diff options
| -rw-r--r-- | configuration.nix | 9 | ||||
| -rw-r--r-- | git.nix | 41 | ||||
| -rw-r--r-- | options.nix | 29 |
3 files changed, 75 insertions, 4 deletions
diff --git a/configuration.nix b/configuration.nix index 8335278..dfdbb64 100644 --- a/configuration.nix +++ b/configuration.nix @@ -2,6 +2,8 @@ imports = [ ./hardware-configuration.nix ./minecraft.nix + ./options.nix + ./git.nix ]; boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; @@ -12,10 +14,11 @@ services.openssh = { enable = true; + authorizedKeysInHomedir = false; # trust only /etc/ssh/authorized_keys.d/%u settings = { PasswordAuthentication = false; PermitRootLogin = "no"; - AllowUsers = [ "kassouni" ]; + AllowUsers = [ "kassouni" "git" ]; KbdInteractiveAuthentication = false; PubkeyAuthentication = true; }; @@ -24,9 +27,7 @@ users.users.kassouni = { extraGroups = [ "wheel" ]; isNormalUser = true; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBmhTnNG0ym84RJzbIcDCwGmPFVaFPkSYiUtNQrrnV6" - ]; + openssh.authorizedKeys.keys = config.my.adminKeys; }; system.stateVersion = "26.05"; @@ -0,0 +1,41 @@ +{config, pkgs, ...}: let + domain = "git.kassouni.net"; + repoRoot = "/srv/git"; +in { + users.users.git = { + isSystemUser = true; + group = "git"; + home = repoRoot; + createHome = true; + homeMode = "755"; + shell = "${pkgs.git}/bin/git-shell"; + openssh.authorizedKeys.keys = config.my.gitKeys; + }; + users.groups.git = { }; + + services.openssh.extraConfig = '' + Match user git + AllowTcpForwarding no + AllowAgentForwarding no + PermitTTY no + ''; + + services.cgit.${domain} = { + enable = true; + scanPath = repoRoot; + gitHttpBackend.checkExportOkFiles = true; + settings.strict-export = "git-daemon-export-ok"; + }; + + services.nginx.virtualHosts.${domain} = { + forceSSL = true; + enableACME = true; + }; + + security.acme = { + acceptTerms = true; + defaults.email = "alex@kassouni.net"; + }; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; +} diff --git a/options.nix b/options.nix new file mode 100644 index 0000000..ad62721 --- /dev/null +++ b/options.nix @@ -0,0 +1,29 @@ +{config, lib, ...}: let + alex = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBmhTnNG0ym84RJzbIcDCwGmPFVaFPkSYiUtNQrrnV6"; +in { + options.my = { + adminKeys = lib.mkOption { + type = with lib.types; listOf singleLineStr; + description = '' + Keys granted an interactive shell in the wheel group, i.e. root by way + of sudo. Only add a key you would trust with the whole machine. + ''; + }; + + gitKeys = lib.mkOption { + type = with lib.types; listOf singleLineStr; + description = '' + Keys granted git-shell access to the repositories under /srv/git. + No interactive shell and no sudo, so this is the list to grow when + someone needs to push. + ''; + }; + }; + + config.my = { + adminKeys = [ alex ]; + + # Admins push too; collaborator keys belong here and nowhere else. + gitKeys = config.my.adminKeys; + }; +} |