From fe280d8fa2c614c98d235034344ecc05a76f476b Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Mon, 2 Nov 2026 01:02:37 +0800
Subject: [PATCH] refactor(ssh): drop no-op openFirewall

It is already the sshd module default, and the shared firewall forces
allowedTCPPorts to [ ] anyway; toplevel drvPaths are unchanged.

Assisted-by: Claude Code (claude-opus-5-5)
---
 modules/nixos/base/ssh.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/nixos/base/ssh.nix b/modules/nixos/base/ssh.nix
index 656d5e37..afb2526b 100644
--- a/modules/nixos/base/ssh.nix
+++ b/modules/nixos/base/ssh.nix
@@ -17,7 +17,6 @@
       # nixpkgs defaults it to true, and PAM then still accepts the Unix password
       KbdInteractiveAuthentication = false;
     };
-    openFirewall = true;
     # Only keys declared in Nix log in; a hand- or intruder-added key is ignored
     authorizedKeysInHomedir = false;
   };