nixos-config/modules/nixos/common-settings/auth.nix

51 lines
918 B
Nix
Raw Normal View History

2024-08-25 09:45:58 +00:00
{
config,
lib,
pkgs,
...
}:
let
2024-08-25 09:45:58 +00:00
inherit (lib)
mkIf
mkEnableOption
mkOption
types
;
cfg = config.commonSettings.auth;
in
{
options.commonSettings.auth = {
enable = mkEnableOption "Common auth settings for servers";
};
config = mkIf cfg.enable {
custom.kanidm-client = {
enable = true;
uri = "https://auth.xinyang.life";
asSSHAuth = {
enable = true;
allowedGroups = [ "linux_users" ];
};
sudoers = [ "xin@auth.xinyang.life" ];
};
services.openssh = {
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
GSSAPIAuthentication = "no";
KerberosAuthentication = "no";
};
};
services.fail2ban.enable = true;
security.sudo = {
execWheelOnly = true;
wheelNeedsPassword = false;
};
};
}