fix(electra): restrict SSH to Nebula interface #76

Closed

nimmo wants to merge 0 commits from electra-lockdown-ssh into main

nimmo commented

2026-07-19 20:01:59 +01:00

Owner

Problem

services.openssh.openFirewall = true on Electra opens TCP/22 in the global firewall, exposing SSH on its LAN/WAN interfaces — not just the nebula.mesh overlay. The interface-specific allowedTCPPorts = [ 22 ] rule does not limit that global rule.

This is the same issue flagged in the Lena review (#75, comment 432) and already fixed there. Electra was left exposed.

Change

hosts/electra/default.nix: remove openFirewall = true (defaults to false); keep networking.firewall.interfaces."nebula.mesh".allowedTCPPorts = [ 22 ].

After this, port 22 is reachable only over the Nebula overlay. nix flake check passes.

Deployment

On Electra: sudo nixos-rebuild switch --flake .#electra, then verify ssh nimmo@electra.mesh still works and that 22 is no longer open on the LAN interface.

## Problem `services.openssh.openFirewall = true` on Electra opens TCP/22 in the global firewall, exposing SSH on its LAN/WAN interfaces — not just the `nebula.mesh` overlay. The interface-specific `allowedTCPPorts = [ 22 ]` rule does not limit that global rule. This is the same issue flagged in the Lena review (#75, comment 432) and already fixed there. Electra was left exposed. ## Change - `hosts/electra/default.nix`: remove `openFirewall = true` (defaults to false); keep `networking.firewall.interfaces."nebula.mesh".allowedTCPPorts = [ 22 ]`. After this, port 22 is reachable only over the Nebula overlay. `nix flake check` passes. ## Deployment On Electra: `sudo nixos-rebuild switch --flake .#electra`, then verify `ssh nimmo@electra.mesh` still works and that 22 is no longer open on the LAN interface.

nimmo added 1 commit

2026-07-19 20:02:00 +01:00

fix(electra): restrict SSH to Nebula interface

Build and Push Attic Cache / test (pull_request) Successful in 34s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / test (push) Successful in 31s

Details

Build and Push Attic Cache / build (push) Successful in 2m57s

Details

52846ab5ae

Remove services.openssh.openFirewall so TCP/22 is no longer open on
Electra's LAN/WAN interfaces. Keep the nebula.mesh interface rule so SSH
remains reachable over the overlay only — matching the lena fix.

nimmo added this to the Nebula Mesh Network milestone

2026-07-19 20:03:54 +01:00

nimmo closed this pull request

2026-07-19 20:16:54 +01:00

nimmo deleted branch electra-lockdown-ssh

2026-07-19 20:17:02 +01:00