From 548806184d9f9ebeb8e4ee60722860e0085874d2 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Sat, 24 Jan 2026 18:26:42 -0600
Subject: more ssh config

---
 flake.nix                      |  1 +
 hosts/mercury/nixos.nix        |  5 +++++
 modules/services/nixos/ssh.nix | 14 +++++++++++++-
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index bffbcd5..14af52d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -80,6 +80,7 @@
     deploy.nodes."ganymede" = {
       hostname = "ganymede";
       sshUser = "root";
+      sshOpts = ["-o" "RequestTTY=force"];
 
       profiles.system = {
         user = "root";
diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix
index 935ecd4..6d269fe 100644
--- a/hosts/mercury/nixos.nix
+++ b/hosts/mercury/nixos.nix
@@ -39,6 +39,11 @@
       LocalForward 8010 127.0.0.1:8010
       DynamicForward 9090
 
+    Host ganymede-deploy
+      HostName 192.168.0.2
+      User root
+      IdentityFile /home/collin/.ssh/id_ed25519
+
     Host io
       Hostname 192.168.50.3
       User admin
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index ca8e618..76b0d87 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -8,6 +8,8 @@
   cfg = config.collinux.services.networking.sshd;
 in {
   config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [2222]; # only on local network
+
     services.openssh = {
       enable = true;
 
@@ -25,10 +27,14 @@ in {
           addr = cfg.bind_host;
           port = 22;
         }
+        {
+          addr = cfg.bind_host;
+          port = 2222;
+        }
       ];
 
       settings = {
-        PermitRootLogin = "prohibit-password"; # deploy-rs uses root account
+        PermitRootLogin = "no";
         PasswordAuthentication = false;
         PubkeyAuthentication = true;
         KbdInteractiveAuthentication = true; # for google authenticator totp codes
@@ -36,6 +42,12 @@ in {
       };
 
       knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts;
+
+      extraConfig = ''
+        Match LocalPort 2222
+          AuthenticationMethods publickey
+          PermitRootLogin prohibit-password
+      '';
     };
 
     security.pam.services = {
-- 
cgit v1.3.1