From b97209171ce216d3f31ed42856c5d5d95c808025 Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <j.stachurski@student.utwente.nl>
Date: Thu, 8 May 2025 23:29:41 +0200
Subject: openssh and firewall changes

---
 nixos/hosts/apocalypse/backup.nix   |  2 +-
 nixos/hosts/apocalypse/default.nix  | 14 ++++++++++++++
 nixos/hosts/apocalypse/firewall.nix | 31 +++++++++++++++++--------------
 3 files changed, 32 insertions(+), 15 deletions(-)

(limited to 'nixos/hosts/apocalypse')

diff --git a/nixos/hosts/apocalypse/backup.nix b/nixos/hosts/apocalypse/backup.nix
index 646ff6c..07386be 100644
--- a/nixos/hosts/apocalypse/backup.nix
+++ b/nixos/hosts/apocalypse/backup.nix
@@ -14,7 +14,7 @@
       ssh_user = "vaultmanager";
       stream_compress = "lz4";
       volume."/btrfs_root" = {
-        target = "ssh://10.100.0.1/vault/backups/apocalypse";
+        target = "ssh://10.127.9.1/vault/backups/apocalypse";
         subvolume = { 
           "@root" = { 
             snapshot_create = "always";
diff --git a/nixos/hosts/apocalypse/default.nix b/nixos/hosts/apocalypse/default.nix
index a84d07d..a6e6233 100644
--- a/nixos/hosts/apocalypse/default.nix
+++ b/nixos/hosts/apocalypse/default.nix
@@ -69,6 +69,20 @@
 
   # Firmware updates 
   services.fwupd.enable = true; 
+
+  services.openssh = {
+    enable = true; 
+    ports = [22]; 
+    openFirewall = false; 
+    allowSFTP = false; 
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = ["wilkuu"];
+      X11Forwarding = false; 
+      PermitRootLogin = "no";
+      PrintMotd = true;
+    }; 
+  };
 }
 
 
diff --git a/nixos/hosts/apocalypse/firewall.nix b/nixos/hosts/apocalypse/firewall.nix
index 2068d55..b2c17af 100644
--- a/nixos/hosts/apocalypse/firewall.nix
+++ b/nixos/hosts/apocalypse/firewall.nix
@@ -1,9 +1,11 @@
 {pkgs, config, ...}:
 let 
   baseTCP = [
-    
+    22000 # Syncthng
   ]; 
   baseUDP = [
+    22000 # Syncthing
+    22027 # Syncthing 
     16555 # Wireguard
   ]; 
   baseTCPRanges = [
@@ -14,34 +16,35 @@ let
   ];
 
   secureTCP = [
-    22 80 433 5900
-  ] ++ baseTCP;  
+    22 80 433 5900 # SSH HTTP VNC
+  ];  
   
   secureUDP = [
-    
-  ] ++ baseUDP;  
+    5900 
+  ];  
 
   secureTCPRanges = [
 
-  ] ++ baseTCPRanges ; 
+  ]; 
   secureUDPRanges = [
 
-  ] ++ baseUDPRanges; 
+  ]; 
 in 
 {
-    networking.firewall {
+    networking.firewall = {
         enable = true; 
         allowedTCPPorts = baseTCP; 
         allowedUDPPorts = baseUDP; 
           allowedUDPPortRanges = baseUDPRanges;
           allowedTCPPortRanges = baseTCPRanges;
         interfaces = {
-        "wg0" = {
-          allowedTCPPorts = secureTCP; 
-          allowedUDPorts = secureUDP; 
-          allowedUDPPortRanges = secureUDPRanges;
-          allowedTCPPortRanges = secureTCPRanges;
-        };
+          "nix-laptop" = {
+            allowedTCPPorts = secureTCP; 
+            allowedUDPPorts = secureUDP; 
+            allowedUDPPortRanges = secureUDPRanges;
+            allowedTCPPortRanges = secureTCPRanges;
+          };
+       };
     };
 }
 
-- 
cgit v1.3.1