Previous discussions about this: #19504 (comment) #19504 (comment)

I'm concerned about this because some NixOS systems may be unknowingly relying on the default setting (true) to open the SSH port on the firewall. Personally, I didn't even know this option existed.

What about removing the default setting altogether. Wouldn't that cause a build-time failure, forcing the system admin to explicitly set it to true or false?

In addition, given the change is not backwards compatible, I think it should be documented in the release notes.

Consensus up to now was that sshd was the only exception allowed to open a firewall port automatically.
Without it, it would be too easy for a user to lock himself out of a machine. Especially on a server machine deployed "in the cloud" with no other access to it (no recovery console or remote management).

If we were to disable that, I'm sure we would receive another PR to re-enable it pretty quickly.

Instead, maybe there is some doc to enhance to emphasize that the first things a concerned admin should do after a NixOS install is to look at and review the sshd config.

👎 - As already stated we had these discussions in the past and we are (AFAIK) fine with having an open tcp/22 port for UX reasons.

I'm concerned about this because some NixOS systems may be unknowingly relying on the default setting (true) to open the SSH port on the firewall. Personally, I didn't even know this option existed.

Understandable. But I'd rather vote for adding either a warning (if only the default value is set) or to mention this in the manual at a more "prominent" position.

Without it, it would be too easy for a user to lock himself out of a machine. Especially on a server machine deployed "in the cloud" with no other access to it (no recovery console or remote management).

Full ack! I already found several corner cases that caused me to lock myself out of a remote NixOS. By disabling an open sshd by default we mainly add another possibility where users might lock themselves out their machines and a recovery from that is usually pretty painful.

What about removing the default setting altogether. Wouldn't that cause a build-time failure, forcing the system admin to explicitly set it to true or false?

In case there are more folks in favor of dropping that default, I'd be fine with this solution.

As discussed a number of times in the past this is on purpose. Some suggestions about throwing a warning seem like a good idea. Maybe forcing users to choose a value for ssh only is an acceptable solution?

What do you think @edolstra?