Changes for plato

lib/fudo/sites.nix

@@ -95,6 +95,12 @@ let
         description = "Location of Dropbear ECDSA key.";
         default = "/etc/dropbear/host_ecdsa_key";
       };
+
+      dropbear-deploy-port = mkOption {
+        type = port;
+        description = "Port to be used for the deploy SSH server.";
+        default = 2112;
+      };
     };
   };
 
@@ -107,16 +113,30 @@ in {
 
   config = mkIf (site-cfg.deploy-pubkey != null) {
     environment.etc."dropbear/authorized_keys" = {
-      text = "root@deploy ${site-cfg.deploy-pubkey}";
+      text = "${site-cfg.deploy-pubkey} root@deploy";
       mode = "0400";
     };
 
-    systemd.services = let dropbear-port = 2112;
-    in {
+    networking.firewall.allowedTCPPorts = [ site-cfg.dropbear-deploy-port ];
 
-      dropbear-init = {
-        wantedBy = [ "multi-user.target" ];
-        script = ''
+    systemd = {
+      sockets = {
+        dropbear-deploy = {
+          wantedBy = [ "sockets.target" ];
+          socketConfig = {
+            ListenStream = "0.0.0.0:${toString site-cfg.dropbear-deploy-port}";
+            Accept = true;
+          };
+          unitConfig = {
+            restartIfChanged = true;
+          };
+        };
+      };
+      
+      services = {
+        dropbear-deploy-init = {
+          wantedBy = [ "multi-user.target" ];
+          script = ''
           if [ ! -d /etc/dropbear ]; then
             mkdir /etc/dropbear
             chmod 700 /etc/dropbear
@@ -132,15 +152,18 @@ in {
             ${pkgs.coreutils}/bin/chmod 0400 ${site-cfg.dropbear-ecdsa-key-path}
           fi
         '';
-      };
+        };
 
-      dropbear = {
-        requires = [ "dropbear-init.service" ];
-        wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
-        serviceConfig = {
-          type = "simple";
-          ExecStart = "${pkgs.dropbear} -F -m -s -j -k -p ${dropbear-port}";
+        "dropbear-deploy@" = {
+          description = "Per-connection service for deployment, using dropbear.";
+          requires = [ "dropbear-deploy-init.service" ];
+          after = [ "network.target" ];
+          serviceConfig = {
+            Type = "simple";
+            ExecStart = "${pkgs.dropbear}/bin/dropbear -F -i -m -s -j -k -r ${site-cfg.dropbear-rsa-key-path} -r ${site-cfg.dropbear-ecdsa-key-path}";
+            ExecReload = "${pkgs.utillinux}/bin/kill -HUP $MAINPID";
+            StandardInput = "socket";
+          };
         };
       };
     };