92abe2574d
- Change PermitRootLogin from 'no' to 'prohibit-password' (key-only) - Add forgejo-deploy public key to root's authorized_keys - Revert deploy-rs user back to root (needs root for activation) Root can only login via SSH key, password auth remains disabled.
16 lines
304 B
Nix
16 lines
304 B
Nix
{ lib, ... }:
|
|
|
|
let
|
|
inherit (lib) mkDefault;
|
|
in
|
|
{
|
|
services.openssh = {
|
|
enable = mkDefault true;
|
|
ports = mkDefault [ 2299 ];
|
|
openFirewall = mkDefault true;
|
|
settings = {
|
|
PermitRootLogin = mkDefault "prohibit-password";
|
|
PasswordAuthentication = mkDefault false;
|
|
};
|
|
};
|
|
}
|