41 lines
1.1 KiB
Nix
41 lines
1.1 KiB
Nix
{
|
|
flake,
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}: {
|
|
# disable NetworkManager and systemd-networkd -wait-online by default
|
|
systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
|
|
systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
|
|
|
|
networking.networkmanager = {
|
|
# Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
|
|
enable = lib.mkDefault true;
|
|
wifi.backend = lib.mkDefault "iwd";
|
|
};
|
|
|
|
networking.firewall.enable = true;
|
|
|
|
# For rage encryption, all hosts need a ssh key pair
|
|
services.openssh = {
|
|
enable = lib.mkDefault false;
|
|
allowSFTP = lib.mkDefault false;
|
|
|
|
# If you don't want the host to have SSH actually opened up to the net,
|
|
# set `services.openssh.openFirewall` to false in your config.
|
|
openFirewall = true;
|
|
|
|
settings.PasswordAuthentication = lib.mkDefault false;
|
|
settings.KbdInteractiveAuthentication = false;
|
|
|
|
extraConfig = ''
|
|
AllowTcpForwarding yes
|
|
X11Forwarding no
|
|
AllowAgentForwarding no
|
|
AllowStreamLocalForwarding no
|
|
AuthenticationMethods publickey
|
|
'';
|
|
};
|
|
}
|