pinpox/infra
1
0
Fork 0
forked from pub-solar/infra
Code Pull requests Activity

ssh: only allow ssh on wireguard interface

Browse source
This commit is contained in:
Benjamin Yule Bädorf 2024-04-05 13:05:45 +02:00
parent f7eaef0d18
commit b1519c8f22
Signed by untrusted user: b12f
GPG key ID: 729956E1124F8F26
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
modules/networking.nix
View file

@ -1,6 +1,10 @@
{ pkgs, ... }: { { pkgs, lib, ... }: {
# Don't expose SSH via public interfaces
networking.firewall.interfaces.wg-ssh.allowedTCPPorts = [ 22 ];
services.openssh = { services.openssh = {
enable = true; enable = true;
openFirewall = lib.mkDefault false;
settings = { settings = {
PermitRootLogin = "prohibit-password"; PermitRootLogin = "prohibit-password";
PasswordAuthentication = false; PasswordAuthentication = false;