refactor: consolidate sshd enable + port 22 into modules/ssh.nix #51

New Issue

2026-06-29T13:02:54+01:00

lyrathorpe commented

2026-06-29 13:02:54 +01:00

Problem

services.openssh.enable = true; together with networking.firewall.allowedTCPPorts = [ 22 ]; is repeated in each sshd host:

hosts/T400/configuration.nix
hosts/MacPro31/configuration.nix
hosts/RPi5/configuration.nix

modules/ssh.nix (imported by all three) currently only carries the hardening settings, not the enable/port.

Impact

Drift risk: the listening service and its firewall port are declared per-host instead of once, so they can diverge.

Suggested fix

Move services.openssh.enable = true; and networking.firewall.allowedTCPPorts = [ 22 ]; into modules/ssh.nix, so importing the module both hardens and enables sshd. Drop the per-host duplicates.

## Problem `services.openssh.enable = true;` together with `networking.firewall.allowedTCPPorts = [ 22 ];` is repeated in each sshd host: - `hosts/T400/configuration.nix` - `hosts/MacPro31/configuration.nix` - `hosts/RPi5/configuration.nix` `modules/ssh.nix` (imported by all three) currently only carries the hardening settings, not the enable/port. ## Impact Drift risk: the listening service and its firewall port are declared per-host instead of once, so they can diverge. ## Suggested fix Move `services.openssh.enable = true;` and `networking.firewall.allowedTCPPorts = [ 22 ];` into `modules/ssh.nix`, so importing the module both hardens and enables sshd. Drop the per-host duplicates.

lyrathorpe referenced this issue from a commit

2026-06-29 13:29:38 +01:00

refactor(ssh): consolidate sshd enable and port 22 into modules/ssh.nix

lyrathorpe referenced this issue

2026-06-29 13:29:53 +01:00

chore: post-refactor cleanups (#50-#53) #54

lyrathorpe referenced this issue from a commit

2026-06-29 14:09:39 +01:00

chore: post-refactor cleanups (#50-#53) (#54)

Sign in to join this conversation.