feat: automate SSH config ('known_hosts', 'authorized_keys' ...)

2026-01-17 17:37:37 +01:00
parent 33b022c659
commit 8464884fdb
15 changed files with 143 additions and 9 deletions
--- a/modules/ssh/hardened-openssh.nix
+++ b/modules/ssh/hardened-openssh.nix
@@ -4,9 +4,17 @@ let
  cfg = config.services.openssh;
 in
 {
+  imports = [
+    ./known-hosts.nix
+    ./authorized-keys.nix
+    ./extract-keys.nix
+  ];
+
  options.services.openssh.harden = mkEnableOption "harden ssh server configuration";
+
  config = {
    networking.firewall.allowedTCPPorts = [ 22 ];
+
    services.openssh.settings = optionalAttrs cfg.harden {
      PermitRootLogin = "no";
      PasswordAuthentication = false;