From 1a8c52d5baf6b9245b5363f92db50f007bfb2cea Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Sun, 18 Aug 2024 01:43:08 -0600
Subject: sys/[lustrated]: implement FIDO2 auth over vsock

---
 sys/auth/openssh.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

(limited to 'sys')

diff --git a/sys/auth/openssh.nix b/sys/auth/openssh.nix
index c1c6c58..eaa28c2 100644
--- a/sys/auth/openssh.nix
+++ b/sys/auth/openssh.nix
@@ -68,6 +68,10 @@ in
         assertion = restrict != null -> (restrict.vsockCid != null -> config.services.openssh.startWhenNeeded);
         message = "SSH vsock restrict requires socket activation";
       }
+      {
+        assertion = restrict != null -> (restrict.vsockCid != null -> config.local.virt.enable);
+        message = "SSH vsock restrict requires nixvirt";
+      }
       {
         assertion = any (key: key) (attrValues cfg.hostKeys);
         message = "No OpenSSH host keys were enabled";
@@ -126,7 +130,10 @@ in
     };
 
     systemd.sockets = mkIf (restrict != null && restrict.vsockCid != null) {
-      sshd.socketConfig.ListenStream = mkForce [ "vsock:${toString restrict.vsockCid}:${toString port}" ];
+      sshd = {
+        after = [ "nixvirt.service" ];
+        socketConfig.ListenStream = mkForce [ "vsock:${toString restrict.vsockCid}:${toString port}" ];
+      };
     };
 
     users.users = {
-- 
cgit v1.2.3