chvp/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add readonly sftponly data access account

Browse source
This commit is contained in:
Charlotte Van Petegem 2022-06-03 21:02:37 +02:00
parent d19ec8b548
commit e71ae589e0
No known key found for this signature in database
GPG key ID: 019E764B7184435A
5 changed files with 34 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
modules/services/data-access/config.nix
View file

@ -9,6 +9,15 @@
group = "users";
passwordFile = "/run/secrets/password_file";
};
users.users.readonly = {
isNormalUser = true;
home = "/home/readonly";
description = "Readonly data access";
uid = 1001;
group = "sftponly";
passwordFile = "/run/secrets/readonly_password_file";
};
users.groups.sftponly = { gid = 10000; };
environment.systemPackages = [ pkgs.rsync pkgs.mktorrent (pkgs.writeShellScriptBin "create_torrent" ". /run/secrets/create_torrent") ];
security.sudo.enable = false;
services.openssh = {
@ -20,7 +29,12 @@
];
extraConfig = ''
HostKeyAlgorithms +ssh-rsa
Match group sftponly
X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no
ForceCommand internal-sftp
'';
authorizedKeysFiles = [ "/run/secrets/authorized_keys" ];
authorizedKeysFiles = [ "/run/secrets/%u_authorized_keys" ];
};
}