We should see if @edolstra finds this to be an acceptable compromise. This satisfies issues he has raised in the past, so I think there is a chance he would be accepting of this.

This would be okay, though I still think that the case where you want sshd enabled but you don't want it exposed in the firewall is a pretty rare one. So the current situation has my preference.

One possible scenario would be having two interfaces and assigning one of them as trusted interface with networking.firewall.trustedInterfaces. As you can access to trusted interface freely, one may think that the other interface is safe while it is not.

One possible scenario would be having two interfaces

This is my scenario. I set openFirewall to false and then explicitly open port 22 for a given interface. Though as mentioned maybe more of a rare scenario 😄

Of course you are right. This is a rare situation. However SSH is a dangerous thing when it is unchecked by firewall. I think we should maximize security whenever possible.

if I'm not mistaken, it'll add an extra not that obvious step to the installation process - not only enable sshd but open port for it.

@Frostman posting a clear message to the screen in an assertion if the user hasn't explicitly opened the firewall will clarify any confusion. All services except openssh require the user to explicitly open a port in the firewall.

Personally I'm somewhat indifferent to this PR, but the change has been requested a number of times and it seems like a reasonable solution to me. Since @edolstra seems to find this solution acceptable enough maybe we just wait and see more opinions 🤷‍♂️

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/ssh-openfirewall-exception/12066/1

AFAIU you won't if you didn't set sshd.openFirewall. If it's null, an eval error will be thrown and thus no bogus config will be deployed.

You are correct @Ma27 - this PR forces the user to explicitly set a value... so no risk of breakage.

AFAIU you won't if you didn't set sshd.openFirewall. If it's null, an eval error will be thrown and thus no bogus config will be deployed.

So does this mean that the default configuration as it is today, made by nixos-generate-config will fail to rebuild?

Edit: Ah, I misremembered. You have to manually enable SSH anyway, so this just makes it a required option. I see.

However, what about the installer image? SSH is enabled on that out-of-the-box. This is nice behavior in my view, because it allows easy provisioning, so even if this is merged, openFirewall should still be set to true on the installer image.

However, what about the installer image? SSH is enabled on that out-of-the-box. This is nice behavior in my view, because it allows easy provisioning, so even if this is merged, openFirewall should still be set to true on the installer image.

I tried to achieve that here. I am not sure if it is enough.

I marked this as stale due to inactivity. → More info