Networking: add ssh and more firewall rules

modules/nixos/networking/firewall/default.nix

@@ -1,5 +1,30 @@
 {
+  pkgs,
+  lib,
+  ...
+}: let
+  inherit (lib.modules) mkForce;
+in {
   imports = [
     ./fail2ban.nix
   ];
+
+  config = {
+    networking.firewall = {
+      enable = true;
+      package = pkgs.iptables;
+
+      allowedTCPPorts = [
+        443
+        80
+      ];
+      allowedUDPPorts = [];
+
+      # make a much smaller and easier to read log
+      logReversePathDrops = true;
+      logRefusedConnections = false;
+
+      checkReversePath = mkForce false;
+    };
+  };
 }

modules/nixos/networking/ssh.nix

@@ -1,7 +1,6 @@
 {...}: {
   services.openssh = {
     enable = true;
-    startWhenNeeded = true;
     settings = {
       PermitRootLogin = "no";
       PasswordAuthentication = false;