sshd enabled for caesium

caesium.nixos.nix

@@ -3,6 +3,7 @@
 {
   imports = [ 
     ./caesium.hardware.nix # Crucial: Imports your UUIDs
+    ./module.firewall.nix
   ];
 
   time.timeZone = "America/New_York";
@@ -14,10 +15,23 @@
   boot.loader.efi.canTouchEfiVariables = true;
   boot.kernelParams = [ "usbcore.autosuspend=-1" ];
 
+  # --- NETWORKING ---
   networking.hostName = "caesium";
   networking.networkmanager.enable = true;
   networking.interfaces.enp13s0.wakeOnLan.enable = true;
 
+  networking.firewall.enable = true;
+
+  # Declaratively restrict ports to CIDRs!
+  networking.firewall.restrictedPorts = {
+    ssh = {
+      port = 22;
+      allowedCIDRs = [
+        "192.168.1.0/16"
+      ];
+    };
+  };
+
   # --- STORAGE & SSD OPTIMIZATION ---
   # Enable TRIM for SSD longevity
   services.fstrim.enable = true;
@@ -43,6 +57,9 @@
     isNormalUser = true;
     shell = pkgs.zsh;
     extraGroups = [ "wheel" "networkmanager" "storage" "docker" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILsZW38Ad1GAhGgfo7LsBzt6M4oo30VafsmNrILPMVio"
+    ];
   };
 
   # --- FILE SYSTEMS (Overrides/Additions) ---
@@ -177,6 +194,18 @@
     binfmt = true;
   };
 
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      AllowUsers = [ "mbessette" ];
+      MaxAuthTries = 3;
+      PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
+    };
+  };
+
   # --- SYSTEM VERSION ---
-  system.stateVersion = "24.11"; # Or current stable version
+  system.stateVersion = "26.05"; # Or current stable version
 }