summaryrefslogblamecommitdiff
path: root/hosts/kay/modules/sftp.nix
blob: b9696527c0dc78824e71e452ffe9622b20a1765b (plain) (tree) 
84fb4de

0f622ef



84fb4de

0f622ef





84fb4de










0f622ef



0f622ef




















1

2
3
4

5

6
7
8
9
10

11
12
13
14
15
16
17
18
19
20

21
22
23

24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

                


                         
                                    




                               









                                                                                                   


                                                   



















                                                                                                  
{ config, ... }:

let
  storage = "/hdd/users";
  pubkeys = config.userdata.pubKeys;
in
{
  users = {
    groups."sftp".members = [];

    users."sftp" = {
      group = "sftp";
      shell = "/run/current-system/sw/bin/nologin";
      isNormalUser = true;
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmA1dyV+o9gfoxlbVG0Y+dn3lVqdFs5fMqfxyNc5/Lr sftp@cez"
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDCbgjAfyDNtLNyOS+sfLirYtfEAkGqV54LOwabpWkvf sftp@veu"
      ] ++ pubkeys;
    };

    users."nazer" = {
      group = "sftp";
      shell = "/run/current-system/sw/bin/nologin";
      isNormalUser = true;
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICV09w9Ovk9wk4Bhn/06iOn+Ss8lK3AmQAl8+lXHRycu nazu@pc"
      ];
    };
  };

  services.openssh.extraConfig  = ''
    Match Group sftp
    # chroot dir should be owned by root
    # and sub dirs by %u
    ChrootDirectory ${storage}/%u
    ForceCommand internal-sftp

    PermitTunnel no
    AllowAgentForwarding no
    AllowTcpForwarding no
    X11Forwarding no
  '';
}