fix(ssh): further harden SSH

modules/ssh/hardened-openssh.nix

@@ -17,18 +17,32 @@ in
   config = {
     networking.firewall.allowedTCPPorts = lib.mkIf config.ssh.enable [ 22 ];
 
-    services.openssh.settings = optionalAttrs cfg.harden {
+    services.openssh = {
-      PermitRootLogin = "no";
+      settings = optionalAttrs cfg.harden {
-      PasswordAuthentication = false;
+        PermitRootLogin = "no";
-      AuthenticationMethods = "publickey";
+        PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
+        AuthenticationMethods = "publickey";
-      ChallengeResponseAuthentication = false;
+        KbdInteractiveAuthentication = false;
-      X11Forwarding = false;
+        ChallengeResponseAuthentication = false;
-      AllowAgentForwarding = false;
+        X11Forwarding = false;
-      AllowTcpForwarding = false;
+        AllowAgentForwarding = false;
-      PermitTunnel = false;
+        AllowTcpForwarding = false;
-      MaxAuthTries = 3;
+        PermitTunnel = false;
-      LoginGraceTime = "1m";
+        MaxAuthTries = 3;
+        LoginGraceTime = "1m";
+        ClientAliveInterval = 300;
+        ClientAliveCountMax = 2;
+        TCPKeepAlive = false;
+        MaxSessions = 4;
+        LogLevel = "VERBOSE";
+        AllowUsers = [ config.host.username ];
+      };
+      hostKeys = mkIf cfg.harden [
+        {
+          type = "ed25519";
+          path = "/etc/ssh/ssh_host_ed25519_key";
+        }
+      ];
     };
   };
 }