programs.ssh.enable
Whether to enable SSH client configuration.
Type: boolean
Default:
false
Example:
true
Declared by:
programs.ssh.enableDefaultConfig
Whether to enable or not the old default config values. This option will become deprecated in the future. For an equivalent, copy and paste the following code snippet in your config:
programs.ssh.settings."*" = {
ForwardAgent = false;
AddKeysToAgent = "no";
Compression = false;
ServerAliveInterval = 0;
ServerAliveCountMax = 3;
HashKnownHosts = false;
UserKnownHostsFile = "~/.ssh/known_hosts";
ControlMaster = "no";
ControlPath = "~/.ssh/master-%r@%n:%p";
ControlPersist = "no";
};
Type: boolean
Default:
true
Example:
false
Declared by:
programs.ssh.package
The openssh package to use. By default, the client provided by your system is used.
Type: null or package
Default:
null
Declared by:
programs.ssh.extraConfig
Extra configuration.
Type: strings concatenated with ā\nā
Default:
""
Declared by:
programs.ssh.extraOptionOverrides
Extra SSH configuration options that take precedence over any host specific configuration.
Type: attribute set of anything
Default:
{ }
Declared by:
programs.ssh.includes
File globs of ssh config files that should be included via the
Include directive.
See
ssh_config(5)
for more information.
Type: list of string
Default:
[ ]
Declared by:
programs.ssh.settings
OpenSSH client configuration blocks written to
~/.ssh/config.
Attribute names are interpreted as Host patterns unless they
start with Host or Match , in which case they are written
literally as block headers. If the order of rules matter then
use the DAG functions to express the dependencies as shown in
the example. Use programs.ssh.settings.<name>.header
when the block should have a short stable name for DAG ordering,
and use lib.hm.dag.entriesBefore or
lib.hm.dag.entriesAfter to order generated groups of blocks.
See
ssh_config(5)
for more information.
Type: DAG of open submodule of attribute set of anything
Default:
{ }
Example:
# Tagged hosts must appear before Match blocks that select those tags.
lib.hm.dag.entriesBefore "corp-host" [ "corp-match" ] [
{
header = "Host build.corp";
HostName = "build.corp.example.org";
User = "builder";
Tag = "corp";
}
{
header = "Host git.corp";
HostName = "git.corp.example.org";
User = "git";
Tag = "corp";
}
]
// {
# Bare attribute names become Host patterns.
"*.internal.example.org" = {
User = "internal";
};
# Literal Host headers can use the full OpenSSH syntax.
"Host *.example.org" = lib.hm.dag.entryBefore [ "github.com" ] {
IdentityFile = "~/.ssh/example";
LocalForward = [
{
bind.port = 8080;
host.address = "10.0.0.13";
host.port = 80;
}
"9000 10.0.0.2:90"
];
DynamicForward = "127.0.0.1:1080";
};
# Literal Match headers can be ordered by their attribute name.
"Match host *.vpn.example.org" = lib.hm.dag.entryAfter [ "github.com" ] {
ProxyJump = "vpn";
};
"github.com" = {
HostName = "github.com";
User = "git";
IdentityFile = "~/.ssh/github";
};
# Keep long or dynamic SSH headers out of DAG references.
corp-match = lib.hm.dag.entryAfter [ "github.com" ] {
header = "Match tagged corp exec \"test -f ~/.corp\"";
ProxyJump = "bastion";
RemoteForward = {
bind.port = 8081;
host.address = "10.0.0.14";
host.port = 80;
};
};
}
# Generated groups can also be placed after named blocks.
// lib.hm.dag.entriesAfter "corp-fallback" [ "corp-match" ] [
{
header = "Host *.corp";
User = "corp";
}
]
Declared by:
programs.ssh.settings.<name>.header
The literal Host or Match line that opens this block.
By default this is derived from the attribute name: names
starting with Host or Match are used literally, and
all other names are prefixed with Host . This default is
suitable for most configurations.
Set this only when the header cannot be expressed as the
attribute name, e.g. when it carries Nix string context
(store paths), or when a stable attribute name is wanted
for lib.hm.dag ordering.
Type: string
Default:
The attribute name, prefixed with Host unless it already
starts with Host or Match .
Declared by: