disable all but public key auth for ssh

configuration.nix

@@ -103,10 +103,9 @@
     enable = true;
     ports = [ 22 ];
     settings = {
-      PasswordAuthentication = true;
+      PasswordAuthentication = false;
       KbdInteractiveAuthentication = false;
-      # AllowUsers = [ "backup" ];
-      # UseDns = true;
+      AuthenticationMethods = "publickey";
       X11Forwarding = false;
       PermitRootLogin = "no";
     };
@@ -138,5 +137,7 @@
   system.stateVersion = "24.11"; # Did you read the comment?
 
   nix.settings.trusted-users = [ "shatteredmint" ];
+  # if people get to that point we are fucked anyways
+  security.sudo.wheelNeedsPassword = false;
 }
 

devices/conv.nix

@@ -64,7 +64,7 @@
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
   # make custom dns work while gracefully falling back on public servers
-  networking.networkmanager.insertNameservers = [ "192.168.178.108" ];
+  # networking.networkmanager.insertNameservers = [ "192.168.178.108" ];
   # networking.interfaces.enp4s0f3u1u4u1.useDHCP = lib.mkDefault true;
   # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
 

devices/desk.nix

@@ -60,4 +60,9 @@
   networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
   # required for ZFS
   networking.hostId = "00000001";
+
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
 }

devices/nas.nix

@@ -14,8 +14,6 @@
   boot.kernelModules = [ ];    
   boot.extraModulePackages = [ ];
 
-  security.sudo.wheelNeedsPassword = false;
-
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
       fsType = "ext4";

flake.lock

@@ -27,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778535464,
-        "narHash": "sha256-kkUQYSv70wynJ/DfnGals6r98I6bK3CVNVTN1zbAd7Y=",
+        "lastModified": 1781365335,
+        "narHash": "sha256-zqDBhXMzfbdlO7F2bGHe7MOtB3xngd/+4ieMHDC+ZXo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b659c7ffd40fc9e3bb60d420c79c67e769b9f4ab",
+        "rev": "5b6f5733726a1b2ccafb5dec6ac4ca7299fad66c",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
     },
     "nix-flatpak": {
       "locked": {
-        "lastModified": 1777402031,
-        "narHash": "sha256-6gkfl9y3+ti0Z6dgby8/R4/DRT8sWU0I0TLCIxwWtjk=",
+        "lastModified": 1780908363,
+        "narHash": "sha256-llGS4y3Qh1eUkli3/Y2VY9FV3GOUKFZR1E2BDftt45Q=",
         "owner": "gmodena",
         "repo": "nix-flatpak",
-        "rev": "22a3adbe7c5c8c8a10a635d32c9ef7fc01a6e4b8",
+        "rev": "1df08625f0f8c7d6e300a0e5df7955bbb877d809",
         "type": "github"
       },
       "original": {
@@ -57,11 +57,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1777954456,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "lastModified": 1781074563,
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
         "owner": "NixOs",
         "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
         "type": "github"
       },
       "original": {

flake.nix

@@ -26,7 +26,6 @@
 	    specialArgs = inputs;
 	    modules = [
           ./devices/desk.nix
-	      ./hardware/nvidia.nix
           ./hardware/scanner.nix
 
 	      ./configuration.nix 
@@ -37,10 +36,7 @@
           ./backup-target.nix
 
 	      ./users/shatteredmint.nix
-          # ./qemu-bridges.nix
-          {
-            programs.kdeconnect.enable = true;
-          }
+          ./qemu-bridges.nix
 	];
       };
 

qemu-bridges.nix

@@ -8,6 +8,7 @@
 
     networking.interfaces.virtbr0 = {
         useDHCP = true;
+        macAddress = "04:92:26:c3:06:c2";
     };
 
     virtualisation.libvirtd = { 

software/default-graphical.nix

@@ -18,6 +18,9 @@
       makemkv
     ];
   };
+
+  programs.kdeconnect.enable = true;
+
   # enable flatpak
   services.flatpak.enable = true;
   home-manager.users.shatteredmint.imports = [

software/wireguard-client.nix

@@ -5,16 +5,17 @@
 {ip}: {
     networking = {
         firewall.allowedUDPPorts = [56878];
-        wireguard = {
-            enable = true;
+        wg-quick = {
+            # enable = true;
             interfaces.wg0 = {
-                ips = [ ("192.168.87." + builtins.toString(ip) + "/32")];
+                address = [ ("192.168.87." + builtins.toString(ip) + "/32")];
                 listenPort = 56878;
                 privateKeyFile = "/root/wg.keys";
+                dns = [ "192.168.178.108" ];
 
                 peers = [
                     {
-                        name = "hub";
+                        # name = "hub";
                         publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
                         allowedIPs = [ "192.168.178.0/24" "192.168.87.127/32" "192.168.87.128/25"];
                         endpoint = "173.249.36.74:56878";