1 files changed, 33 insertions, 17 deletions

diff --git a/modules/by-name/ss/ssh/module.nix b/modules/by-name/ss/ssh/module.nix
index f7218e36..39c203fd 100644
--- a/modules/by-name/ss/ssh/module.nix
+++ b/modules/by-name/ss/ssh/module.nix
@@ -15,16 +15,16 @@
 }: let
   cfg = config.soispha.programs.ssh;
 
-  mkDefaultMatchBlock = userKnownHostsFile: {
-    addKeysToAgent = "no";
-    compression = true;
-    controlMaster = "no";
-    controlPersist = "no";
-    forwardAgent = false;
-    hashKnownHosts = false;
-    serverAliveCountMax = 3;
-    serverAliveInterval = 240;
-    inherit userKnownHostsFile;
+  mkDefaultMatchBlock = UserKnownHostsFile: {
+    AddKeysToAgent = "no";
+    Compression = true;
+    ControlMaster = "no";
+    ControlPersist = "no";
+    ForwardAgent = false;
+    HashKnownHosts = false;
+    ServerAliveCountMax = 3;
+    ServerAliveInterval = 240;
+    inherit UserKnownHostsFile;
   };
 in {
   options.soispha.programs.ssh = {
@@ -48,19 +48,35 @@ in {
         enable = true;
         enableDefaultConfig = false;
 
-        matchBlocks."*" = mkDefaultMatchBlock (
-          builtins.toString (pkgs.writeTextFile {
-            name = "root-known-hosts";
-            text = cfg.rootKnownHosts;
-          })
-        );
+        settings = {
+          "Host *" = mkDefaultMatchBlock (
+            builtins.toString (pkgs.writeTextFile {
+              name = "root-known-hosts";
+              text = cfg.rootKnownHosts;
+            })
+          );
+          "Host *.your-storagebox.de" = {
+            # Don't try to authenticate via password for these, because we need to use the
+            # forced commands, and they are only provided via the ssh key login.
+            # So password login is a footgun (it is, however, valid to use it for non-root
+            # use-cases)
+            PasswordAuthentication = false;
+          };
+        };
       };
 
       soispha.programs.ssh = {
         enable = true;
         enableDefaultConfig = false;
 
-        matchBlocks."*" = mkDefaultMatchBlock "${config.home-manager.users.soispha.xdg.dataHome}/ssh/known_hosts";
+        settings = {
+          "Host *" = mkDefaultMatchBlock "${config.home-manager.users.soispha.xdg.dataHome}/ssh/known_hosts";
+          "Host *.your-storagebox.de" = {
+            # Port 22 is for sftp, and when we connect as user, we probably want an
+            # interactive shell.
+            Port = 23;
+          };
+        };
       };
     };
   };