Spring Cleaning

- create new module, `system`, that consumes the `boot` module and takes
in the more system-interested services from the `services` module
- touch up left over services (which are more self-hosting interested)
- touch up yo and yoshi configs

22 files changed, 252 insertions, 530 deletions

diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/adguard.nix
index 69fb8a4..f59934e 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/adguard.nix
@@ -3,9 +3,13 @@
   lib,
   ...
 }: let
-  cfg = config.collinux.services.selfhost.adguard;
-in
-  lib.mkIf cfg.enable {
+  cfg = config.collinux.services.adguard;
+in {
+  imports = [
+    (import ./mkCaddyCfg.nix cfg)
+  ];
+
+  config = lib.mkIf cfg.enable {
     services.adguardhome = {
       enable = true;
       port = cfg.port;
@@ -31,17 +35,6 @@ in
       DNS=127.0.0.1
       DNSStubListener=no
     '';
-
     services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
-
-    services.caddy = lib.mkIf cfg.caddy.enable {
-      virtualHosts.${cfg.root_url}.extraConfig = ''
-        ${
-          if cfg.caddy.bind_tailscale
-          then "bind tailscale/${cfg.service_name}"
-          else ""
-        }
-        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
-      '';
-    };
-  }
+  };
+}
diff --git a/modules/services/nixos/audio.nix b/modules/services/nixos/audio.nix
deleted file mode 100644
index 9de6787..0000000
--- a/modules/services/nixos/audio.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.audio;
-in
-  lib.mkIf cfg.enable {
-    security.rtkit.enable = true;
-    services.pipewire = {
-      enable = true;
-      wireplumber.enable = true;
-      alsa.enable = true;
-      pulse.enable = false;
-    };
-
-    boot.blacklistedKernelModules = ["snd_seq_dummy"]; # remove extraneous alsa midi devices
-
-    environment.systemPackages = with pkgs; [pwvucontrol qpwgraph];
-  }
diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix
deleted file mode 100644
index acf628c..0000000
--- a/modules/services/nixos/bluetooth.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.bluetooth;
-in
-  lib.mkIf cfg.enable {
-    hardware.bluetooth = {
-      enable = true;
-      powerOnBoot = true;
-
-      settings.General = {
-        FastConnectable = true;
-        ControllerMode = "bredr";
-        JustWorksRepairing = "always";
-      };
-    };
-
-    systemd.user.services."mpris-proxy" = {
-      unitConfig = {
-        BindsTo = ["bluetooth.target"];
-        After = ["bluetooth.target"];
-      };
-
-      wantedBy = ["bluetooth.target"];
-
-      # serviceConfig already exists (?)
-    };
-
-    # hardening (down to 2.1 OK)
-    systemd.services."bluetooth".serviceConfig = {
-      IPAddressDeny = "any";
-      ProtectKernelLogs = true;
-      ProtectKernelModules = lib.mkForce true;
-      RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
-      ProtectClock = true;
-      ProcSubset = "pid";
-    };
-  }
diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix
new file mode 100644
index 0000000..06f040c
--- /dev/null
+++ b/modules/services/nixos/caddy.nix
@@ -0,0 +1,23 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.services.caddy;
+in
+  lib.mkIf cfg.enable {
+    services.caddy = {
+      # just always install this. No harm in installing an extra plugin
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61"
+        ];
+        hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
+      };
+      enable = true;
+      environmentFile = cfg.envFile;
+    };
+    networking.firewall.allowedTCPPorts = [80 443];
+    environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff
+  }
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index 9c95180..234a712 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -1,10 +1,11 @@
 {
   imports = [
-    ./networking
-    ./audio.nix
-    ./bluetooth.nix
-    ./tailscale.nix
-    ./selfhost
-    ./ssh.nix
+    # ./navidrome.nix
+    ./headscale.nix
+    ./forgejo.nix
+    ./openssh.nix
+    # ./jellyfin.nix
+    ./caddy.nix
+    ./adguard.nix
   ];
 }
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/forgejo.nix
index 1b02628..5c98633 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/forgejo.nix
@@ -3,9 +3,13 @@
   config,
   ...
 }: let
-  cfg = config.collinux.services.selfhost.forgejo;
-in
-  lib.mkIf cfg.enable {
+  cfg = config.collinux.services.forgejo;
+in {
+  imports = [
+    (import ./mkCaddyCfg.nix cfg)
+  ];
+
+  config = lib.mkIf cfg.enable {
     services.forgejo = {
       enable = true;
       database.type = "sqlite3";
@@ -18,10 +22,10 @@ in
           # ssh
           START_SSH_SERVER = true; # use builtin ssh server
           BUILTIN_SSH_SERVER_USER = "git";
-          SSH_DOMAIN = "ganymede";
-          SSH_PORT = 2225; # don't conflict with system ssh
+          SSH_DOMAIN = cfg.root_url or "ganymede";
+          SSH_PORT = cfg.git_ssh_port; # don't conflict with system ssh
           SSH_LISTEN_HOST = cfg.bind_host;
-          SSH_LISTEN_PORT = 2225;
+          SSH_LISTEN_PORT = cfg.git_ssh_port;
         };
         service = {
           DISABLE_REGISTRATION = false;
@@ -40,15 +44,5 @@ in
       after = lib.mkAfter ["network-online.target"];
       wants = lib.mkAfter ["network-online.target"];
     };
-
-    services.caddy = lib.mkIf cfg.caddy.enable {
-      virtualHosts.${cfg.root_url}.extraConfig = ''
-        ${
-          if cfg.caddy.bind_tailscale
-          then "bind tailscale/${cfg.service_name}"
-          else ""
-        }
-        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
-      '';
-    };
-  }
+  };
+}
diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/headscale.nix
index 2bdcca1..51d3da5 100644
--- a/modules/services/nixos/selfhost/headscale.nix
+++ b/modules/services/nixos/headscale.nix
@@ -4,7 +4,7 @@
   lib,
   ...
 }: let
-  cfg = config.collinux.services.selfhost.headscale;
+  cfg = config.collinux.services.headscale;
 
