initial commit

fleet.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  pkgs,
+  ...
+}: let
+  create_users = host: {
+    users.users."${host.username}" = {
+      createHome = false;
+      home = "/home/chroot/" + host.username;
+      isNormalUser = false;
+      isSystemUser = true;
+      group = "sftp_users";
+      openssh.authorizedKeys.keys = [host.key];
+      shell = null;
+    };
+  };
+
+  users = [
+    {
+      username = "router";
+      key = "ssh-ed25519 AAAAC3NzaC2aZGI1OTE5AAAAOIOZKLFCZLM67viQXHYRjraE6WLfvETMkjjgSz0mxMzS root@router";
+    }
+  ];
+in {
+  imports = builtins.map create_users users;
+
+  users.groups = {sftp_users = {};};
+
+  services.openssh.extraConfig = ''
+    Match Group sftp_users
+      X11Forwarding no
+      AllowTcpForwarding no
+      ChrootDirectory %h
+      ForceCommand internal-sftp
+  '';
+}