xyno/nix-configs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

allow sftp

Browse source
This commit is contained in:
Philipp Hochkamp 2022-04-13 14:40:30 +02:00
parent 73e31ca37c
commit c181069544
3 changed files with 11 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hosts/ds9/default.nix
View file

@ -51,11 +51,19 @@ in
};
services.openssh.sftpServerExecutable = "internal-sftp";
services.openssh.extraConfig = ''
Match User picardbackup
ChrootDirectory ${config.users.users.picardbackup.home}
ForceCommand internal-sftp
AllowTcpForwarding no
'';
# Backup Target
users.users.picardbackup = {
createHome = true;
group = "users";
home = "/backups/picard";
home = "/backups/restic/picard";
isSystemUser = true;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvCF8KGgpF9O8Q7k+JXqZ5eMeEeTaMhCIk/2ZFOzXL0"

2
hosts/picard/default.nix
View file

@ -56,7 +56,7 @@
"--keep-yearly 75"
];
initialize = true;
repository = "sftp:ds9:/backups/picard/restic";
repository = "sftp:picardbackup@ds9:/restic";
paths = [
"/persistent"
];

2
nixos-modules/system/security.nix
View file

@ -12,7 +12,7 @@ in
security.sudo.execWheelOnly = true;
services.openssh = {
passwordAuthentication = false;
allowSFTP = false; # just use rsync, lol
allowSFTP = true; # just use rsync, lol
kbdInteractiveAuthentication = false;
extraConfig = ''
AllowTcpForwarding yes