   acl_file = (pkgs.formats.json {}).generate "acl.json" {
     ssh = [
@@ -16,8 +16,12 @@
       }
     ];
   };
-in
-  lib.mkIf cfg.enable {
+in {
+  imports = [
+    (import ./mkCaddyCfg.nix cfg)
+  ];
+
+  config = lib.mkIf cfg.enable {
     services.headscale = {
       enable = true;
       address = cfg.bind_host;
@@ -34,7 +38,7 @@ in
           nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"];
         };
 
-        policy.path = "${acl_file}";
+        policy.path = acl_file;
 
         prefixes = {
           "v4" = "100.100.0.0/16";
@@ -50,7 +54,7 @@ in
     };
 
     # make sure headscale can start before tailscale
-    systemd.services."headscale" = lib.mkIf config.collinux.services.networking.tailscale.enable {
+    systemd.services."headscale" = lib.mkIf config.collinux.system.networking.tailscale.enable {
       after = lib.mkForce ["network.target"];
       before = lib.mkForce ["headscale.target"];
       wants = lib.mkForce ["network.target" "headscale.target"];
@@ -61,15 +65,5 @@ in
     };
 
     environment.systemPackages = [pkgs.headscale];
-
-    services.caddy = lib.mkIf cfg.caddy.enable {
-      virtualHosts.${cfg.root_url}.extraConfig = ''
-        ${
-          if cfg.caddy.bind_tailscale
-          then "bind tailscale/${cfg.service_name}"
-          else ""
-        }
-        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
-      '';
-    };
-  }
+  };
+}
diff --git a/modules/services/nixos/jellyfin.nix b/modules/services/nixos/jellyfin.nix
new file mode 100644
index 0000000..65193f2
--- /dev/null
+++ b/modules/services/nixos/jellyfin.nix
@@ -0,0 +1,10 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.jellyfin;
+in
+  lib.mkIf cfg.enable {
+    services.jellyfin.enable = true;
+  }
diff --git a/modules/services/nixos/mkCaddyCfg.nix b/modules/services/nixos/mkCaddyCfg.nix
new file mode 100644
index 0000000..bb2e06d
--- /dev/null
+++ b/modules/services/nixos/mkCaddyCfg.nix
@@ -0,0 +1,15 @@
+cfg: {
+  services.caddy =
+    if cfg.caddy.enable
+    then {
+      virtualHosts.${cfg.root_url}.extraConfig = ''
+        ${
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
+          else ""
+        }
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+      '';
+    }
+    else {};
+}
diff --git a/modules/services/nixos/selfhost/navidrome.nix b/modules/services/nixos/navidrome.nix
index 5250b85..5250b85 100644
--- a/modules/services/nixos/selfhost/navidrome.nix
+++ b/modules/services/nixos/navidrome.nix
diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
deleted file mode 100644
index a042411..0000000
--- a/modules/services/nixos/networking/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  imports = [
-    ./iwd.nix
-    ./networkmanager.nix
-    ./networkd.nix
-    ./resolved.nix
-  ];
-
-  networking.firewall = {
-    enable = true;
-    checkReversePath = "loose";
-  };
-}
diff --git a/modules/services/nixos/networking/iwd.nix b/modules/services/nixos/networking/iwd.nix
deleted file mode 100644
index db5cc2e..0000000
--- a/modules/services/nixos/networking/iwd.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.networking.iwd;
-in
-  lib.mkIf cfg.enable {
-    networking = {
-      wireless.iwd = {
-        enable = true;
-        settings = {
-          General = {
-            EnableNetworkConfiguration = !config.collinux.services.networking.networkd.enable;
-            AddressRandomization = "once";
-            AddressRandomizationRange = "full";
-          };
-          Network.NameResolvingService = "systemd"; # either systemd or resolvconf
-        };
-      };
-
-      # Disable default networking stuff
-      dhcpcd.enable = false;
-      useDHCP = false;
-      networkmanager.enable = false;
-    };
-  }
diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix
deleted file mode 100644
index e84fd2f..0000000
--- a/modules/services/nixos/networking/networkd.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.networking.networkd;
-
-  dhcp_enabled = cfg.static == null;
-in
-  lib.mkIf cfg.enable {
-    networking = {
-      wireless =
-        if !config.collinux.services.networking.iwd.enable
-        then {
-          enable = true;
-          networks.${cfg.ssid}.pskRaw = "ext:psk";
-          secretsFile = cfg.pskFile;
-        }
-        else {};
-
-      useNetworkd = true;
-
-      # Disable default networking stuff
-      dhcpcd.enable = false;
-      useDHCP = false;
-      networkmanager.enable = false;
-    };
-
-    systemd.network = {
-      enable = true;
-
-      wait-online = {
-        enable = true;
-        ignoredInterfaces = ["docker0"];
-        anyInterface = true;
-      };
-
-      networks."11-lan" = {
-        name = "wl*";
-
-        networkConfig =
-          (
-            if dhcp_enabled
-            then {DHCP = "yes";}
-            else {
-              Address = cfg.static.ip;
-              Gateway = cfg.static.gateway;
-              DHCP = "no";
-              # DNS is managed by systemd-resolved (not specified here)
-            }
