From 38ccadbc876ab9ae4f27d3e84a31f57bee10af3b Mon Sep 17 00:00:00 2001
From: Akshay Nair <phenax5@gmail.com>
Date: Sun, 8 Jun 2025 21:05:21 +0530
Subject: Switch to ssh key

---
 build.sh                    | 9 ++++++---
 modules/network/default.nix | 4 +---
 modules/network/ssh.nix     | 9 ++++++---
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/build.sh b/build.sh
index 0d6376f..0d8d65b 100755
--- a/build.sh
+++ b/build.sh
@@ -4,14 +4,17 @@ set -euo pipefail
 SSH_TARGET="bacchus@192.168.0.117"
 
 config_sync() {
-  sshpass -p password rsync -r "$SSH_TARGET:~/nixos/flake.lock" .
-  sshpass -p password rsync -r . "$SSH_TARGET:~/nixos"
-  # sshpass -p password ssh "$SSH_TARGET" sh -c "nixos-rebuild build --flake 'path:/home/bacchus/nixos#bacchus'"
+  rsync -r "$SSH_TARGET:~/nixos/flake.lock" .
+  rsync -r . "$SSH_TARGET:~/nixos"
+  # ssh "$SSH_TARGET" sh -c "nixos-rebuild build --flake 'path:/home/bacchus/nixos#bacchus'"
 }
 
+run_ssh() { ssh "$SSH_TARGET" "$@"; }
+
 cmd="$1"; shift;
 case "$cmd" in
   sync) config_sync ;;
+  run) run_ssh "$@" ;;
   *) echo "foo" && exit 1 ;;
 esac
 
diff --git a/modules/network/default.nix b/modules/network/default.nix
index 444f53c..6a3ab69 100644
--- a/modules/network/default.nix
+++ b/modules/network/default.nix
@@ -7,9 +7,7 @@ in {
   networking = {
     hostName = "bacchus";
 
-    firewall = {
-      enable = true;
-    };
+    firewall.enable = true;
 
     networkmanager = {
       enable = true;
diff --git a/modules/network/ssh.nix b/modules/network/ssh.nix
index e4e5b2a..573bdf4 100644
--- a/modules/network/ssh.nix
+++ b/modules/network/ssh.nix
@@ -5,7 +5,10 @@ in {
   services.sshd.enable = true;
 
   # Auth
-  # TODO: dont allow via password
-  # openssh.authorizedKeys.keys = private.ssh.authorizedKeys;
-  services.openssh.settings.PermitRootLogin = "yes"; 
+  users.users.bacchus.openssh.authorizedKeys.keys = private.ssh.authorizedKeys;
+  services.openssh.settings = {
+    PermitRootLogin = "no";
+    PasswordAuthentication = false;
+    ChallengeResponseAuthentication = false;
+  };
 }
-- 
cgit v1.3.1