feat: ssh

modules/base/default.nix

@@ -6,6 +6,7 @@
     ./stylix
 
     ./programs
+    ./services
 
     ./profiles.nix
     ./home.nix

modules/base/profiles.nix

@@ -20,6 +20,10 @@ in {
         nix-output-monitor = enabled;
         ripgrep = enabled;
       };
+
+      services = {
+        openssh = enabled; # required for agenix
+      };
     }
     #
     #

modules/base/services/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./openssh.nix
+  ];
+}

modules/base/services/openssh.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.marleyos.services.openssh;
+in {
+  options.marleyos.services.openssh.enable = lib.mkEnableOption "openssh";
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+
+      settings = {
+        PermitRootLogin = "prohibit-password";
+      };
+    };
+  };
+}

modules/darwin/services/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./openssh.nix
+  ];
+}

modules/darwin/services/openssh.nix

@@ -0,0 +1,13 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.marleyos.services.openssh;
+in {
+  config = lib.mkIf cfg.enable {
+    services.openssh.extraConfig = ''
+      PermitRootLogin prohibit-password
+    '';
+  };
+}

modules/home/profiles.nix

@@ -28,6 +28,7 @@ in {
         man = enabled;
         nh = enabled;
         ripgrep = enabled;
+        ssh = enabled;
       };
     }
     #

modules/home/programs/default.nix

@@ -25,6 +25,7 @@
     ./neovim.nix
     ./nh.nix
     ./ripgrep.nix
+    ./ssh.nix
     ./waybar.nix
 
     # TODO: uncomment when swaylock is figured out

modules/nixos/profiles.nix

@@ -12,13 +12,11 @@ in {
     # Universal - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
     {
       programs = {
-        fish = enabled;
         nh = enabled;
       };
 
       services = {
         docker = enabled;
-        openssh = enabled; # needed for agenix
       };
     }
     #

modules/nixos/services/openssh.nix

@@ -5,15 +5,9 @@
 }: let
   cfg = config.marleyos.services.openssh;
 in {
-  options.marleyos.services.openssh.enable = lib.mkEnableOption "openssh";
-
   config = lib.mkIf cfg.enable {
-    services.openssh = {
+    services.openssh.settings = {
-      enable = true;
+      PermitRootLogin = "prohibit-password";
-
-      settings = {
-        PermitRootLogin = "prohibit-password";
-      };
     };
   };
 }