-          )
-          // {
-            LinkLocalAddressing = "no";
-          };
-
-        dhcpV4Config.UseDNS = "no";
-        dhcpV6Config.UseDNS = "no";
-      };
-    };
-  }
diff --git a/modules/services/nixos/networking/networkmanager.nix b/modules/services/nixos/networking/networkmanager.nix
deleted file mode 100644
index e032bd0..0000000
--- a/modules/services/nixos/networking/networkmanager.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.networking.networkmanager;
-in
-  lib.mkIf cfg.enable {
-    networking = {
-      networkmanager = {
-        enable = true;
-        dns = "systemd-resolved";
-        dhcp = "internal";
-      };
-
-      dhcpcd.enable = false;
-    };
-
-    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=true";
-  }
diff --git a/modules/services/nixos/networking/resolved.nix b/modules/services/nixos/networking/resolved.nix
deleted file mode 100644
index 03333b1..0000000
--- a/modules/services/nixos/networking/resolved.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  networking.resolvconf.enable = false;
-
-  networking.nameservers = [
-    "9.9.9.9#dns.quad9.net"
-    "149.112.112.112#dns.quad9.net"
-  ];
-
-  services.resolved = {
-    enable = true;
-    dnsovertls = "opportunistic";
-    dnssec = "allow-downgrade";
-
-    # disable extra stuff
-    llmnr = "false";
-    extraConfig = "MulticastDNS=no";
-  };
-}
diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix
new file mode 100644
index 0000000..c0c8c30
--- /dev/null
+++ b/modules/services/nixos/openssh.nix
@@ -0,0 +1,96 @@
+{
+  config,
+  lib,
+  pkgs,
+  hosts,
+  ...
+}: let
+  cfg = config.collinux.services.sshd;
+
+  anyAttr = attr: cfg.portConfig |> builtins.map (x: x.${attr} != null) |> builtins.any (x: x);
+  anyOTP = cfg.portConfig |> builtins.map (x: x.otp == true) |> builtins.any (x: x);
+
+  authorizedKeys =
+    hosts
+    |> builtins.mapAttrs (_: data: data.user_pubkey or null)
+    |> builtins.attrValues
+    |> builtins.filter (x: x != null);
+in {
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = cfg.portConfig |> builtins.map (x: x.port);
+
+    services.openssh = {
+      enable = true;
+      allowSFTP = false;
+
+      hostKeys = [
+        {
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          type = "ed25519";
+        }
+      ];
+
+      listenAddresses =
+        cfg.portConfig
+        |> builtins.map (x: {
+          addr = "0.0.0.0";
+          port = x.port;
+        });
+
+      # Lock down everything by default
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+        PubkeyAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        AllowAgentForwarding = false;
+      };
+
+      extraConfig =
+        cfg.portConfig
+        |> builtins.map (x:
+          lib.concatStringsSep "\n" [
+            "Match LocalPort ${toString x.port}"
+            (
+              if x.otp
+              then ''
+                ChallengeResponseAuthentication yes
+                PubkeyAuthentication yes
+                KbdInteractiveAuthentication yes
+                AuthenticationMethods publickey,keyboard-interactive:pam
+              ''
+              else ''
+                PubkeyAuthentication yes
+                AuthenticationMethods publickey
+              ''
+            )
+            (lib.optionalString x.rootLogin "PermitRootLogin yes")
+          ])
+        |> lib.concatStringsSep "\n\n";
+    };
+
+    security.pam.services = lib.optionalAttrs anyOTP {
+      login.googleAuthenticator.enable = true;
+
+      sshd.text = ''
+        account required pam_unix.so
+
+        auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so nullok no_increment_hotp
+        auth sufficient pam_permit.so
+
+        session required pam_env.so conffile=/etc/pam/environment readenv=0
+        session required pam_unix.so
+        session required pam_loginuid.so
+        session optional ${pkgs.systemd}/lib/security/pam_systemd.so
+      '';
+    };
+
+    users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys;
+    users.users."root".openssh.authorizedKeys.keys = lib.mkIf (anyAttr "rootLogin") authorizedKeys;
+
+    systemd.services."openssh" = {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+  };
+}
diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix
deleted file mode 100644
index f625f62..0000000
--- a/modules/services/nixos/selfhost/caddy.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.selfhost.caddy;
-in
-  lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      services.caddy = {
-        enable = true;
-        environmentFile = cfg.envFile;
-      };
-      networking.firewall.allowedTCPPorts = [80 443];
-      environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff
-    }
-    (lib.mkIf config.collinux.services.networking.tailscale.enable {
-      services.caddy = {
-        package = pkgs.caddy.withPlugins {
-          plugins = [
-            "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61"
-          ];
-          hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
