diff --git a/README.md b/README.md
index 41ab843..def1453 100644
--- a/README.md
+++ b/README.md
@@ -22,6 +22,7 @@ My personal NixOS system configuration.
 | `modules/locale.nix` | Timezone, locale, console keymap |
 | `modules/nix-settings.nix` | Nix features, GC, unfree |
 | `modules/security.nix` | sysctl hardening, sudo, firejail, GnuPG, polkit |
+| `modules/remote.nix` | SSH between my machines (keys only) and ZeroVRAM's port 8080, both for the home network only; fixed host names `nexo-pc` / `nexo-laptop` |
 | `modules/hardware.nix` | GPU, tablet, Bluetooth, I2C, RTL-SDR, OpenRGB, printing |
 | `modules/audio.nix` | PipeWire |
 | `modules/desktop.nix` | Plasma, SDDM, fonts, theming |
diff --git a/configuration.nix b/configuration.nix
index 56ab189..44ab54e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -10,6 +10,7 @@
     ./modules/locale.nix
     ./modules/nix-settings.nix
     ./modules/security.nix
+    ./modules/remote.nix
 
     # Hardware
     ./modules/hardware.nix
diff --git a/modules/networking.nix b/modules/networking.nix
index 69dcd7e..7cd7bbc 100644
--- a/modules/networking.nix
+++ b/modules/networking.nix
@@ -1,7 +1,7 @@
 { config, pkgs, ... }:
 
 {
-  networking.hostName = "nixos";
+  networking.hostName = "nexo-pc";
   networking.networkmanager.enable = true;
 
   networking.firewall = {
diff --git a/modules/remote.nix b/modules/remote.nix
new file mode 100644
index 0000000..a1663e0
--- /dev/null
+++ b/modules/remote.nix
@@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+
+# My machines working together at home: SSH (keys only) and ZeroVRAM's zvm_node (port 8080),
+# both reachable from the home network only — not from other networks the laptop joins.
+let
+  homeLan = "192.168.1.0/24";
+  homePorts = [ 22 8080 ];  # SSH, zvm_node
+  rule = op: port: "iptables ${op} nixos-fw -p tcp -s ${homeLan} --dport ${toString port} -j nixos-fw-accept";
+in
+{
+  # Fixed names for the machines (their addresses are reserved in the router). The router's own
+  # *.lan names don't resolve here: DNS goes over TLS to public resolvers (networking.nix).
+  networking.hosts = {
+    "192.168.1.225" = [ "nexo-pc" ];
+    "192.168.1.197" = [ "nexo-laptop" ];
+  };
+
+  services.openssh = {
+    enable = true;
+    openFirewall = false;  # opened below for the home network only
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      AllowUsers = [ "nexoniarz" ];
+    };
+  };
+
+  # Keys allowed to log in here. The laptop's key goes in this list once it has one
+  # (ssh-keygen -t ed25519 on the laptop, then the line from ~/.ssh/id_ed25519.pub).
+  users.users."nexoniarz".openssh.authorizedKeys.keys = [
+  ];
+
+  # Inserted at the top of the firewall chain (rules appended at the end would come after its
+  # final reject); removed again when the firewall stops or reloads.
+  networking.firewall.extraCommands = lib.concatMapStringsSep "\n" (rule "-I") homePorts;
+  networking.firewall.extraStopCommands = lib.concatMapStringsSep "\n" (p: "${rule "-D" p} || true") homePorts;
+}