commit afeb76d6287955bc8c638365ebefe71a1fd7302a · pyrox.dev/nixpkgs

+45 -32

nixos/modules/services/networking/ssh/sshd.nix

···

       561
        
             };

     

       562
        
       

     

       563
        
           systemd =

     

       564
       -
             let

     

       565
       -
               service =

     

       566
       -
                 { description = "SSH Daemon";

     

       567
       -
                   wantedBy = lib.optional (!cfg.startWhenNeeded) "multi-user.target";

     

       568
       -
                   after = [ "network.target" "sshd-keygen.service" ];

     

       569
       -
                   wants = [ "sshd-keygen.service" ];

     

       570
       -
                   stopIfChanged = false;

     

       571
       -
                   path = [ cfg.package ];

     

       572
       -
                   environment.LD_LIBRARY_PATH = nssModulesPath;

     

       573
       -
       

     

       574
       -
                   restartTriggers = lib.optionals (!cfg.startWhenNeeded) [

     

       575
       -
                     config.environment.etc."ssh/sshd_config".source

     

       576
       -
                   ];

     

       577
       -
       

     

       578
       -
                   serviceConfig =

     

       579
       -
                     { ExecStart =

     

       580
       -
                         (lib.optionalString cfg.startWhenNeeded "-") +

     

       581
       -
                         "${cfg.package}/bin/sshd " + (lib.optionalString cfg.startWhenNeeded "-i ") +

     

       582
       -
                         "-D " +  # don't detach into a daemon process

     

       583
       -
                         "-f /etc/ssh/sshd_config";

     

       584
       -
                       KillMode = "process";

     

       585
       -
                     } // (if cfg.startWhenNeeded then {

     

       586
       -
                       StandardInput = "socket";

     

       587
       -
                       StandardError = "journal";

     

       588
       -
                     } else {

     

       589
       -
                       Restart = "always";

     

       590
       -
                       Type = "simple";

     

       591
       -
                     });

     

       592
       -
                 };

     

       593
       -
             in

     

       594
        
             {

     

       595
        
               sockets.sshd = lib.mkIf cfg.startWhenNeeded {

     

       596
        
                 description = "SSH Socket";

     
···

       607
        
                   # Prevent brute-force attacks from shutting down socket

     

       608
        
                   socketConfig.TriggerLimitIntervalSec = 0;

     

       609
        
               };

     

       610
       -
               services."sshd@" = lib.mkIf cfg.startWhenNeeded service;

     

       611
       -
               services.sshd = lib.mkIf (! cfg.startWhenNeeded) service;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       612
        
       

     

       613
        
               services.sshd-keygen = {

     

       614
        
                 description = "SSH Host Keys Generation";

···

       561
        
             };

     

       562
        
       

     

       563
        
           systemd =

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       564
        
             {

     

       565
        
               sockets.sshd = lib.mkIf cfg.startWhenNeeded {

     

       566
        
                 description = "SSH Socket";

     
···

       577
        
                   # Prevent brute-force attacks from shutting down socket

     

       578
        
                   socketConfig.TriggerLimitIntervalSec = 0;

     

       579
        
               };

     

       580
       +
       

     

       581
       +
               services."sshd@" = {

     

       582
       +
                 description = "SSH per-connection Daemon";

     

       583
       +
                 after = [ "network.target" "sshd-keygen.service" ];

     

       584
       +
                 wants = [ "sshd-keygen.service" ];

     

       585
       +
                 stopIfChanged = false;

     

       586
       +
                 path = [ cfg.package ];

     

       587
       +
                 environment.LD_LIBRARY_PATH = nssModulesPath;

     

       588
       +
       

     

       589
       +
                 serviceConfig = {

     

       590
       +
                   Type = "notify";

     

       591
       +
                   ExecStart = lib.concatStringsSep " " [

     

       592
       +
                     "-${lib.getExe' cfg.package "sshd"}"

     

       593
       +
                     "-i"

     

       594
       +
                     "-D"

     

       595
       +
                     "-f /etc/ssh/sshd_config"

     

       596
       +
                   ];

     

       597
       +
                   KillMode = "process";

     

       598
       +
                   StandardInput = "socket";

     

       599
       +
                   StandardError = "journal";

     

       600
       +
                 };

     

       601
       +
               };

     

       602
       +
       

     

       603
       +
               services.sshd = lib.mkIf (! cfg.startWhenNeeded) {

     

       604
       +
                 description = "SSH Daemon";

     

       605
       +
                 wantedBy = [ "multi-user.target" ];

     

       606
       +
                 after = [ "network.target" "sshd-keygen.service" ];

     

       607
       +
                 wants = [ "sshd-keygen.service" ];

     

       608
       +
                 stopIfChanged = false;

     

       609
       +
                 path = [ cfg.package ];

     

       610
       +
                 environment.LD_LIBRARY_PATH = nssModulesPath;

     

       611
       +
       

     

       612
       +
                 restartTriggers = [ config.environment.etc."ssh/sshd_config".source ];

     

       613
       +
       

     

       614
       +
                 serviceConfig = {

     

       615
       +
                   Type = "notify";

     

       616
       +
                   Restart = "always";

     

       617
       +
                   ExecStart = lib.concatStringsSep " " [

     

       618
       +
                     (lib.getExe' cfg.package "sshd")

     

       619
       +
                     "-D"

     

       620
       +
                     "-f" "/etc/ssh/sshd_config"

     

       621
       +
                   ];

     

       622
       +
                   KillMode = "process";

     

       623
       +
                 };

     

       624
       +
               };

     

       625
        
       

     

       626
        
               services.sshd-keygen = {

     

       627
        
                 description = "SSH Host Keys Generation";