networking ssh

modules/nixos/net/net-network-manager.ulu.nix

@@ -6,8 +6,6 @@
       inherit (lib.modules) mkDefault mkForce;
     in
     {
-      networking.hostName = "copland";
-
       networking.networkmanager = {
         enable = true;
         dns = mkForce "none";

modules/nixos/services/service-ssh.ulu.nix

@@ -3,7 +3,19 @@
   flake.nixosModules.service-ssh =
     { ... }:
     {
-      services.openssh.enable = true;
       services.tailscale.enable = true;
+
+      services.openssh = {
+        enable = true;
+        openFirewall = false;
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+          PermitRootLogin = "no";
+        };
+      };
+
+      networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 22 ];
+      networking.firewall.trustedInterfaces = [ "tailscale0" ];
     };
 }