hosts/MacPro31/configuration.nix

@@ -26,10 +26,8 @@
   # workstation.nix is the backstop).
   zramSwap.enable = true;
 
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
-  # workstation.nix with a default-deny policy).
+  # the firewall itself is enabled in workstation.nix with a default-deny policy.
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
   # enabled in workstation.nix.

hosts/RPi5/configuration.nix

@@ -25,15 +25,12 @@
   boot.loader.grub.enable = false;
   boot.loader.generic-extlinux-compatible.enable = true;
 
-  # Remote administration. Key-only policy and the authorized key come from
+  # Remote administration: the daemon, port 22 and key-only policy all come from
-  # ../../modules/ssh.nix; here we just enable the daemon and open the port.
+  # ../../modules/ssh.nix.
-  services.openssh.enable = true;
 
-  # Default-deny inbound. Open only SSH here; the Docker and nginx submodules
+  # Default-deny inbound; the Docker and nginx submodules open their own ports
-  # open their own ports (Docker via a source-restricted nftables rule, nginx
+  # (Docker via a source-restricted nftables rule, nginx via 80/443).
-  # via 80/443). List-valued, so these merge with the submodule definitions.
   networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # See `man configuration.nix` / the stateVersion docs before changing.
   system.stateVersion = "26.05";

hosts/T400/configuration.nix

@@ -21,10 +21,8 @@
   # Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
   zramSwap.enable = true;
 
-  # This host accepts SSH, so open 22 (the firewall itself is enabled in
+  # sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
-  # laptop.nix with a default-deny policy).
+  # the firewall itself is enabled in laptop.nix with a default-deny policy.
-  services.openssh.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 ];
 
   # Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
   # workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and

modules/ssh.nix

@@ -1,8 +1,11 @@
-# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
+# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
-# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
+# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
-# not here.
+# registry (modules/users.nix), not here.
 { ... }:
 {
+  services.openssh.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 ];
+
   services.openssh.settings = {
     PasswordAuthentication = false; # keys only
     KbdInteractiveAuthentication = false; # no keyboard-interactive fallback