{ lib, config, ... }:

with lib;

let
  cfg = config.services.openssh;
in
{
  imports = [
    ./known-hosts.nix
    ./authorized-keys.nix
    ./extract-keys.nix
  ];

  options.services.openssh.harden = mkEnableOption "harden ssh server configuration";

  config = {
    networking.firewall.allowedTCPPorts = lib.mkIf config.ssh.enable [ 22 ];

    services.openssh = {
      settings = optionalAttrs cfg.harden {
        PermitRootLogin = "no";
        PasswordAuthentication = false;
        AuthenticationMethods = "publickey";
        KbdInteractiveAuthentication = false;
        ChallengeResponseAuthentication = false;
        X11Forwarding = false;
        AllowAgentForwarding = false;
        AllowTcpForwarding = false;
        PermitTunnel = false;
        MaxAuthTries = 3;
        LoginGraceTime = "1m";
        ClientAliveInterval = 300;
        ClientAliveCountMax = 2;
        TCPKeepAlive = false;
        MaxSessions = 4;
        LogLevel = "VERBOSE";
        AllowUsers = [ config.host.username ];
      };
      hostKeys = mkIf cfg.harden [
        {
          type = "ed25519";
          path = "/etc/ssh/ssh_host_ed25519_key";
        }
      ];
    };
  };
}