begin migration to dendritic pattern

old-config/hosts/takamaki/modules/openssh.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  users.users."grey".openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeYFzFyv1LEdWngyTDqnsdJQhmgAfQbbksyZrNWkameVMJpi8IJ+3IIrL96BtD8EAC/jxHIbri49TInN0lYRBH3cH3jbBupdDFaziH3ohyMoeg8enKYsiisaT+MTGEGFygF9Ul1WDrOM1oThEP1LTYj5pWNfZRtIG870jLzRkNczb0eCtEO0qWtyH92Cb5BSpXBKd4Eaysvkm5ex77I5Y1Hl0RUjyEiegiwC1LrcrFhjhVFQGlShTr5kf/LJrwamyGJx4oLi462Omf/jLwNoIMLNgxzuJBynYK714AY9U/IbNq//bEQro6i2cwxPm4lSTaGemnhvEItHsDfbeAJ06iqOl51OtsM2qees2ygCgFvraKNRTmOoRkhS/IwC1bqoMqR8uraYcfKlXeXBjYnJbVG6u/SAGLg7Llmt5UAs7a6/W/7ytWJ90uQVjgPcb7h+9ji+jK18EQUd/AAknfLkLE5IoU5wj6+2OTAGeCT46BbMpYOk2RJinUy93VBIPuRyvZ5tdIt76BPt3JgosYbYtbdkyZTI8V72iCVLWae1uCF2pJlZ1gLteaS0ZmkgyEsAchm8VaoE8NrIO4MBpyZ3fZ9gsprT5jsnUb9Hc+opKSgX+OwDjzM5BadCUFtvoJE3FNTv7koIDg2myHyYj+1kFxp6ctjNgP9V9/0rc4oWz9ew== grey@kitagawa" ];
+
+  services.openssh = {
+    enable = true;
+    enableRecommendedAlgorithms = false;
+    generateHostKeys = false;
+    settings = {
+      AllowUsers = [ "grey" ];
+      KbdInteractiveAuthentication = false;
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+      MaxAuthTries = 3;
+      MaxSessions = 5;
+      MaxStartups = "2:50:5";
+    };
+    startWhenNeeded = true;
+  };
+
+  networking.firewall.extraCommands = ''
+    if [ "$(iptables -S INPUT)" != "-P INPUT ACCEPT" ]; then iptables -D INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP; ${pkgs.ipset}/bin/ipset destroy geo-whitelist; fi
+    ${pkgs.ipset}/bin/ipset restore -file /home/grey/nixos/assets/geo-whitelist.ipset
+    iptables -I INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP
+  '';
+}