-        };
-      };
-    })
-  ])
diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix
deleted file mode 100644
index de1078b..0000000
--- a/modules/services/nixos/selfhost/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  imports = [
-    ./adguard.nix
-    ./forgejo.nix
-    ./headscale.nix
-    ./caddy.nix
-  ];
-}
diff --git a/modules/services/nixos/selfhost/jellyfin.nix b/modules/services/nixos/selfhost/jellyfin.nix
deleted file mode 100644
index 59ea473..0000000
--- a/modules/services/nixos/selfhost/jellyfin.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.selfhost.jellyfin;
-in
-  lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      services.jellyfin = {
-        enable = true;
-      };
-    }
-    # (lib.mkIf (with config.collinux.services; networking.tailscale.enable && selfhost.caddy.enable) {
-    #   services.caddy.virtualHosts."https://jellyfin.tail7cca06.ts.net".extraConfig = ''
-    #     bind tailscale/jellyfin
-    #     reverse_proxy localhost:${config.services.jellyfin.port}
-    #   '';
-    # })
-  ])
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
deleted file mode 100644
index fa8b2ef..0000000
--- a/modules/services/nixos/ssh.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  hosts,
-  ...
-}: let
-  cfg = config.collinux.services.networking.sshd;
-in {
-  config = lib.mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [2222]; # only on local network
-
-    services.openssh = {
-      enable = true;
-
-      allowSFTP = false;
-
-      hostKeys = [
-        {
-          path = "/etc/ssh/ssh_host_ed25519_key";
-          type = "ed25519";
-        }
-      ];
-
-      listenAddresses = [
-        {
-          addr = cfg.bind_host;
-          port = 22;
-        }
-        {
-          addr = cfg.bind_host;
-          port = 2222;
-        }
-      ];
-
-      settings = {
-        PermitRootLogin = "no";
-        PasswordAuthentication = false;
-        PubkeyAuthentication = true;
-        KbdInteractiveAuthentication = true; # for google authenticator totp codes
-        AuthenticationMethods = "publickey,keyboard-interactive:pam";
-      };
-
-      extraConfig = ''
-        Match LocalPort 2222
-          AuthenticationMethods publickey
-          PermitRootLogin prohibit-password
-      '';
-    };
-
-    security.pam.services = {
-      login.googleAuthenticator.enable = true;
-
-      sshd.text = ''
-        account required pam_unix.so # unix (order 10900)
-
-        auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so nullok no_increment_hotp # google_authenticator (order 12500)
-        auth sufficient pam_permit.so
-
-        session required pam_env.so conffile=/etc/pam/environment readenv=0 # env (order 10100)
-        session required pam_unix.so # unix (order 10200)
-        session required pam_loginuid.so # loginuid (order 10300)
-        session optional ${pkgs.systemd}/lib/security/pam_systemd.so # systemd (order 12000)
-      '';
-    };
-
-    users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys =
-      hosts
-      |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
-      |> builtins.attrValues
-      |> (builtins.filter (x: x != null));
-
-    users.users."root".openssh.authorizedKeys.keys =
-      hosts
-      |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
-      |> builtins.attrValues
-      |> (builtins.filter (x: x != null)); # only possible over home network (:2222)
-
-    systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
-      after = lib.mkAfter ["network-online.target"];
-      wants = lib.mkAfter ["network-online.target"];
-    };
-
-    services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true";
-  };
-}
diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix
deleted file mode 100644
index 50e35d3..0000000
--- a/modules/services/nixos/tailscale.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.networking.tailscale;
-in
-  lib.mkIf cfg.enable {
-    services.tailscale = {
-      enable = true;
-      useRoutingFeatures = "both";
-    };
-
-    networking.firewall = {
-      checkReversePath = "loose";
-      trustedInterfaces = ["tailscale0"];
-      allowedUDPPorts = [config.services.tailscale.port];
-    };
-
-    # don't start tailscale until after headscale starts
-    systemd.services."tailscaled" =
-      if config.collinux.services.selfhost.headscale.enable
-      then {
-        wants = lib.mkForce ["network.target" "headscale.target"];
-        after = lib.mkForce ["network.target" "headscale.target"];
-      }
-      else {
-        wants = lib.mkForce ["network.target"];
-        after = lib.mkForce ["network.target"];
-      };
-
-    environment.systemPackages = [pkgs.tailscale];
-  }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 9a1f662..880206f 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -1,122 +1,93 @@
 {
   lib,
-  config,
+  my-lib,
   ...
 }: let
   inherit (lib) mkOption mkEnableOption;
+  inherit ((my-lib {inherit lib;}).netTypes) ipAddr;
 
