From 4541b9d7ca8c430bbd363bd6076ad4c467fb53df Mon Sep 17 00:00:00 2001
From: elwrcl <elwerici@proton.me>
Date: Fri, 4 Sep 2026 00:38:34 +0300
Subject: [PATCH] networking ssh

---
 modules/nixos/net/net-network-manager.ulu.nix |  2 --
 modules/nixos/services/service-ssh.ulu.nix    | 14 +++++++++++++-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/modules/nixos/net/net-network-manager.ulu.nix b/modules/nixos/net/net-network-manager.ulu.nix
index 88ec867..1f61393 100644
--- a/modules/nixos/net/net-network-manager.ulu.nix
+++ b/modules/nixos/net/net-network-manager.ulu.nix
@@ -6,8 +6,6 @@
       inherit (lib.modules) mkDefault mkForce;
     in
     {
-      networking.hostName = "copland";
-
       networking.networkmanager = {
         enable = true;
         dns = mkForce "none";
diff --git a/modules/nixos/services/service-ssh.ulu.nix b/modules/nixos/services/service-ssh.ulu.nix
index a0a7308..c748b27 100644
--- a/modules/nixos/services/service-ssh.ulu.nix
+++ b/modules/nixos/services/service-ssh.ulu.nix
@@ -3,7 +3,19 @@
   flake.nixosModules.service-ssh =
     { ... }:
     {
-      services.openssh.enable = true;
       services.tailscale.enable = true;
+
+      services.openssh = {
+        enable = true;
+        openFirewall = false;
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+          PermitRootLogin = "no";
+        };
+      };
+
+      networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 22 ];
+      networking.firewall.trustedInterfaces = [ "tailscale0" ];
     };
 }