From 548806184d9f9ebeb8e4ee60722860e0085874d2 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Sat, 24 Jan 2026 18:26:42 -0600
Subject: more ssh config

---
 modules/services/nixos/ssh.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

(limited to 'modules')

diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index ca8e618..76b0d87 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -8,6 +8,8 @@
   cfg = config.collinux.services.networking.sshd;
 in {
   config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [2222]; # only on local network
+
     services.openssh = {
       enable = true;
 
@@ -25,10 +27,14 @@ in {
           addr = cfg.bind_host;
           port = 22;
         }
+        {
+          addr = cfg.bind_host;
+          port = 2222;
+        }
       ];
 
       settings = {
-        PermitRootLogin = "prohibit-password"; # deploy-rs uses root account
+        PermitRootLogin = "no";
         PasswordAuthentication = false;
         PubkeyAuthentication = true;
         KbdInteractiveAuthentication = true; # for google authenticator totp codes
@@ -36,6 +42,12 @@ in {
       };
 
       knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts;
+
+      extraConfig = ''
+        Match LocalPort 2222
+          AuthenticationMethods publickey
+          PermitRootLogin prohibit-password
+      '';
     };
 
     security.pam.services = {
-- 
cgit v1.3.1