-  ip_addr = lib.types.strMatching "^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$";
-  ip_addr_cidr = lib.types.strMatching "^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])/(3[0-2]|[12]?[0-9])$";
+  selfhostOptions = {
+    service_name,
+    default_port ? null,
+  }: {
+    enable = mkEnableOption "${service_name} selfhosted service";
+
+    service_name = mkOption {
+      type = lib.types.str;
+      internal = true;
+    };
+
+    bind_host = mkOption {
+      description = "The IP address on which ${service_name} will listen for incoming connections. The default, `0.0.0.0`, means 'all interfaces'";
+      type = ipAddr;
+      default = "0.0.0.0";
+    };
+    port = mkOption {
+      description = "The port on which ${service_name} will listen for incomming connections";
+      type = lib.types.port;
+      default = default_port;
+    };
+
+    root_url = mkOption {
+      description = "The final url that this service will be hosted on. Required for caddy, otherwise optional";
+      type = lib.types.nullOr lib.types.str;
+    };
+
+    caddy = {
+      enable = mkEnableOption "Automatically create caddy configurations for this service";
+      bind_tailscale = mkEnableOption "Bind the service to ${service_name}.{tailnet}";
+    };
+  };
 in {
   options = {
     collinux.services = {
-      networking = {
-        enable = mkEnableOption "wifi";
+      sshd = {
+        enable = mkEnableOption "OpenSSH server";
 
