summaryrefslogtreecommitdiffstats
path: root/lass/2configs/default.nix
diff options
context:
space:
mode:
Diffstat (limited to 'lass/2configs/default.nix')
-rw-r--r--lass/2configs/default.nix21
1 files changed, 8 insertions, 13 deletions
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index 972b4760a..27242b129 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -23,8 +23,8 @@ with import <stockholm/lib>;
openssh.authorizedKeys.keys = [
config.krebs.users.lass-mors.pubkey
config.krebs.users.lass-blue.pubkey
- config.krebs.users.lass-shodan.pubkey
- config.krebs.users.lass-icarus.pubkey
+ config.krebs.users.lass-xerxes.pubkey
+ config.krebs.users.lass-yubikey.pubkey
];
};
mainUser = {
@@ -42,6 +42,8 @@ with import <stockholm/lib>;
openssh.authorizedKeys.keys = [
config.krebs.users.lass-mors.pubkey
config.krebs.users.lass-blue.pubkey
+ config.krebs.users.lass-xerxes.pubkey
+ config.krebs.users.lass-yubikey.pubkey
];
};
};
@@ -173,13 +175,7 @@ with import <stockholm/lib>;
'';
};
- services.openssh = {
- enable = true;
- hostKeys = [
- # XXX bits here make no science
- { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
- ];
- };
+ services.openssh.enable = true;
services.journald.extraConfig = ''
SystemMaxUse=1G
@@ -190,7 +186,9 @@ with import <stockholm/lib>;
enable = true;
tables = {
nat.PREROUTING.rules = [
- { predicate = "! -i retiolum -p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; }
+ { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; }
+ { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; }
+ { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; }
{ predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; }
];
nat.OUTPUT.rules = [
@@ -217,7 +215,4 @@ with import <stockholm/lib>;
networking.dhcpcd.extraConfig = ''
noipv4ll
'';
- services.netdata = {
- enable = true;
- };
}