motiejus/config
1
Fork 0
Code Packages Releases Activity

fra1-b: block global sshd

Browse Source
This commit is contained in:
Motiejus Jakštys 2024-08-27 08:36:02 +03:00
parent d91976dafc
commit 96a98405ad
2 changed files with 21 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hosts/fra1-b/configuration.nix
View File

@ -70,7 +70,6 @@ in
services = { services = {
node_exporter.enable = true; node_exporter.enable = true;
sshguard.enable = true;
tailscale.enable = true; tailscale.enable = true;
ssh8022.server = { ssh8022.server = {
@ -127,10 +126,7 @@ in
useDHCP = true; useDHCP = true;
firewall = { firewall = {
allowedUDPPorts = [ 53 ]; allowedUDPPorts = [ 53 ];
allowedTCPPorts = [ allowedTCPPorts = [ 53 ];
22
53
];
}; };
}; };

14
modules/services/ssh8022/default.nix
View File

@ -34,7 +34,18 @@
cfg = config.mj.services.ssh8022.server; cfg = config.mj.services.ssh8022.server;
in in
lib.mkIf cfg.enable { lib.mkIf cfg.enable {
services.spiped = {
mj.services.friendlyport.ports = [
{
subnets = [ myData.subnets.tailscale.cidr ];
tcp = [ 22 ];
}
];
services = {
openssh.openFirewall = false;
spiped = {
enable = true; enable = true;
config = { config = {
ssh8022 = { ssh8022 = {
@ -45,6 +56,7 @@
}; };
}; };
}; };
};
networking.firewall.allowedTCPPorts = [ myData.ports.ssh8022 ]; networking.firewall.allowedTCPPorts = [ myData.ports.ssh8022 ];
systemd.services."spiped@ssh8022" = { systemd.services."spiped@ssh8022" = {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];