blob: ff4ce0773309f5a8f14c8d26e34bb9233a6164a4 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.tmate-ssh-server;
defaultKeysDir = "/etc/tmate-ssh-server-keys";
edKey = "${defaultKeysDir}/ssh_host_ed25519_key";
rsaKey = "${defaultKeysDir}/ssh_host_rsa_key";
keysDir =
if cfg.keysDir == null
then defaultKeysDir
else cfg.keysDir;
domain = config.networking.domain;
in
{
options.services.tmate-ssh-server = {
enable = mkEnableOption (mdDoc "tmate ssh server");
package = mkOption {
type = types.package;
description = mdDoc "The package containing tmate-ssh-server";
defaultText = literalExpression "pkgs.tmate-ssh-server";
default = pkgs.tmate-ssh-server;
};
host = mkOption {
type = types.str;
description = mdDoc "External host name";
defaultText = lib.literalExpression "config.networking.domain or config.networking.hostName";
default =
if domain == null then
config.networking.hostName
else
domain;
};
port = mkOption {
type = types.port;
description = mdDoc "Listen port for the ssh server";
default = 2222;
};
openFirewall = mkOption {
type = types.bool;
default = false;
description = mdDoc "Whether to automatically open the specified ports in the firewall.";
};
advertisedPort = mkOption {
type = types.port;
description = mdDoc "External port advertised to clients";
};
keysDir = mkOption {
type = with types; nullOr str;
description = mdDoc "Directory containing ssh keys, defaulting to auto-generation";
default = null;
};
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = optionals cfg.openFirewall [ cfg.port ];
services.tmate-ssh-server = {
advertisedPort = mkDefault cfg.port;
};
environment.systemPackages =
let
tmate-config = pkgs.writeText "tmate.conf"
''
set -g tmate-server-host "${cfg.host}"
set -g tmate-server-port ${toString cfg.port}
set -g tmate-server-ed25519-fingerprint "@ed25519_fingerprint@"
set -g tmate-server-rsa-fingerprint "@rsa_fingerprint@"
'';
in
[
(pkgs.writeShellApplication {
name = "tmate-client-config";
runtimeInputs = with pkgs;[ openssh coreutils sd ];
text = ''
RSA_SIG="$(ssh-keygen -l -E SHA256 -f "${keysDir}/ssh_host_rsa_key.pub" | cut -d ' ' -f 2)"
ED25519_SIG="$(ssh-keygen -l -E SHA256 -f "${keysDir}/ssh_host_ed25519_key.pub" | cut -d ' ' -f 2)"
sd -sp '@ed25519_fingerprint@' "$ED25519_SIG" ${tmate-config} | \
sd -sp '@rsa_fingerprint@' "$RSA_SIG"
'';
})
];
systemd.services.tmate-ssh-server = {
description = "tmate SSH Server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${cfg.package}/bin/tmate-ssh-server -h ${cfg.host} -p ${toString cfg.port} -q ${toString cfg.advertisedPort} -k ${keysDir}";
};
preStart = mkIf (cfg.keysDir == null) ''
if [[ ! -d ${defaultKeysDir} ]]
then
mkdir -p ${defaultKeysDir}
fi
if [[ ! -f ${edKey} ]]
then
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f ${edKey} -N ""
fi
if [[ ! -f ${rsaKey} ]]
then
${pkgs.openssh}/bin/ssh-keygen -t rsa -f ${rsaKey} -N ""
fi
'';
};
};
meta = {
maintainers = with maintainers; [ jlesquembre ];
};
}
|