;
   terminal.enable = true;
   devenv.enable = true;

home/modules/ssh/default.nix

@@ -1,10 +1,13 @@
 {
-  myUtils,
+  config,
   lib,
   pkgs,
+  myUtils,
   ...
 }:
+
 let
+  cfg = config.ssh;
   hostDir = ../../hosts;
   hostNames = myUtils.dirNames hostDir;
   hostsWithKeys = lib.filter (
@@ -12,6 +15,9 @@ let
   ) hostNames;
 in
 {
+  options.ssh.enable = lib.mkEnableOption "ssh";
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [ sshfs ];
 
     programs.ssh = {
@@ -39,4 +45,5 @@ in
           };
         };
     };
+  };
 }

modules/ssh/authorized-keys.nix

@@ -16,8 +16,8 @@ in
     };
   };
 
-  # auto generate authorized_keys from `authorizedHosts`
+  config = lib.mkIf config.ssh.enable {
-  config.users.users.${username}.openssh.authorizedKeys.keys =
+    users.users.${username}.openssh.authorizedKeys.keys =
       lib.flatten (
         map (
           hostname:
@@ -28,4 +28,5 @@ in
         ) ((builtins.filter (h: h != config.host.name) adminHosts) ++ config.ssh.authorizedHosts)
       )
       ++ lib.splitString "\n" (builtins.readFile ./ssh_bak.pub);
+  };
 }

modules/ssh/default.nix

@@ -1,10 +1,17 @@
-{ lib, ... }:
+{ lib, config, ... }:
 
+let
+  cfg = config.ssh;
+in
 {
   imports = [ ./hardened-openssh.nix ];
 
-  config.services.openssh = {
+  options.ssh.enable = lib.mkEnableOption "SSH server";
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
       enable = lib.mkDefault true;
       harden = lib.mkDefault true;
     };
+  };
 }

modules/ssh/extract-keys.nix

@@ -1,9 +1,10 @@
 { lib, config, ... }:
+
 let
   inherit (config.host) username;
 in
 {
-  # auto extract SSH keys
+  config = lib.mkIf config.ssh.enable {
     system.activationScripts.extractSshKeys = lib.stringAfter [ "etc" ] ''
       HOST_KEY="/etc/ssh/ssh_host_ed25519_key.pub"
       HOST_DIR="/home/${username}/nix/hosts/${config.networking.hostName}"
@@ -29,4 +30,5 @@ in
         chmod 644 "$HOST_DIR/ssh_user.pub"
       fi
     '';
+  };
 }

modules/ssh/hardened-openssh.nix

@@ -1,5 +1,7 @@
 { lib, config, ... }:
+
 with lib;
+
 let
   cfg = config.services.openssh;
 in
@@ -13,7 +15,7 @@ in
   options.services.openssh.harden = mkEnableOption "harden ssh server configuration";
 
   config = {
-    networking.firewall.allowedTCPPorts = [ 22 ];
+    networking.firewall.allowedTCPPorts = lib.mkIf config.ssh.enable [ 22 ];
 
     services.openssh.settings = optionalAttrs cfg.harden {
       PermitRootLogin = "no";

modules/ssh/known-hosts.nix

@@ -4,6 +4,7 @@
   outputs,
   ...
 }:
+
 let
   hosts = lib.attrNames outputs.nixosConfigurations;
   hostsWithKeys = lib.filter (
@@ -11,9 +12,10 @@ let
   ) hosts;
 in
 {
-  # auto generate known_hosts for all hosts in flake
+  config = lib.mkIf config.ssh.enable {
     programs.ssh.knownHosts = lib.genAttrs hostsWithKeys (hostname: {
       publicKeyFile = ../../hosts/${hostname}/ssh_host.pub;
       extraHostNames = lib.optional (hostname == config.networking.hostName) "localhost";
     });
+  };
 }