SSH between my machines and ZeroVRAM's port, home network only; host names nexo-pc / nexo-laptop

- modules/remote.nix: OpenSSH with keys only (no passwords, no root), ports 22 and
  8080 (zvm_node) opened for 192.168.1.0/24 only; /etc/hosts names for both machines
  (DNS goes over TLS, so the router's *.lan names don't resolve)
- the laptop accepts the PC's key; the PC's list is ready for the laptop's
- hostName: nixos -> nexo-laptop

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -28,6 +28,7 @@ only the hardware differs.
 | `modules/locale.nix` | Timezone, locale, console keymap |
 | `modules/nix-settings.nix` | Nix features, GC, unfree |
 | `modules/security.nix` | sysctl hardening, sudo, firejail, GnuPG, polkit |
+| `modules/remote.nix` | SSH between my machines (keys only) and ZeroVRAM's port 8080, both for the home network only; fixed host names `nexo-pc` / `nexo-laptop` |
 | `modules/hardware.nix` | Hybrid graphics (PRIME offload), ASUS daemons, tablet, Bluetooth, I2C, RTL-SDR, printing |
 | `modules/audio.nix` | PipeWire |
 | `modules/desktop.nix` | Plasma, SDDM, fonts, theming |

configuration.nix

@@ -10,6 +10,7 @@
     ./modules/locale.nix
     ./modules/nix-settings.nix
     ./modules/security.nix
+    ./modules/remote.nix
 
     # Hardware
     ./modules/hardware.nix

modules/networking.nix

@@ -1,7 +1,7 @@
 { config, pkgs, ... }:
 
 {
-  networking.hostName = "nixos";
+  networking.hostName = "nexo-laptop";
   networking.networkmanager.enable = true;
 
   networking.firewall = {

modules/remote.nix

@@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+
+# My machines working together at home: SSH (keys only) and ZeroVRAM's zvm_node (port 8080),
+# both reachable from the home network only — not from other networks the laptop joins.
+let
+  homeLan = "192.168.1.0/24";
+  homePorts = [ 22 8080 ];  # SSH, zvm_node
+  rule = op: port: "iptables ${op} nixos-fw -p tcp -s ${homeLan} --dport ${toString port} -j nixos-fw-accept";
+in
+{
+  # Fixed names for the machines (their addresses are reserved in the router). The router's own
+  # *.lan names don't resolve here: DNS goes over TLS to public resolvers (networking.nix).
+  networking.hosts = {
+    "192.168.1.225" = [ "nexo-pc" ];
+    "192.168.1.197" = [ "nexo-laptop" ];
+  };
+
+  services.openssh = {
+    enable = true;
+    openFirewall = false;  # opened below for the home network only
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      AllowUsers = [ "nexoniarz" ];
+    };
+  };
+
+  # Keys allowed to log in here: the PC
+  users.users."nexoniarz".openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAPXDmX7gYH0A2zez4f1F63kjAI8t7iyte+gXmyI4wtz nexoniarz@nexo-pc"
+  ];
+
+  # Inserted at the top of the firewall chain (rules appended at the end would come after its
+  # final reject); removed again when the firewall stops or reloads.
+  networking.firewall.extraCommands = lib.concatMapStringsSep "\n" (rule "-I") homePorts;
+  networking.firewall.extraStopCommands = lib.concatMapStringsSep "\n" (p: "${rule "-D" p} || true") homePorts;
+}