From adfbf841b0095496e7dc836f58139cf3a0997857 Mon Sep 17 00:00:00 2001
From: Timo Wilken
Date: Tue, 21 Nov 2023 22:55:31 +0100
Subject: Allow SSH access to end-user machines

This is useful for communicating between the two laptops.
---
 tw/system/lap.scm | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'tw/system/lap.scm')

diff --git a/tw/system/lap.scm b/tw/system/lap.scm
index f6e56116..e3037d61 100644
--- a/tw/system/lap.scm
+++ b/tw/system/lap.scm
@@ -29,7 +29,8 @@
                      kerberos linux mtools pulseaudio search shells tls wm xorg)
 
 (use-service-modules admin authentication avahi base cups dbus desktop docker
-                     kerberos linux mcron networking pm shepherd syncthing vpn xorg)
+                     kerberos linux mcron networking pm shepherd ssh syncthing
+                     vpn xorg)
 
 (define efi-system-partition          ; /dev/nvme0n1p1
   (uuid "E04A-DF05" 'fat))
@@ -452,6 +453,14 @@ EndSection
         (secrets-configuration
          (host-key "/etc/secrets.key")))  ; we have no SSH host keys, so use a custom key
 
+      (service openssh-service-type
+        (openssh-configuration
+         (x11-forwarding? #t)
+         (permit-root-login #f)
+         (password-authentication? #f)
+         (authorized-keys
+          `(("timo" ,(local-file "files/timo.pub"))))))
+
       (modify-services (append %system-channel-services %desktop-services)
         ;; Let sane find the airscan backend. ipp-usb needs to be running separately.
         (sane-service-type _ => sane-backends/airscan)
-- 
cgit v1.2.3