os/kay/modules/sshfwd.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

{ ... }:
let
  group = "sshfwd";
in
{
  networking.firewall.allowedTCPPorts = [ 2222 ];

  users = {
    groups.${group}.members = [ ];

    users."lia" = {
      inherit group;
      isSystemUser = true;

      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe7fJlh9L+9JSq0+hK7jNZjszmZqNXwzqcZ+zx0yJyU lia"
      ];
    };
  };

  services.openssh.extraConfig = ''
    Match Group ${group}
    ForceCommand echo 'this account is only usable for remote forwarding'
    PermitTunnel no
    AllowAgentForwarding no
    X11Forwarding no

    AllowTcpForwarding remote
    GatewayPorts clientspecified
    PermitListen *:2222
  '';
}