diff options
Diffstat (limited to 'nixos/modules/services/misc')
-rw-r--r-- | nixos/modules/services/misc/nix-ssh-serve.nix | 40 |
1 files changed, 23 insertions, 17 deletions
diff --git a/nixos/modules/services/misc/nix-ssh-serve.nix b/nixos/modules/services/misc/nix-ssh-serve.nix index 80e7961b1f82..d70bd855c7ff 100644 --- a/nixos/modules/services/misc/nix-ssh-serve.nix +++ b/nixos/modules/services/misc/nix-ssh-serve.nix @@ -1,32 +1,35 @@ { config, lib, pkgs, ... }: -let - serveOnly = pkgs.writeScript "nix-store-serve" '' - #!${pkgs.stdenv.shell} - if [ "$SSH_ORIGINAL_COMMAND" != "nix-store --serve" ]; then - echo 'Error: You are only allowed to run `nix-store --serve'\'''!' >&2 - exit 1 - fi - exec /run/current-system/sw/bin/nix-store --serve - ''; - - inherit (lib) mkIf mkOption types; -in { +with lib; + +{ options = { + nix.sshServe = { + enable = mkOption { - description = "Whether to enable serving the nix store over ssh."; - default = false; type = types.bool; + default = false; + description = "Whether to enable serving the Nix store as a binary cache via SSH."; + }; + + keys = mkOption { + type = types.listOf types.str; + default = []; + example = [ "ssh-dss AAAAB3NzaC1k... alice@example.org" ]; + description = "A list of SSH public keys allowed to access the binary cache via SSH."; }; + }; + }; config = mkIf config.nix.sshServe.enable { + users.extraUsers.nix-ssh = { - description = "User for running nix-store --serve."; + description = "Nix SSH substituter user"; uid = config.ids.uids.nix-ssh; - shell = pkgs.stdenv.shell; + useDefaultShell = true; }; services.openssh.enable = true; @@ -38,8 +41,11 @@ in { PermitTTY no PermitTunnel no X11Forwarding no - ForceCommand ${serveOnly} + ForceCommand ${config.nix.package}/bin/nix-store --serve Match All ''; + + users.extraUsers.nix-ssh.openssh.authorizedKeys.keys = config.nix.sshServe.keys; + }; } |