modules/nixos/services/openssh/default.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.services.openssh;
+  inherit (lib) mkIf mkEnableOption;
+in
+{
+  options.${namespace}.services.openssh = {
+    enable = mkEnableOption "Enable SSH";
+  };
+
+  config = mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+
+    services.fail2ban = {
+      enable = true;
+    };
+  };
+}

modules/nixos/services/remotebuild/default.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.services.remotebuild;
+  inherit (lib) mkIf mkEnableOption;
+in
+{
+  options.${namespace}.services.remotebuild = {
+    enable = mkEnableOption "Enable remotebuild";
+  };
+
+  config = mkIf cfg.enable {
+    users.users.remotebuild = {
+      isNormalUser = true;
+      createHome = false;
+      group = "remotebuild";
+
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYZjG+XPNoVHVdCel5MK4mwvtoFCqDY1WMI1yoU71Rd root@yggdrasil"
+      ];
+    };
+
+    users.groups.remotebuild = { };
+
+    nix = {
+      nrBuildUsers = 64;
+      settings = {
+        trusted-users = [ "remotebuild" ];
+
+        min-free = 10 * 1024 * 1024;
+        max-free = 200 * 1024 * 1024;
+
+        max-jobs = "auto";
+        cores = 0;
+      };
+    };
+
+    systemd.services.nix-daemon.serviceConfig = {
+      MemoryAccounting = true;
+      MemoryMax = "90%";
+      OOMScoreAdjust = 500;
+    };
+  };
+}

systems/aarch64-linux/nixberry/default.nix

@@ -19,42 +19,6 @@ in
     raspberry-pi-5
   ];
 
-  security.sudo.wheelNeedsPassword = false;
-  users.users.remotebuild = {
-    isNormalUser = true;
-    createHome = false;
-    group = "remotebuild";
-
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYZjG+XPNoVHVdCel5MK4mwvtoFCqDY1WMI1yoU71Rd root@yggdrasil"
-    ];
-  };
-
-  users.groups.remotebuild = { };
-
-  nixpkgs.hostPlatform = {
-    system = "aarch64-linux";
-  };
-
-  nix = {
-    nrBuildUsers = 64;
-    settings = {
-      trusted-users = [ "remotebuild" ];
-
-      min-free = 10 * 1024 * 1024;
-      max-free = 200 * 1024 * 1024;
-
-      max-jobs = "auto";
-      cores = 0;
-    };
-  };
-
-  systemd.services.nix-daemon.serviceConfig = {
-    MemoryAccounting = true;
-    MemoryMax = "90%";
-    OOMScoreAdjust = 500;
-  };
-
   services.tailscale = {
     enable = true;
     useRoutingFeatures = "server";
@@ -83,16 +47,15 @@ in
         };
       };
     };
-  };
+    firewall = {
-
+      allowedTCPPorts = [
-  networking.firewall = {
+        53
-    allowedTCPPorts = [
+        80
-      53
+      ];
-      80
+      allowedUDPPorts = [
-    ];
+        53
-    allowedUDPPorts = [
+      ];
-      53
+    };
-    ];
   };
 
   services.adguardhome = {
@@ -134,7 +97,6 @@ in
             "https://adguardteam.github.io/HostlistsRegistry/assets/filter_24.txt"
             "https://adguardteam.github.io/HostlistsRegistry/assets/filter_47.txt"
           ];
-
     };
   };
 
@@ -165,17 +127,14 @@ in
     };
   };
 
-  services.openssh = {
-    enable = true;
-    settings = {
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
-    };
-  };
-
   ${namespace} = {
     submodules.basics = enabled;
 
+    services = {
+      openssh = enabled;
+      remotebuild = enabled;
+    };
+
     system = {
       # cachemiss for webkit gtk
       hardware.networking.enable = mkForce false;

systems/x86_64-linux/loptland/default.nix

@@ -39,18 +39,6 @@ in
     };
   };
 
-  services.openssh = {
-    enable = true;
-    settings = {
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
-    };
-  };
-
-  services.fail2ban = {
-    enable = true;
-  };
-
   services.nginx = {
     enable = true;
     recommendedProxySettings = true;
@@ -199,6 +187,7 @@ in
         enable = true;
         inherit sopsFile;
       };
+      openssh = enabled;
     };
 
     security = {