finish configuration for ssh

- iptables geoip whitelist for ssh
- NOPASSWD for efibootmgr, allowing easy reboot into windows from laptop/phone
- no fastfetch for remote shells

hosts/takamaki/configs/fastfetch.nix

@@ -3,7 +3,21 @@
   lib,
   ...
 }: {
-  programs.zsh.initContent = lib.mkOrder 1500 "fastfetch";
+  programs.zsh.initContent = lib.mkOrder 1500 ''
+    SESSION_TYPE=local
+    if [ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ]; then
+      SESSION_TYPE=remote/ssh
+    # many other tests omitted
+    else
+      case $(ps -o comm= -p "$PPID") in
+        sshd|*/sshd) SESSION_TYPE=remote/ssh;;
+      esac
+    fi
+
+    if [ $SESSION_TYPE != remote/ssh ]; then
+      fastfetch
+    fi
+  '';
 
   programs.fastfetch = {
     enable = true;

hosts/takamaki/default.nix

@@ -29,6 +29,8 @@ in {
 
   environment.systemPackages = with pkgs; [
     efibootmgr
+    iptables
+    ipset
   ];
 
   hardware.steam-hardware.enable = true;

hosts/takamaki/home.nix

@@ -61,6 +61,17 @@ in {
     gtk2.force = true;
   };
 
+  programs.ssh = {
+    settings = {
+      "sakamoto" = {
+        HostName = "192.168.0.40";
+        Port = "22";
+        User = "grey";
+        IdentityFile = "~/.ssh/id_sakamoto";
+      };
+    };
+  };
+
   home.activation = {
     linkAutostartDir = lib.hm.dag.entryAfter ["writeBoundary"] ''
         #!/bin/bash
@@ -81,4 +92,24 @@ in {
       sudo reboot
     '';
   };
+
+  home.file.".local/bin/universal-shutdown" = {
+    enable = true;
+    force = true;
+    executable = true;
+    text = ''
+      #!/usr/bin/env bash
+      sudo systemctl poweroff
+    '';
+  };
+
+  home.file.".local/bin/universal-reboot" = {
+    enable = true;
+    force = true;
+    executable = true;
+    text = ''
+      #!/usr/bin/env bash
+      sudo reboot
+    '';
+  };
 }

hosts/takamaki/modules/openssh.nix

@@ -20,4 +20,11 @@
     };
     startWhenNeeded = true;
   };
+
+  networking.firewall.extraCommands = ''
+    iptables -D INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP
+    ${pkgs.ipset}/bin/ipset destroy geo-whitelist
+    ${pkgs.ipset}/bin/ipset restore -file /home/grey/nixos/assets/geo-whitelist.ipset
+    iptables -I INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP
+  '';
 }

hosts/takamaki/modules/sudo.nix

@@ -27,10 +27,18 @@
           command = "${pkgs.efibootmgr}/bin/efibootmgr";
           options = [ "NOPASSWD" ];
         }
+        {
+          command = "/run/current-system/sw/bin/efibootmgr";
+          options = [ "NOPASSWD" ];
+        }
         {
           command = "${pkgs.efibootmgr}/bin/efibootdump";
           options = [ "NOPASSWD" ];
         }
+        {
+          command = "${pkgs.efibootmgr}/sbin/efibootdump";
+          options = [ "NOPASSWD" ];
+        }
       ];
       users = [ "grey" ];
     }];