fix(ssh): harden ARM SD installer image SSH

deploy/colmena.nix

@@ -19,10 +19,27 @@ inputs.colmena.lib.makeHive {
 
   vm.deployment.tags = [ "local" ];
 
-  hecuba.deployment = {
+  hecuba =
+    { ... }:
+    {
+      imports = [ ../hosts/hecuba ];
+      deployment = {
         targetHost = "hecuba";
         targetUser = "username";
         targetPort = 22;
         tags = [ "cloud" ];
       };
+    };
+
+  eetion =
+    { ... }:
+    {
+      imports = [ ../hosts/eetion ];
+      deployment = {
+        targetHost = "eetion";
+        targetUser = "h";
+        targetPort = 22;
+        tags = [ "arm" ];
+      };
+    };
 }

flake.nix

@@ -77,7 +77,7 @@
         "nixpkgs=${inputs.nixpkgs}"
       ]; # <https://github.com/nix-community/nixd/blob/main/nixd/docs/configuration.md>
       nixosConfigurations =
-        (lib.genAttrs hostDirNames (
+        (lib.genAttrs (lib.filter (h: h != "eetion") hostDirNames) (
           host:
           nixpkgs.lib.nixosSystem {
             modules = [ ./hosts/${host} ];
@@ -87,6 +87,13 @@
           }
         ))
         // {
+          eetion = nixpkgs.lib.nixosSystem {
+            system = "aarch64-linux";
+            modules = [ ./hosts/eetion ];
+            specialArgs = {
+              inherit inputs outputs dotsPath;
+            };
+          };
           sd-image-aarch64 = nixpkgs.lib.nixosSystem {
             system = "x86_64-linux";
             modules = [

hosts/andromache/default.nix

@@ -13,6 +13,7 @@ let
 in
 {
   imports = [
+    inputs.disko.nixosModules.disko
     ../../modules/common
     ./hard.nix
     inputs.nixos-hardware.nixosModules.common-cpu-intel
@@ -89,6 +90,12 @@ in
     };
   };
 
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+  environment.systemPackages = [
+    inputs.colmena.packages.${pkgs.system}.colmena
+  ];
+
 
   services = {
     xserver = {

hosts/astyanax/default.nix

@@ -13,6 +13,7 @@ let
 in
 {
   imports = [
+    inputs.disko.nixosModules.disko
     ../../modules/common
     ./hard.nix
     inputs.nixos-hardware.nixosModules.common-pc
@@ -75,6 +76,7 @@ in
   };
 
   environment.systemPackages = [
+    inputs.colmena.packages.${pkgs.system}.colmena
     (pkgs.writeShellApplication {
       name = "wol-andromache";
       runtimeInputs = [ pkgs.wakeonlan ];

hosts/eetion/default.nix

@@ -0,0 +1,62 @@
+{ pkgs, ... }:
+
+# Orange Pi Zero2 H616
+# See <https://nixos.wiki/wiki/NixOS_on_ARM/Orange_Pi_Zero2_H616>
+
+let
+  username = "h";
+  hostName = "eetion";
+in
+{
+  imports = [
+    ./hard.nix
+    ../../modules/ssh/hardened-openssh.nix
+  ];
+
+  ssh.username = username;
+  ssh.authorizedHosts = [
+    "andromache"
+    "astyanax"
+  ];
+
+  boot.loader = {
+    grub.enable = false;
+    generic-extlinux-compatible.enable = true;
+  };
+
+  networking.hostName = hostName;
+  networking.networkmanager.enable = true;
+
+  users.users = {
+    root.hashedPassword = "!";
+    ${username} = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+    };
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  services.openssh = {
+    enable = true;
+    harden = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+  ];
+
+  nix.settings = {
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+    trusted-users = [
+      "root"
+      "@wheel"
+    ];
+  };
+
+  system.stateVersion = "26.05";
+}

hosts/eetion/hard.nix

@@ -0,0 +1,22 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [ ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXOS_SD";
+    fsType = "ext4";
+    options = [ "noatime" ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

hosts/hecuba/default.nix

@@ -15,6 +15,7 @@ let
 in
 {
   imports = [
+    inputs.disko.nixosModules.disko
     ../../modules/common
     ./hard.nix
     ../../modules/ssh/hardened-openssh.nix

hosts/vm/default.nix

@@ -12,6 +12,7 @@ let
 in
 {
   imports = [
+    inputs.disko.nixosModules.disko
     ../../modules/common
     ./hard.nix
     inputs.sops-nix.nixosModules.sops

images/sd-image-aarch64.nix

@@ -37,7 +37,10 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    harden = true;
+  };
 
   # sdImage.postBuildCommands =
   #   let

modules/common/default.nix

@@ -7,7 +7,6 @@
 
 {
   imports = [
-    inputs.disko.nixosModules.disko
     inputs.home-manager.nixosModules.default
   ];