fix(security): tighten desktop remote access

modules/nixos/base/ssh.nix

@@ -11,7 +11,7 @@
       # in modules/nixos/desktop/ssh.nix (needed for GUI forwarding).
       X11Forwarding = lib.mkDefault false;
       # root user is used for remote deployment, so we need to allow it
-      PermitRootLogin = "prohibit-password";
+      PermitRootLogin = lib.mkDefault "prohibit-password";
       PasswordAuthentication = false; # disable password login
     };
     openFirewall = true;

modules/nixos/desktop/networking/remote-desktop.nix

@@ -1,7 +1,5 @@
 {
-  config,
   lib,
-  myvars,
   pkgs,
   ...
 }:
@@ -34,7 +32,7 @@
   services.sunshine = {
     enable = lib.mkDefault false; # default to false, for security reasons.
     autoStart = true;
-    capSysAdmin = true; # only needed for Wayland -- omit this when using with Xorg
+    capSysAdmin = false;
     openFirewall = true;
     settings = {
       # pc  - Only localhost may access the web ui
@@ -45,6 +43,4 @@
       wan_encryption_mode = 2;
     };
   };
-
-  users.users."${myvars.username}".extraGroups = lib.mkIf config.services.sunshine.enable [ "input" ];
 }

modules/nixos/desktop/ssh.nix

@@ -1,5 +1,8 @@
 {
   # Desktops keep X11 forwarding (current behavior, needed for GUI forwarding);
   # servers default to off (see modules/nixos/base/ssh.nix).
-  services.openssh.settings.X11Forwarding = true;
+  services.openssh.settings = {
+    PermitRootLogin = "no";
+    X11Forwarding = true;
+  };
 }

outputs/aarch64-linux/tests/security-ssh-x11/expected.nix

@@ -3,5 +3,12 @@
   outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
-  name: name == "ai-niri" || name == "shoukei-niri"
+  name:
+  let
+    isDesktop = name == "ai-niri" || name == "shoukei-niri";
+  in
+  {
+    X11Forwarding = isDesktop;
+    PermitRootLogin = if isDesktop then "no" else "prohibit-password";
+  }
 )

outputs/aarch64-linux/tests/security-ssh-x11/expr.nix

@@ -3,5 +3,11 @@
   outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
-  name: outputs.nixosConfigurations.${name}.config.services.openssh.settings.X11Forwarding
+  name:
+  let
+    settings = outputs.nixosConfigurations.${name}.config.services.openssh.settings;
+  in
+  {
+    inherit (settings) PermitRootLogin X11Forwarding;
+  }
 )

outputs/x86_64-linux/tests/idols-ai-gpu/expected.nix

@@ -2,7 +2,8 @@
   loadsVirtualDisplay = true;
   createsVirtualDisplay = true;
   niriUsesIntelRenderer = true;
-  sunshineUserHasInputAccess = true;
+  sunshineUserHasInputAccess = false;
+  sunshineHasSysAdmin = false;
   sunshineStartsAfterNiri = true;
   sunshineWaitsForNiriOutput = true;
 }

outputs/x86_64-linux/tests/idols-ai-gpu/expr.nix

@@ -12,6 +12,7 @@ in
   createsVirtualDisplay = lib.hasInfix "options vkms create_default_dev=1" cfg.boot.extraModprobeConfig;
   niriUsesIntelRenderer = lib.hasInfix "/dev/dri/by-path/pci-0000:00:02.0-render" niriHardware;
   sunshineUserHasInputAccess = builtins.elem "input" cfg.users.users.ryan.extraGroups;
+  sunshineHasSysAdmin = cfg.services.sunshine.capSysAdmin;
   sunshineStartsAfterNiri = builtins.elem "niri.service" cfg.systemd.user.services.sunshine.after;
   sunshineWaitsForNiriOutput = lib.hasInfix "niri msg outputs" cfg.systemd.user.services.sunshine.preStart;
 }

outputs/x86_64-linux/tests/security-ssh-x11/expected.nix

@@ -3,5 +3,12 @@
   outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
-  name: name == "ai-niri" || name == "shoukei-niri"
+  name:
+  let
+    isDesktop = name == "ai-niri" || name == "shoukei-niri";
+  in
+  {
+    X11Forwarding = isDesktop;
+    PermitRootLogin = if isDesktop then "no" else "prohibit-password";
+  }
 )

outputs/x86_64-linux/tests/security-ssh-x11/expr.nix

@@ -3,5 +3,11 @@
   outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
-  name: outputs.nixosConfigurations.${name}.config.services.openssh.settings.X11Forwarding
+  name:
+  let
+    settings = outputs.nixosConfigurations.${name}.config.services.openssh.settings;
+  in
+  {
+    inherit (settings) PermitRootLogin X11Forwarding;
+  }
 )