c8h4/nixos-config
1
0
Fork 0
Code Issues Actions Activity

services: forgejo: simplify sshd setup
All checks were successful
flake / build (push) Successful in 2m59s
Details

Browse source 
Signed-off-by: Christoph Heiss <christoph@c8h4.io>
This commit is contained in:
Christoph Heiss 2024-08-24 17:47:58 +02:00
parent dfeffdf041
commit be9bb3843c
Signed by: c8h4
GPG key ID: 6817E9C75C0785D7
1 changed files with 1 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
services/forgejo.nix
View file

@ -145,15 +145,6 @@ in {
inherit (cfg) user group;
mode = "0750";
};
"/run/forgejo-dispatch/authorized-keys"."f+" = {
# sshd_config(5): The program must be owned by root, not writable by group or others
mode = "0755";
argument = builtins.concatStringsSep "\\n" [
"#!${lib.getExe pkgs.bash}"
''
exec ${pkgs.toybox}/bin/cat "${config.services.forgejo.stateDir}/.ssh/authorized_keys"''
];
};
};
services.nginx.virtualHosts.${fqdn} =
@ -182,14 +173,7 @@ in {
extraGroups = [ "restic-backup" ];
};
services.openssh = {
settings.AllowUsers = [ cfg.user ];
extraConfig = ''
Match User ${cfg.user}
AuthorizedKeysCommand /run/forgejo-dispatch/authorized-keys
AuthorizedKeysCommandUser ${cfg.user}
'';
};
services.openssh.settings.AllowUsers = [ cfg.user ];
services.restic.backups.forgejo = {
environmentFile = secrets."restic/rest-env".path;