From 57bf6c7c1cbd8c51f358d8837704e567a487d547 Mon Sep 17 00:00:00 2001
From: adikro <adikro@disroot.org>
Date: Fri, 26 Dec 2025 21:23:54 +0100
Subject: moved ssh key, improved firewall settings for tailscale

---
 os/core/ssh.nix   | 15 ++++++++-------
 os/core/users.nix |  3 ---
 2 files changed, 8 insertions(+), 10 deletions(-)

(limited to 'os')

diff --git a/os/core/ssh.nix b/os/core/ssh.nix
index 032bb44..b2cf411 100644
--- a/os/core/ssh.nix
+++ b/os/core/ssh.nix
@@ -1,11 +1,14 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, username, ... }:
 let
   cfg = config.os.core.ssh;
 in
 {
   options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup";
   config = lib.mkIf cfg.enable {
-    services.tailscale.enable = true;
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+    };
 
     services.openssh = {
       enable = true;
@@ -18,10 +21,8 @@ in
       enableSSHSupport = true;
       pinentryPackage = pkgs.pinentry-curses;
     };
-
-    networking.firewall = {
-      trustedInterfaces = [ "tailscale0" ];
-      allowedUDPPorts = [ 41641 ];
-    };
+    users.users.${username}.openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdQ7yU6kYnqM0zNQZC4M+lKLaNSmWHNvmxGy6mQ3wAXhgZbm1YzXF7/oirx1y8JQhukEkdF0ftSVw9DuZEoVwIOhGkJfFJwoWWdB8xZ215EZjqU3RczcMjI+SeyUMAzNdU84rF+lYF3NLHrdzLv98bq6S1W8a6w8+ofl7WZtDcdwOn5XMc9JV0YBuZj41mKgU7rzVOq61zRiCPsKhCIc/1MVPgHxVT4pN7j9eG0dgLKMluZY9BfnOf3SopcbfxFpPWVFNGN18RKQY7LbJ26FBRhGZQMwMYoHsN+cm0pY1Pw3uJ04volBtEk5Wj1czran1hobaKw9FL/N+g/VN7Ye5r20qyoKUmQZdl/b7E/xA6DpI5R1keW6t8uv/PK2BmjTY1E46tni6uwwywnikP05dsUghcVMWgd3bKQ+9zLyV0bIwlcmk+Ep9A6h0TIl5w/fsuUlHOGSWngeLN0CbRIcNmSOD1k8TpCJeCCVK39QSY+bu3Wite3ygH4jWTx4ofcZM/eoXUhg5fNymdtZYkurW8dps1JE6pj6ORgC0yY8QJCrMri3Ouzdwa/54zJwGQq+kV8EinEP+P5X8088bnS5SpShYKoWmQOAmtMSuIA8AWj6miIVVmZhz16FxnzbI+qOUMuhpdv6EDQtwfJLF+12ASinKMQvlOM3V9XwW13jBBnQ=="
+    ];
   };
 }
diff --git a/os/core/users.nix b/os/core/users.nix
index 7ef4f9a..9ce0e2d 100644
--- a/os/core/users.nix
+++ b/os/core/users.nix
@@ -9,9 +9,6 @@ in
     users.users.adam = {
       isNormalUser = true;
       shell = pkgs.fish;
-      openssh.authorizedKeys.keys = [
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdQ7yU6kYnqM0zNQZC4M+lKLaNSmWHNvmxGy6mQ3wAXhgZbm1YzXF7/oirx1y8JQhukEkdF0ftSVw9DuZEoVwIOhGkJfFJwoWWdB8xZ215EZjqU3RczcMjI+SeyUMAzNdU84rF+lYF3NLHrdzLv98bq6S1W8a6w8+ofl7WZtDcdwOn5XMc9JV0YBuZj41mKgU7rzVOq61zRiCPsKhCIc/1MVPgHxVT4pN7j9eG0dgLKMluZY9BfnOf3SopcbfxFpPWVFNGN18RKQY7LbJ26FBRhGZQMwMYoHsN+cm0pY1Pw3uJ04volBtEk5Wj1czran1hobaKw9FL/N+g/VN7Ye5r20qyoKUmQZdl/b7E/xA6DpI5R1keW6t8uv/PK2BmjTY1E46tni6uwwywnikP05dsUghcVMWgd3bKQ+9zLyV0bIwlcmk+Ep9A6h0TIl5w/fsuUlHOGSWngeLN0CbRIcNmSOD1k8TpCJeCCVK39QSY+bu3Wite3ygH4jWTx4ofcZM/eoXUhg5fNymdtZYkurW8dps1JE6pj6ORgC0yY8QJCrMri3Ouzdwa/54zJwGQq+kV8EinEP+P5X8088bnS5SpShYKoWmQOAmtMSuIA8AWj6miIVVmZhz16FxnzbI+qOUMuhpdv6EDQtwfJLF+12ASinKMQvlOM3V9XwW13jBBnQ=="
-      ];
       extraGroups = lib.mkMerge [
         [ "wheel" ]
 
-- 
cgit v1.3