ssh: require public key authentication

flake.lock

@@ -108,10 +108,10 @@
     },
     "secrets": {
       "locked": {
-        "lastModified": 1769514557,
+        "lastModified": 1770625307,
-        "narHash": "sha256-nJOWEsRw7C2hrrC9xf74oAq3dLJEXq71M2bbdO+DUpw=",
+        "narHash": "sha256-kg3cWWbUBD0wPXR51vxpsRk0rlR4++qjsKELH32M70E=",
         "ref": "refs/heads/main",
-        "rev": "6aa45be13cc08dc2518b6b749df5e81975ed6df4",
+        "rev": "b46d84d1cc5b9fa6d0ca334b9b37a30dabdefec2",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@git.colorsky.fun/Sky/secrets"

flake.nix

@@ -5,8 +5,6 @@
     napcat.url = "github:initialencounter/napcat.nix";
 
     secrets.url = "git+ssh://git@git.colorsky.fun/Sky/secrets?shallow=1";
-
-    # nix-minecraft.url = "github:Infinidoge/nix-minecraft";
   };
 
   outputs =

host/macmini.nix

@@ -1,5 +1,7 @@
 {
   pkgs,
+  secrets,
+  lib,
   ...
 }:
 
@@ -12,7 +14,6 @@
     ../modules/services/gitea.nix
     ../modules/services/napcat.nix
     ../modules/services/nignx.nix
-    # ../modules/services/mcserver.nix
 
     ../modules/system/boot.nix
     ../modules/system/networking.nix
@@ -27,6 +28,9 @@
   i18n.defaultLocale = "en_US.UTF-8";
 
   users.users.sky = {
+    openssh.authorizedKeys.keys = [
+      (lib.readFile secrets.files.keys.nixos-wsl-pub)
+    ];
     isNormalUser = true;
     extraGroups = [ "wheel" ];
     packages = with pkgs; [

modules/services/mcserver.nix

@@ -1,59 +0,0 @@
-{ inputs, pkgs, ... }:
-{
-  imports = [
-    inputs.nix-minecraft.nixosModules.minecraft-servers
-  ];
-  nixpkgs.overlays = [ inputs.nix-minecraft.overlay ];
-
-  services.minecraft-servers = {
-    enable = false;
-    eula = true;
-    openFirewall = true;
-
-    dataDir = "/var/lib/minecraft-server";
-
-    user = "minecraft-server";
-
-    group = "minecraft-server";
-
-    servers.fabric = {
-      enable = true;
-
-      autoStart = true;
-
-      package = pkgs.fabricServers.fabric-1_21_1.override {
-        loaderVersion = "0.16.10";
-      };
-
-      serverProperties = {
-        online-mode = false;
-      };
-
-      operators = {
-        TNPP5444 = "b7f0ad2e-98af-3882-9a72-9b3901c72fd5";
-      };
-
-      symlinks = {
-        mods = pkgs.linkFarmFromDrvs "mods" (
-          builtins.attrValues {
-            Fabric-API = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/9YVrKY0Z/fabric-api-0.115.0%2B1.21.1.jar";
-              sha512 = "e5f3c3431b96b281300dd118ee523379ff6a774c0e864eab8d159af32e5425c915f8664b1cd576f20275e8baf995e016c5971fea7478c8cb0433a83663f2aea8";
-            };
-            Backpacks = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/MGcd6kTf/versions/Ci0F49X1/1.2.1-backpacks_mod-1.21.2-1.21.3.jar";
-              sha512 = "6efcff5ded172d469ddf2bb16441b6c8de5337cc623b6cb579e975cf187af0b79291b91a37399a6e67da0758c0e0e2147281e7a19510f8f21fa6a9c14193a88b";
-            };
-          }
-        );
-      };
-    };
-  };
-
-  users.users.minecraft-server = {
-    isNormalUser = true;
-    home = "/var/lib/minecraft-server";
-    extraGroups = [ "minecraft-server" ];
-  };
-  users.groups.minecraft-server = { };
-}

modules/services/nignx.nix

@@ -5,6 +5,7 @@
     enable = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
+
     virtualHosts."git.colorsky.fun" = {
       forceSSL = true;
       useACMEHost = "colorsky.fun";
@@ -25,7 +26,30 @@
       '';
     };
 
-    virtualHosts."192.168.68.59" = { };
+    virtualHosts."ddns.colorsky.fun" = {
+      forceSSL = true;
+      useACMEHost = "colorsky.fun";
+
+      locations."/".proxyPass = "http://localhost:9876";
+
+      extraConfig = ''
+        listen [::]:8443 ssl;
+      '';
+    };
+
+    virtualHosts."bot.colorsky.fun" = {
+      forceSSL = true;
+      useACMEHost = "colorsky.fun";
+
+      locations."/" = {
+        proxyPass = "http://localhost:23231";
+        proxyWebsockets = true;
+      };
+      extraConfig = ''
+        listen [::]:8443 ssl;
+      '';
+    };
+
   };
 
   security.acme = {

modules/system/networking.nix

@@ -1,6 +1,10 @@
 { ... }:
 {
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    settings.KbdInteractiveAuthentication = false;
+  };
 
   networking = {
     hostName = "macmini";