diff options
author | makefu <github@syntax-fehler.de> | 2017-04-17 13:15:13 +0200 |
---|---|---|
committer | makefu <github@syntax-fehler.de> | 2017-04-17 13:15:13 +0200 |
commit | 35c7e1c37545dd96c90d54191ba835eb0ceeac8e (patch) | |
tree | 65db0a2d770654f555fcac74c8e457261054df5d /lass/1systems/iso.nix | |
parent | 9d7e9bf4a9630bb763d7d7bff7880c70405c7ea3 (diff) | |
parent | b6a4df7e398c7b4d7dc4f56d2eded22a79fee30f (diff) |
Merge remote-tracking branch 'lass/master'
Diffstat (limited to 'lass/1systems/iso.nix')
-rw-r--r-- | lass/1systems/iso.nix | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/lass/1systems/iso.nix b/lass/1systems/iso.nix index 9dfbf7cb..01d698c4 100644 --- a/lass/1systems/iso.nix +++ b/lass/1systems/iso.nix @@ -15,7 +15,6 @@ with import <stockholm/lib>; krebs.enable = true; krebs.build.user = config.krebs.users.lass; krebs.build.host = config.krebs.hosts.iso; - krebs.build.source.nixos-config.symlink = "stockholm/lass/1systems/${config.krebs.buil.host.name}.nix"; } { nixpkgs.config.allowUnfree = true; @@ -122,18 +121,12 @@ with import <stockholm/lib>; { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } ]; }; + systemd.services.sshd.wantedBy = mkForce [ "multi-user.target" ]; } { krebs.iptables = { enable = true; tables = { - nat.PREROUTING.rules = [ - { predicate = "! -i retiolum -p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; } - { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; } - ]; - nat.OUTPUT.rules = [ - { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 100; } - ]; filter.INPUT.policy = "DROP"; filter.FORWARD.policy = "DROP"; filter.INPUT.rules = [ @@ -148,5 +141,8 @@ with import <stockholm/lib>; }; }; } + { + krebs.hidden-ssh.enable = true; + } ]; } |