networking ssh

modules/nixos/services/service-ssh.ulu.nix

@@ -3,7 +3,19 @@
   flake.nixosModules.service-ssh =
     { ... }:
     {
-      services.openssh.enable = true;
       services.tailscale.enable = true;
+
+      services.openssh = {
+        enable = true;
+        openFirewall = false;
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+          PermitRootLogin = "no";
+        };
+      };
+
+      networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 22 ];
+      networking.firewall.trustedInterfaces = [ "tailscale0" ];
     };
 }