mirror of
https://github.com/Nexoniarz/nexoniarz-config-nixos-laptop.git
synced 2026-11-03 04:24:27 +00:00
f1f5f71245
- modules/remote.nix: OpenSSH with keys only (no passwords, no root), ports 22 and 8080 (zvm_node) opened for 192.168.1.0/24 only; /etc/hosts names for both machines (DNS goes over TLS, so the router's *.lan names don't resolve) - the laptop accepts the PC's key; the PC's list is ready for the laptop's - hostName: nixos -> nexo-laptop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
1.5 KiB
Nix
38 lines
1.5 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
# My machines working together at home: SSH (keys only) and ZeroVRAM's zvm_node (port 8080),
|
|
# both reachable from the home network only — not from other networks the laptop joins.
|
|
let
|
|
homeLan = "192.168.1.0/24";
|
|
homePorts = [ 22 8080 ]; # SSH, zvm_node
|
|
rule = op: port: "iptables ${op} nixos-fw -p tcp -s ${homeLan} --dport ${toString port} -j nixos-fw-accept";
|
|
in
|
|
{
|
|
# Fixed names for the machines (their addresses are reserved in the router). The router's own
|
|
# *.lan names don't resolve here: DNS goes over TLS to public resolvers (networking.nix).
|
|
networking.hosts = {
|
|
"192.168.1.225" = [ "nexo-pc" ];
|
|
"192.168.1.197" = [ "nexo-laptop" ];
|
|
};
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
openFirewall = false; # opened below for the home network only
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
KbdInteractiveAuthentication = false;
|
|
PermitRootLogin = "no";
|
|
AllowUsers = [ "nexoniarz" ];
|
|
};
|
|
};
|
|
|
|
# Keys allowed to log in here: the PC
|
|
users.users."nexoniarz".openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAPXDmX7gYH0A2zez4f1F63kjAI8t7iyte+gXmyI4wtz nexoniarz@nexo-pc"
|
|
];
|
|
|
|
# Inserted at the top of the firewall chain (rules appended at the end would come after its
|
|
# final reject); removed again when the firewall stops or reloads.
|
|
networking.firewall.extraCommands = lib.concatMapStringsSep "\n" (rule "-I") homePorts;
|
|
networking.firewall.extraStopCommands = lib.concatMapStringsSep "\n" (p: "${rule "-D" p} || true") homePorts;
|
|
}
|