feb2025 sprint

3 files changed, 46 insertions, 3 deletions

diff --git a/machines/xnet/net/default.nix b/machines/xnet/net/default.nix
index 9673792..8258ea6 100644
--- a/machines/xnet/net/default.nix
+++ b/machines/xnet/net/default.nix
@@ -59,6 +59,7 @@ in
 {
   imports = [
     ./sshd.nix
+    ./dns.nix
   ];
 
   options.xnet.net = {
@@ -76,6 +77,9 @@ in
   };
 
   config = mkIf ((length cfg.join) > 0) {
+    # networkd will handle this
+    networking.useDHCP = false;
+
     systemd.network =
       let
         name = config.networking.hostName;
diff --git a/machines/xnet/net/dns.nix b/machines/xnet/net/dns.nix
new file mode 100644
index 0000000..579d6aa
--- /dev/null
+++ b/machines/xnet/net/dns.nix
@@ -0,0 +1,39 @@
+{ ... }: {
+  services.resolved.enable = false;
+
+  services.unbound = {
+    enable = true;
+    settings.server = {
+      interface = [ "127.0.0.1" ];
+      access-control = [
+        "0.0.0.0/0 refuse"
+        "127.0.0.0/8 allow"
+      ];
+
+      private-domain = [ ];
+      private-address = [ ];
+
+      harden-glue = true;
+      harden-dnssec-stripped = true;
+      use-caps-for-id = false;
+      prefetch = true;
+      edns-buffer-size = 1232;
+      hide-identity = true;
+      hide-version = true;
+      tls-system-cert = true;
+    };
+
+    settings.forward-zone = [{
+      name = ".";
+      forward-tls-upstream = true;
+      forward-addr = [
+        "9.9.9.9#dns.quad9.net"
+        "149.112.112.112#dns.quad9.net"
+      ];
+    }];
+  };
+
+  networking = {
+    nameservers = [ "::1" ];
+  };
+}
diff --git a/machines/xnet/net/sshd.nix b/machines/xnet/net/sshd.nix
index b7cacc2..9d7976e 100644
--- a/machines/xnet/net/sshd.nix
+++ b/machines/xnet/net/sshd.nix
@@ -22,10 +22,10 @@ in
         type = "ed25519";
       }];
       settings = {
-        UsePAM = true;
+        UsePAM = false;
         X11Forwarding = false;
-        PermitRootLogin = "yes";
-        # PasswordAuthentication = false;
+        PermitRootLogin = "prohibit-password";
+        PasswordAuthentication = false;
         Ciphers = [ "chacha20-poly1305@openssh.com" ];
         Macs = [ "hmac-sha2-512-etm@openssh.com" ];
         KexAlgorithms = [ "curve25519-sha256@libssh.org" ];