diff --git a/hosts/alo-cloud-1/default.nix b/hosts/alo-cloud-1/default.nix index 7742ea0..4afc9ba 100644 --- a/hosts/alo-cloud-1/default.nix +++ b/hosts/alo-cloud-1/default.nix @@ -25,7 +25,6 @@ internalInterfaces = [ "tailscale0" ]; }; - # Security hardening: Enable firewall (override global setting) networking.firewall = { enable = lib.mkForce true; allowedTCPPorts = [ 80 443 ]; # Public web traffic only @@ -33,11 +32,7 @@ trustedInterfaces = [ "tailscale0" ]; # Full access via VPN }; - # Security hardening: Restrict SSH to Tailscale only + key-based auth services.openssh = { - listenAddresses = [ - { addr = "100.75.147.49"; port = 22; } # Tailscale IP only - ]; settings.PasswordAuthentication = false; # Keys only }; }