From da900f6014b8fa65c5e097acfe6d949aee4a4179 Mon Sep 17 00:00:00 2001
From: Aargh Rai <aargh.rai+git@gmail.com>
Date: Wed, 29 Jul 2026 17:30:51 +0530
Subject: ventoy & tailscale

---
 nixos/environment.nix   | 1 +
 nixos/opt/tailscale.nix | 7 -------
 nixos/services.nix      | 8 +++++++-
 3 files changed, 8 insertions(+), 8 deletions(-)

(limited to 'nixos')

diff --git a/nixos/environment.nix b/nixos/environment.nix
index 9ab3d7e..c29c8bf 100644
--- a/nixos/environment.nix
+++ b/nixos/environment.nix
@@ -79,6 +79,7 @@
     termshark
     mitmproxy
     certmitm
+    ventoy
   ];
   fonts.packages = with pkgs; [
     dejavu_fonts
diff --git a/nixos/opt/tailscale.nix b/nixos/opt/tailscale.nix
index a14c93b..50244cb 100644
--- a/nixos/opt/tailscale.nix
+++ b/nixos/opt/tailscale.nix
@@ -1,24 +1,17 @@
 { config, pkgs, ... }:
 {
-  # 1. Enable the service and the firewall
   services.tailscale.enable = true;
   networking.nftables.enable = true;
   networking.firewall = {
     enable = true;
-    # Always allow traffic from your Tailscale network
     trustedInterfaces = [ "tailscale0" ];
-    # Allow the Tailscale UDP port through the firewall
     allowedUDPPorts = [ config.services.tailscale.port ];
   };
 
-  # 2. Force tailscaled to use nftables (Critical for clean nftables-only systems)
-  # This avoids the "iptables-compat" translation layer issues.
   systemd.services.tailscaled.serviceConfig.Environment = [ 
     "TS_DEBUG_FIREWALL_MODE=nftables" 
   ];
 
-  # 3. Optimization: Prevent systemd from waiting for network online 
-  # (Optional but recommended for faster boot with VPNs)
   systemd.network.wait-online.enable = false; 
   boot.initrd.systemd.network.wait-online.enable = false;
 }
diff --git a/nixos/services.nix b/nixos/services.nix
index 2cbd8b5..38634b2 100644
--- a/nixos/services.nix
+++ b/nixos/services.nix
@@ -29,7 +29,13 @@
     wireplumber.enable = true;
   };
   services.cloudflare-warp.enable = true;
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
   services.flatpak.enable = true;
   services.kanata = {
     enable = true;
-- 
cgit v1.2.3