From 1e845f7b765c4039f7541fb3542ba2bf76bb323c Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 14 Jan 2016 12:42:52 +0100
Subject: ma 1 omo: use sftp share

---
 makefu/1systems/omo.nix             |  4 ++++
 makefu/2configs/share-user-sftp.nix | 21 +++++++++++++++++++++
 makefu/2configs/smart-monitor.nix   |  4 +---
 3 files changed, 26 insertions(+), 3 deletions(-)
 create mode 100644 makefu/2configs/share-user-sftp.nix

(limited to 'makefu')

diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index 3daa74cf2..2a657995c 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -27,9 +27,12 @@ in {
       ../2configs/exim-retiolum.nix
       ../2configs/smart-monitor.nix
       ../2configs/mail-client.nix
+      ../2configs/share-user-sftp.nix
       ../3modules
     ];
+  # services.openssh.allowSFTP = false;
   krebs.build.host = config.krebs.hosts.omo;
+  
 
   # copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
   services.sabnzbd.enable = true;
@@ -103,4 +106,5 @@ in {
   zramSwap.enable = true;
   zramSwap.numDevices = 2;
 
+
 }
diff --git a/makefu/2configs/share-user-sftp.nix b/makefu/2configs/share-user-sftp.nix
new file mode 100644
index 000000000..2c93143ec
--- /dev/null
+++ b/makefu/2configs/share-user-sftp.nix
@@ -0,0 +1,21 @@
+{ config, ... }:
+
+{
+  users.users = {
+    share = {
+      uid = 9002;
+      home = "/var/empty";
+      openssh.authorizedKeys.keys = [ config.krebs.users.makefu.pubkey ];
+    };
+  };
+  # we will use internal-sftp to make uncomplicated Chroot work
+  services.openssh.extraConfig = ''
+    Match User share
+      ChrootDirectory /media
+      ForceCommand internal-sftp
+      AllowTcpForwarding no
+      PermitTunnel no
+      X11Forwarding no
+    Match All
+  '';
+}
diff --git a/makefu/2configs/smart-monitor.nix b/makefu/2configs/smart-monitor.nix
index 9b0290a9b..a37969d3d 100644
--- a/makefu/2configs/smart-monitor.nix
+++ b/makefu/2configs/smart-monitor.nix
@@ -12,8 +12,6 @@
     # short daily, long weekly, check on boot
     defaults.monitored = "-a -o on -s (S/../.././02|L/../../7/04)";
 
-    devices = lib.mkDefault [{
-      device = "/dev/sda";
-    }];
+    devices = lib.mkDefault [ ];
   };
 }
-- 
cgit v1.2.3