mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-08-27 13:54:03 +02:00
Ryan Yin
72a6e95cab
Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
22 lines
766 B
Nix
22 lines
766 B
Nix
{ lib, ... }:
|
|
{
|
|
# Secure by default: firewall ON everywhere unless a host explicitly disables it
|
|
# (servers disable it in modules/nixos/server/{server,server-aarch64}.nix).
|
|
networking.firewall.enable = lib.mkDefault true;
|
|
# Enable the OpenSSH daemon.
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
X11Forwarding = true;
|
|
# root user is used for remote deployment, so we need to allow it
|
|
PermitRootLogin = "prohibit-password";
|
|
PasswordAuthentication = false; # disable password login
|
|
};
|
|
openFirewall = true;
|
|
};
|
|
|
|
# Add terminfo database of all known terminals to the system profile.
|
|
# https://github.com/NixOS/nixpkgs/blob/nixos-26.05/nixos/modules/config/terminfo.nix
|
|
environment.enableAllTerminfo = true;
|
|
}
|