rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Eee: permanent reverse tunnel to server

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-09-29 08:04:47 +01:00
parent dd5a80594e
commit c4804e2efe
1 changed files with 34 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

38
hosts/FredOS-Eee.nix
View file

@ -7,6 +7,9 @@
# Build on the server, never on the Eee — evaluating this flake alone would
# eat its 1GB.
{ config, lib, pkgs, ... }:
let
serverKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMbIdOSPjnJYQ7z7n0mHKo8T8PnAkCyIBCmT4KpsHyy/ fred@FredOS-Mediaserver";
in
{
imports = [
../settings/locale.nix
@ -52,10 +55,37 @@
};
services.openssh.enable = true;
# The server's key, so it can push closures and poke at the box.
users.users.fred.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMbIdOSPjnJYQ7z7n0mHKo8T8PnAkCyIBCmT4KpsHyy/ fred@FredOS-Mediaserver"
];
# The server's key, so it can push closures and poke at the box. Root too:
# `eee-update` copies unsigned closures, which only a trusted user may do.
users.users.fred.openssh.authorizedKeys.keys = [ serverKey ];
users.users.root.openssh.authorizedKeys.keys = [ serverKey ];
# The Eee lives on other people's networks, so the server can't reach it.
# Instead it holds a reverse tunnel open: server's localhost:2222 -> Eee:22
# (`ssh eee` there). The key is made here on first start and only allowed
# to open that one forward (hosts/FredOS-Mediaserver.nix). Plain ssh +
# Restart=always covers reconnects; ExitOnForwardFailure retries while the
# server still holds a dead session's port.
systemd.services.server-tunnel = {
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
serviceConfig = {
StateDirectory = "server-tunnel";
Restart = "always";
RestartSec = 30;
};
preStart = ''
[ -f $STATE_DIRECTORY/id_ed25519 ] || \
${pkgs.openssh}/bin/ssh-keygen -q -t ed25519 -N "" -C "eee-tunnel" -f $STATE_DIRECTORY/id_ed25519
'';
script = ''
exec ${pkgs.openssh}/bin/ssh -N -i $STATE_DIRECTORY/id_ed25519 \
-o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes \
-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$STATE_DIRECTORY/known_hosts \
-R 2222:localhost:22 fred@nordhammer.it
'';
};
# Firefox is marked unsupported on i686 (Mozilla dropped 32-bit Linux), so
# WebKit is the only engine left that handles the modern web.