1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.autossh-ng;
in
{
###### interface
options = {
services.autossh-ng = {
sessions = lib.mkOption {
type = lib.types.attrsOf (
lib.types.submodule (
{ name, config, ... }:
{
options = {
user = lib.mkOption {
type = lib.types.str;
example = "bill";
description = "Name of the user the local session should run as";
};
destination = lib.mkOption {
type = lib.types.str;
example = "billremote@socks.host.net";
description = "Destination to connect to";
};
hostKeyChecking = lib.mkOption {
type = lib.types.bool;
description = ''
Whether to enable host key checking. The advantage of enabling
host key checking is that it protects against AitM attacks, on
the other hand disabling host key checking makes the autossh
connection resilient against host key rotations of the destination
machine.
'';
};
knownHostsFile = lib.mkOption {
type = lib.types.path;
example = "/home/bill/.ssh/known_hosts";
description = ''
If you enabled host key checking, use this file to verify
destination host keys against.
'';
};
extraArguments = lib.mkOption {
type = lib.types.separatedString " ";
example = "-L2222:localhost:22 -i \${config.age.secrets.privatekey.path}";
description = ''
Arguments to be passed to the ssh process process.
Some meaningful options include
-D (open SOCKS proxy on local port),
-R (forward remote port),
-L (forward local port),
-v (Enable debug),
-i (identity file to use).
Check ssh manual for the complete list.
'';
};
};
}
)
);
default = { };
description = ''
Set of SSH sessions to start as systemd services. Each service is
named 'autossh-ng-{session.name}'.
'';
example = {
"socket-peer" = {
user = "bill";
destination = "billremote@socks.host.net";
extraArguments = "-L2222:localhost:22 -i \${config.age.secrets.privatekey.path}";
};
};
};
};
};
###### implementation
config = lib.mkIf (cfg.sessions != { }) {
systemd.services =
lib.attrsets.mapAttrs' (name: s: {
name = "autossh-ng-${name}";
value = {
description = "Automatic SSH session (" + name + ")";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "notify";
NotifyAccess = "all";
User = "${s.user}";
# backoff would be nice, but doesn't automatically
# get reset on successful start yet, so static 10s restart for now:
Restart = "always";
RestartSec = "10s";
ExecStart =
let
hostKeyCheckOption =
if s.hostKeyChecking then
"-o \"UserKnownHostsFile=${s.knownHostsFile}\""
else
"-o \"UserKnownHostsFile=/dev/null\" -o \"StrictHostKeyChecking=no\"";
ready = pkgs.writers.writeBash "systemd-signal-ready" ''
${config.systemd.package}/bin/systemd-notify --ready
'';
in
''
${pkgs.openssh}/bin/ssh \
-o "ServerAliveInterval 30" \
-o "ServerAliveCountMax 3" \
-o "PermitLocalCommand=yes" \
-o "LocalCommand ${ready}" \
-o ExitOnForwardFailure=yes \
${hostKeyCheckOption} \
-N \
${s.extraArguments} \
${s.destination}
'';
};
};
}) cfg.sessions;
};
}
|
