From e42f368d724072a7bd6e7a9decf49b3df6fea978 Mon Sep 17 00:00:00 2001
From: Emma Thorpe <emma.thorpe@citrix.com>
Date: Mon, 29 Jun 2026 13:29:24 +0100
Subject: [PATCH] refactor(ssh): consolidate sshd enable and port 22 into
 modules/ssh.nix

The daemon enable and the firewall port were duplicated in each sshd host
(T400, Mac Pro, RPi5). Move both into modules/ssh.nix so importing it both
hardens and enables sshd; drop the per-host copies. No build change: the
three hosts evaluate to identical derivations.

Closes #51
---
 hosts/MacPro31/configuration.nix |  6 ++----
 hosts/RPi5/configuration.nix     | 11 ++++-------
 hosts/T400/configuration.nix     |  6 ++----
 modules/ssh.nix                  |  9 ++++++---
 4 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/hosts/MacPro31/configuration.nix b/hosts/MacPro31/configuration.nix
index 77b1a16..6faae6d 100644
--- a/hosts/MacPro31/configuration.nix
+++ b/hosts/MacPro31/configuration.nix
@@ -26,10 +26,8 @@
   # workstation.nix is the backstop).
   zramSwap.enable = true;
 
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # workstation.nix with a default-deny policy).
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # the firewall itself is enabled in workstation.nix with a default-deny policy.
 
   # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
   # enabled in workstation.nix.
diff --git a/hosts/RPi5/configuration.nix b/hosts/RPi5/configuration.nix
index 632c6da..4e3630d 100644
--- a/hosts/RPi5/configuration.nix
+++ b/hosts/RPi5/configuration.nix
@@ -25,15 +25,12 @@
   boot.loader.grub.enable = false;
   boot.loader.generic-extlinux-compatible.enable = true;
 
-  # Remote administration. Key-only policy and the authorized key come from
-  # ../../modules/ssh.nix; here we just enable the daemon and open the port.
-  services.openssh.enable = true;
+  # Remote administration: the daemon, port 22 and key-only policy all come from
+  # ../../modules/ssh.nix.
 
-  # Default-deny inbound. Open only SSH here; the Docker and nginx submodules
-  # open their own ports (Docker via a source-restricted nftables rule, nginx
-  # via 80/443). List-valued, so these merge with the submodule definitions.
+  # Default-deny inbound; the Docker and nginx submodules open their own ports
+  # (Docker via a source-restricted nftables rule, nginx via 80/443).
   networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # See `man configuration.nix` / the stateVersion docs before changing.
   system.stateVersion = "26.05";
diff --git a/hosts/T400/configuration.nix b/hosts/T400/configuration.nix
index 52c8931..96c05d1 100644
--- a/hosts/T400/configuration.nix
+++ b/hosts/T400/configuration.nix
@@ -21,10 +21,8 @@
   # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
   zramSwap.enable = true;
 
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
-  # laptop.nix with a default-deny policy).
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
+  # the firewall itself is enabled in laptop.nix with a default-deny policy.
 
   # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
   # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and
diff --git a/modules/ssh.nix b/modules/ssh.nix
index f56ec95..f486656 100644
--- a/modules/ssh.nix
+++ b/modules/ssh.nix
@@ -1,8 +1,11 @@
-# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
-# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
-# not here.
+# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
+# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
+# registry (modules/users.nix), not here.
 { ... }:
 {
+  services.openssh.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
+
   services.openssh.settings = {
     PasswordAuthentication = false; # keys only
     KbdInteractiveAuthentication = false; # no keyboard-interactive fallback