security: disable SSH X11 forwarding on servers, keep on desktops

modules/nixos/base/ssh.nix

@@ -7,7 +7,9 @@
   services.openssh = {
     enable = true;
     settings = {
-      X11Forwarding = true;
+      # Secure by default: X11 forwarding off everywhere; desktops re-enable it
+      # in modules/nixos/desktop/ssh.nix (needed for GUI forwarding).
+      X11Forwarding = lib.mkDefault false;
       # root user is used for remote deployment, so we need to allow it
       PermitRootLogin = "prohibit-password";
       PasswordAuthentication = false; # disable password login

modules/nixos/desktop/ssh.nix

@@ -0,0 +1,5 @@
+{
+  # Desktops keep X11 forwarding (current behavior, needed for GUI forwarding);
+  # servers default to off (see modules/nixos/base/ssh.nix).
+  services.openssh.settings.X11Forwarding = true;
+}

outputs/aarch64-linux/tests/security-ssh-x11/expected.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: name == "ai-niri" || name == "shoukei-niri"
+)

outputs/aarch64-linux/tests/security-ssh-x11/expr.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: outputs.nixosConfigurations.${name}.config.services.openssh.settings.X11Forwarding
+)

outputs/x86_64-linux/tests/security-ssh-x11/expected.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: name == "ai-niri" || name == "shoukei-niri"
+)

outputs/x86_64-linux/tests/security-ssh-x11/expr.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: outputs.nixosConfigurations.${name}.config.services.openssh.settings.X11Forwarding
+)