From 0c4f3acb281be6290c55a6e96bc29fab5b5c7a11 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 11 Sep 2023 18:24:28 +0200
Subject: stockholm -> hrm

---
 configs/sshd.nix | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 configs/sshd.nix

(limited to 'configs/sshd.nix')

diff --git a/configs/sshd.nix b/configs/sshd.nix
new file mode 100644
index 0000000..281d498
--- /dev/null
+++ b/configs/sshd.nix
@@ -0,0 +1,26 @@
+{ config, lib, ... }: let
+  cfg.host = config.krebs.build.host;
+  nets =
+    lib.optional (cfg.host.nets?retiolum) cfg.host.nets.retiolum ++
+    lib.optional (cfg.host.nets?wiregrill) cfg.host.nets.wiregrill;
+in {
+  services.openssh = {
+    enable = true;
+  };
+  tv.iptables.input-internet-accept-tcp = [ "ssh" ];
+  tv.iptables.extra.nat.OUTPUT = [
+    "-o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22"
+  ];
+  tv.iptables.extra4.nat.PREROUTING =
+    map
+      (net: "-d ${net.ip4.addr} -p tcp --dport 22 -j ACCEPT")
+      (builtins.filter (net: net.ip4 != null) nets);
+  tv.iptables.extra6.nat.PREROUTING =
+    map
+      (net: "-d ${net.ip6.addr} -p tcp --dport 22 -j ACCEPT")
+      (builtins.filter (net: net.ip6 != null) nets);
+  tv.iptables.extra.nat.PREROUTING = [
+    "-p tcp --dport 22 -j REDIRECT --to-ports 0"
+    "-p tcp --dport 11423 -j REDIRECT --to-ports 22"
+  ];
+}
-- 
cgit v1.2.3