diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index ab0edcebc67..d2565c10eef 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -323,6 +323,14 @@
services.tetrd.
+
+
+ uptermd, an
+ open-source solution for sharing terminal sessions instantly
+ over the public internet via secure tunnels. Available at
+ services.uptermd.
+
+
agate,
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index af65ae46131..c029dd76d23 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -99,6 +99,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable).
+- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable).
+
- [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](options.html#opt-services.agate.enable).
- [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](options.html#opt-services.archisteamfarm.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index b3efa5d5e6f..7b681ecffb2 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -936,6 +936,7 @@
./services/networking/unifi.nix
./services/video/unifi-video.nix
./services/video/rtsp-simple-server.nix
+ ./services/networking/uptermd.nix
./services/networking/v2ray.nix
./services/networking/vsftpd.nix
./services/networking/wasabibackend.nix
diff --git a/nixos/modules/services/networking/uptermd.nix b/nixos/modules/services/networking/uptermd.nix
new file mode 100644
index 00000000000..072f561f5c3
--- /dev/null
+++ b/nixos/modules/services/networking/uptermd.nix
@@ -0,0 +1,106 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.uptermd;
+in
+{
+ options = {
+ services.uptermd = {
+ enable = mkEnableOption "uptermd";
+
+ openFirewall = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to open the firewall for the port in .
+ '';
+ };
+
+ port = mkOption {
+ type = types.port;
+ default = 2222;
+ description = ''
+ Port the server will listen on.
+ '';
+ };
+
+ listenAddress = mkOption {
+ type = types.str;
+ default = "[::]";
+ example = "127.0.0.1";
+ description = ''
+ Address the server will listen on.
+ '';
+ };
+
+ hostKey = mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ example = "/run/keys/upterm_host_ed25519_key";
+ description = ''
+ Path to SSH host key. If not defined, an ed25519 keypair is generated automatically.
+ '';
+ };
+
+ extraFlags = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ example = [ "--debug" ];
+ description = ''
+ Extra flags passed to the uptermd command.
+ '';
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ networking.firewall = mkIf cfg.openFirewall {
+ allowedTCPPorts = [ cfg.port ];
+ };
+
+ systemd.services.uptermd = {
+ description = "Upterm Daemon";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+
+ path = [ pkgs.openssh ];
+
+ preStart = mkIf (cfg.hostKey == null) ''
+ if ! [ -f ssh_host_ed25519_key ]; then
+ ssh-keygen \
+ -t ed25519 \
+ -f ssh_host_ed25519_key \
+ -N ""
+ fi
+ '';
+
+ serviceConfig = {
+ StateDirectory = "uptermd";
+ WorkingDirectory = "/var/lib/uptermd";
+ ExecStart = "${pkgs.upterm}/bin/uptermd --ssh-addr ${cfg.listenAddress}:${toString cfg.port} --private-key ${if cfg.hostKey == null then "ssh_host_ed25519_key" else cfg.hostKey} ${concatStringsSep " " cfg.extraFlags}";
+
+ # Hardening
+ AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+ CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+ PrivateUsers = cfg.port >= 1024;
+ LockPersonality = true;
+ MemoryDenyWriteExecute = true;
+ PrivateDevices = true;
+ ProtectClock = true;
+ ProtectControlGroups = true;
+ ProtectHome = true;
+ ProtectHostname = true;
+ ProtectKernelLogs = true;
+ ProtectKernelModules = true;
+ ProtectKernelTunables = true;
+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+ RestrictNamespaces = true;
+ RestrictRealtime = true;
+ SystemCallArchitectures = "native";
+ SystemCallFilter = "@system-service";
+ };
+ };
+ };
+}