fra1-b: block global sshd

hosts/fra1-b/configuration.nix

@@ -70,7 +70,6 @@ in
 
     services = {
       node_exporter.enable = true;
-      sshguard.enable = true;
       tailscale.enable = true;
 
       ssh8022.server = {
@@ -127,10 +126,7 @@ in
     useDHCP = true;
     firewall = {
       allowedUDPPorts = [ 53 ];
-      allowedTCPPorts = [
+      allowedTCPPorts = [ 53 ];
-        22
-        53
-      ];
     };
   };
 

modules/services/ssh8022/default.nix

@@ -34,14 +34,26 @@
         cfg = config.mj.services.ssh8022.server;
       in
       lib.mkIf cfg.enable {
-        services.spiped = {
+
-          enable = true;
+        mj.services.friendlyport.ports = [
-          config = {
+          {
-            ssh8022 = {
+            subnets = [ myData.subnets.tailscale.cidr ];
-              inherit (cfg) keyfile;
+            tcp = [ 22 ];
-              decrypt = true;
+          }
-              source = "[0.0.0.0]:8022";
+        ];
-              target = "127.0.0.1:22";
+
+        services = {
+          openssh.openFirewall = false;
+
+          spiped = {
+            enable = true;
+            config = {
+              ssh8022 = {
+                inherit (cfg) keyfile;
+                decrypt = true;
+                source = "[0.0.0.0]:8022";
+                target = "127.0.0.1:22";
+              };
             };
           };
         };