From 8d29f82f74491c0e929d7518747d91651fc6e821 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sun, 1 Dec 2024 21:23:06 +0100
Subject: [PATCH] nixos/programs/ssh: support connection to a AF_VSOCK/AF_UNIX
 upon demand

Since systemd 256, it's possible to connect to VMs and containers
without using any classical IP networking.

Rather, we can leverage modern AF_VSOCK (for virtual machine
communications) or classical AF_UNIX (for containers).

See
https://www.freedesktop.org/software/systemd/man/256/systemd-ssh-proxy.html
for more documentation.

Change-Id: I2e06a6ebb6d0f34c9cfd69d6dc2aef983b47ed6f
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/programs/ssh.nix | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix
index f2ef248d7866..55c2f4d248a0 100644
--- a/nixos/modules/programs/ssh.nix
+++ b/nixos/modules/programs/ssh.nix
@@ -26,6 +26,22 @@ let
   knownHostsFiles = [ "/etc/ssh/ssh_known_hosts" ]
     ++ builtins.map pkgs.copyPathToStore cfg.knownHostsFiles;
 
+  # Taken from https://www.freedesktop.org/software/systemd/man/256/systemd-ssh-proxy.html
+  sshSystemdProxyConfig = ''
+    # AF_VSOCK / AF_UNIX support for SSH
+    # Built for VMs / containers access without going via the classical networking stack.
+    Host unix/* vsock/*
+      ProxyCommand ${config.systemd.package}/lib/systemd/systemd-ssh-proxy %h %p
+      ProxyUseFdpass yes
+      CheckHostIP no
+
+    # Local host SSH without classical networking
+    Host .host
+      ProxyCommand ${config.systemd.package}/lib/systemd/systemd-ssh-proxy unix/run/ssh-unix-local/socket %p
+      ProxyUseFdpass yes
+      CheckHostIP no
+  '';
+
 in
 {
   ###### interface
@@ -33,6 +49,18 @@ in
   options = {
 
     programs.ssh = {
+      enableSystemdSshProxySupport = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to configure `ssh` so that it's possible to perform:
+          - `ssh vsock/<cid>`
+          - `ssh unix/a/path/to/some/container/unix/socket`
+          - `ssh some_name.host` to connect to the local host without involving networking
+
+          See https://www.freedesktop.org/software/systemd/man/256/systemd-ssh-proxy.html for details.
+        '';
+      };
 
       enableAskPassword = lib.mkOption {
         type = lib.types.bool;
@@ -295,6 +323,7 @@ in
         Host *
         GlobalKnownHostsFile ${builtins.concatStringsSep " " knownHostsFiles}
 
+        ${lib.optionalString (cfg.enableSystemdSshProxySupport) sshSystemdProxyConfig}
         ${lib.optionalString (!config.networking.enableIPv6) "AddressFamily inet"}
         ${lib.optionalString cfg.setXAuthLocation "XAuthLocation ${pkgs.xorg.xauth}/bin/xauth"}
         ${lib.optionalString (cfg.forwardX11 != null) "ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}"}
-- 
2.47.0

this is almost all what you need IIRC