pub-solar/infra
6
1
Fork 3
Code Issues 25 Pull requests 11 Actions Packages Projects 1 Releases Wiki Activity

WIP: forgejo: run internal ssh server on port 22 #131

Closed
b12f wants to merge 1 commit from fix/forgejo-ssh into main
pull from: fix/forgejo-ssh
merge into: pub-solar:main
Conversation 1 Commits 1 Files changed 2 +6 -1
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit ad1ea4a49e - Show all commits

4
hosts/nachtigall/apps/forgejo.nix
View file

@ -41,6 +41,9 @@
users.groups.gitea = {}; users.groups.gitea = {};
# Expose SSH port only for forgejo SSH
networking.firewall.allowedTCPPorts = [ 22 ];
services.forgejo = { services.forgejo = {
enable = true; enable = true;
user = "gitea"; user = "gitea";
@ -63,6 +66,7 @@
DOMAIN = "git.pub.solar"; DOMAIN = "git.pub.solar";
HTTP_ADDR = "127.0.0.1"; HTTP_ADDR = "127.0.0.1";
HTTP_PORT = 3000; HTTP_PORT = 3000;
START_SSH_SERVER = true;
}; };
log.LEVEL = "Warn"; log.LEVEL = "Warn";

3
modules/networking.nix
View file

@ -1,10 +1,11 @@
{ pkgs, lib, ... }: { { pkgs, lib, ... }: {
# Don't expose SSH via public interfaces # Don't expose SSH via public interfaces
networking.firewall.interfaces.wg-ssh.allowedTCPPorts = [ 22 ]; networking.firewall.interfaces.wg-ssh.allowedTCPPorts = [ 2222 ];
services.openssh = { services.openssh = {
enable = true; enable = true;
openFirewall = lib.mkDefault false; openFirewall = lib.mkDefault false;
ports = [ 2222 ];
settings = { settings = {
PermitRootLogin = "prohibit-password"; PermitRootLogin = "prohibit-password";
PasswordAuthentication = false; PasswordAuthentication = false;