-        iwd.enable = mkEnableOption "lightweight wifi daemon";
-        networkmanager.enable = mkEnableOption "heavier wifi daemon";
-
-        networkd = {
-          enable = mkEnableOption "use systemd-networkd";
-          ssid = mkOption {
-            description = "SSID for this network";
-            type = lib.types.str;
-          };
-          pskFile = mkOption {
-            description = "Absolute path to a file containing the pre-shared key for this network";
-            type = lib.types.str;
-            example = "/run/secrets.d/wifi-psk";
-          };
-
-          static = lib.mkOption {
-            description = "Set a static IP address for this device on this network. Set to null to use DHCP";
-            type = lib.types.nullOr (lib.types.submodule {
-              options = {
-                ip = mkOption {
-                  description = "IP address";
-                  type = ip_addr_cidr;
-                };
-                gateway = mkOption {
-                  description = "default gateway";
-                  type = ip_addr;
-                };
+        portConfig = mkOption {
+          description = "List of ssh bind hosts. see submodule options for details";
+          type = lib.types.listOf (lib.types.submodule {
+            options = {
+              port = mkOption {
+                description = "Port to run on";
+                type = lib.types.port;
               };
-            });
-            default = null;
-          };
-        };
 
-        tailscale.enable = mkEnableOption "tailscale";
-        sshd = {
-          enable = mkEnableOption "OpenSSH server";
-          bind_host = mkOption {
-            description = "The IP address on which OpenSSH will listen for incomming connections. The default, `0.0.0.0`, means 'all interfaces'";
-            type = ip_addr;
-            default = "0.0.0.0";
-          };
+              otp = mkEnableOption "Whether to require TOTP (Google Authenticator) 2fa codes for this port";
+              rootLogin = mkEnableOption "Whether to allow root login for this port";
+            };
+          });
         };
       };
 
-      audio.enable = mkEnableOption "pipewire and wireplumber";
-
-      bluetooth.enable = mkEnableOption "bluetooth";
-
-      selfhost = let
-        selfhostOptions = {
-          service_name,
-          default_port ? null,
-        }: {
-          enable = mkEnableOption "${service_name} selfhosted service";
-
-          service_name = mkOption {
-            type = lib.types.str;
-            internal = true;
-          };
-
-          bind_host = mkOption {
-            description = "The IP address on which ${service_name} will listen for incoming connections. The default, `0.0.0.0`, means 'all interfaces'";
-            type = ip_addr;
-            default = "0.0.0.0";
-          };
-          port = mkOption {
-            description = "The port on which ${service_name} will listen for incomming connections";
-            type = lib.types.port;
-            default = default_port;
-          };
-
-          root_url = mkOption {
-            description = "The final url that this service will be hosted on. Required for caddy, otherwise optional";
-            type = lib.types.nullOr lib.types.str;
-          };
-
-          caddy = {
-            enable = mkEnableOption "Automatically create caddy configurations for this service";
-            bind_tailscale = mkEnableOption "Bind the service to ${service_name}.{tailnet}";
-          };
-        };
-      in {
-        adguard = selfhostOptions {
-          service_name = "adguard";
-          default_port = 8001;
-        };
+      adguard = selfhostOptions {
+        service_name = "adguard";
+        default_port = 8001;
+      };
 
-        forgejo = selfhostOptions {
+      forgejo =
+        (selfhostOptions {
           service_name = "forgejo";
           default_port = 8010;
+        })
+        // {
+          git_ssh_port = mkOption {
+            type = lib.types.port;
+            default = 2225;
+          };
         };
 
-        headscale = selfhostOptions {
-          service_name = "headscale";
-          default_port = 8080;
-        };
+      headscale = selfhostOptions {
+        service_name = "headscale";
+        default_port = 8080;
+      };
 
-        caddy = {
-          enable = mkEnableOption "caddy https server";
-          envFile = mkOption {
-            description = "Absolute path to file that contains environment variables for caddy operations";
-            type = lib.types.str;
-            example = "/run/secrets.d/caddy-env";
-          };
+      caddy = {
+        enable = mkEnableOption "caddy https server";
+        envFile = mkOption {
+          description = "Absolute path to file that contains environment variables for caddy operations";
+          type = lib.types.str;
+          example = "/run/secrets.d/caddy-env";
         };
       };
     };