summaryrefslogblamecommitdiff
path: root/hosts/kay/modules/sshfwd.nix
blob: 0f0d3c36ff68dbd55e1a334263c093eef9fba593 (plain) (tree) 
7bb35b9




























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28




























                                                                                                     
{ ... }: let
  group = "sshfwd";
in {
  networking.firewall.allowedTCPPorts = [ 2222 ];

  users = {
    groups.${group}.members = [];

    users."lia" = {
      inherit group;
      isSystemUser = true;

      openssh.authorizedKeys.keys
        = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe7fJlh9L+9JSq0+hK7jNZjszmZqNXwzqcZ+zx0yJyU lia" ];
    };
  };

  services.openssh.extraConfig  = ''
    Match Group ${group}
    ForceCommand echo 'this account is only usable for forwarding'
    PermitTunnel no
    AllowAgentForwarding no
    X11Forwarding no

    AllowTcpForwarding yes
    GatewayPorts yes
  '';
}