xyno/nix-configs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

allow sftp

Browse source
This commit is contained in:
Philipp Hochkamp 2022-04-13 14:40:30 +02:00
parent 73e31ca37c
commit c181069544
3 changed files with 11 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hosts/ds9/default.nix
View file

@ -51,11 +51,19 @@ in
}; };
services.openssh.sftpServerExecutable = "internal-sftp";
services.openssh.extraConfig = ''
Match User picardbackup
ChrootDirectory ${config.users.users.picardbackup.home}
ForceCommand internal-sftp
AllowTcpForwarding no
'';
# Backup Target # Backup Target
users.users.picardbackup = { users.users.picardbackup = {
createHome = true; createHome = true;
group = "users"; group = "users";
home = "/backups/picard"; home = "/backups/restic/picard";
isSystemUser = true; isSystemUser = true;
openssh.authorizedKeys.keys = [ openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvCF8KGgpF9O8Q7k+JXqZ5eMeEeTaMhCIk/2ZFOzXL0" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvCF8KGgpF9O8Q7k+JXqZ5eMeEeTaMhCIk/2ZFOzXL0"

2
hosts/picard/default.nix
View file

@ -56,7 +56,7 @@
"--keep-yearly 75" "--keep-yearly 75"
]; ];
initialize = true; initialize = true;
repository = "sftp:ds9:/backups/picard/restic"; repository = "sftp:picardbackup@ds9:/restic";
paths = [ paths = [
"/persistent" "/persistent"
]; ];

2
nixos-modules/system/security.nix
View file

@ -12,7 +12,7 @@ in
security.sudo.execWheelOnly = true; security.sudo.execWheelOnly = true;
services.openssh = { services.openssh = {
passwordAuthentication = false; passwordAuthentication = false;
allowSFTP = false; # just use rsync, lol allowSFTP = true; # just use rsync, lol
kbdInteractiveAuthentication = false; kbdInteractiveAuthentication = false;
extraConfig = '' extraConfig = ''
AllowTcpForwarding yes AllowTcpForwarding yes