Unverified Commit cf10d7ae authored by Matthieu Coudron's avatar Matthieu Coudron Committed by GitHub
Browse files

services.openssh: support freeform settings (#193757) 

* services.openssh: support freeform settings

Keep "extraConfig" but introduces "settings".

Also renames several options

(mkRenamedOptionModule [ "services" "openssh" "kbdInteractiveAuthentication" ] [  "services" "openssh" "settings" "KbdInteractiveAuthentication" ])
(mkRenamedOptionModule [ "services" "openssh" "passwordAuthentication" ] [  "services" "openssh" "settings" "PasswordAuthentication" ])
(mkRenamedOptionModule [ "services" "openssh" "useDns" ] [  "services" "openssh" "settings" "UseDns" ])
(mkRenamedOptionModule [ "services" "openssh" "permitRootLogin" ] [  "services" "openssh" "settings" "PermitRootLogin" ])

* updated doc
* regen doc
parent 6dccdc45

nixos/doc/manual/configuration/ssh.section.md

+1 −1
Original line number Diff line number Diff line
@@ -8,7 +8,7 @@ services.openssh.enable = true; 


By default, root logins using a password are disallowed. They can be

disabled entirely by setting

[](#opt-services.openssh.permitRootLogin) to `"no"`.

[](#opt-services.openssh.settings.PermitRootLogin) to `"no"`.



You can declaratively specify authorised RSA/DSA public keys for a user

as follows:

nixos/doc/manual/from_md/configuration/ssh.section.xml

+1 −1
Original line number Diff line number Diff line
@@ -9,7 +9,7 @@ services.openssh.enable = true; 
  <para>

    By default, root logins using a password are disallowed. They can be

    disabled entirely by setting

    <xref linkend="opt-services.openssh.permitRootLogin" /> to

    <xref linkend="opt-services.openssh.settings.PermitRootLogin" /> to

    <literal>&quot;no&quot;</literal>.

  </para>

  <para>

nixos/doc/manual/from_md/release-notes/rl-2305.section.xml

+18 −0
Original line number Diff line number Diff line
@@ -324,6 +324,24 @@ 
          <link linkend="opt-services.usbmuxd.package">services.usbmuxd.package</link>

        </para>

      </listitem>

      <listitem>

        <para>

          A few openssh options have been moved from extraConfig to the

          new freeform option <literal>settings</literal> and renamed as

          follow:

          <literal>services.openssh.kbdInteractiveAuthentication</literal>

          to

          <literal>services.openssh.settings.KbdInteractiveAuthentication</literal>,

          <literal>services.openssh.passwordAuthentication</literal> to

          <literal>services.openssh.settings.PasswordAuthentication</literal>,

          <literal>services.openssh.useDns</literal> to

          <literal>services.openssh.settings.UseDns</literal>,

          <literal>services.openssh.permitRootLogin</literal> to

          <literal>services.openssh.settings.PermitRootLogin</literal>,

          <literal>services.openssh.logLevel</literal> to

          <literal>services.openssh.settings.LogLevel</literal>.

        </para>

      </listitem>

      <listitem>

        <para>

          <literal>services.mastodon</literal> gained a tootctl wrapped

nixos/doc/manual/release-notes/rl-2305.section.md

+2 −0
Original line number Diff line number Diff line
@@ -85,6 +85,8 @@ In addition to numerous new and upgraded packages, this release has the followin 


- The module `usbmuxd` now has the ability to change the package used by the daemon. In case you're experiencing issues with `usbmuxd` you can try an alternative program like `usbmuxd2`. Available as [services.usbmuxd.package](#opt-services.usbmuxd.package)



- A few openssh options have been moved from extraConfig to the new freeform option `settings` and renamed as follow: `services.openssh.kbdInteractiveAuthentication` to `services.openssh.settings.KbdInteractiveAuthentication`, `services.openssh.passwordAuthentication` to `services.openssh.settings.PasswordAuthentication`, `services.openssh.useDns` to `services.openssh.settings.UseDns`, `services.openssh.permitRootLogin` to `services.openssh.settings.PermitRootLogin`, `services.openssh.logLevel` to `services.openssh.settings.LogLevel`.



- `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables.



- The `dnsmasq` service now takes configuration via the

nixos/modules/profiles/installation-device.nix

+1 −1
Original line number Diff line number Diff line
@@ -72,7 +72,7 @@ with lib; 
    # mounting the storage in a different system.

    services.openssh = {

      enable = true;

      permitRootLogin = "yes";

      settings.PermitRootLogin = "yes";

    };



    # Enable wpa_supplicant, but don't start it by default.