finish configuration for ssh

- iptables geoip whitelist for ssh
- NOPASSWD for efibootmgr, allowing easy reboot into windows from laptop/phone
- no fastfetch for remote shells

hosts/takamaki/modules/openssh.nix

@@ -20,4 +20,11 @@
     };
     startWhenNeeded = true;
   };
+
+  networking.firewall.extraCommands = ''
+    iptables -D INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP
+    ${pkgs.ipset}/bin/ipset destroy geo-whitelist
+    ${pkgs.ipset}/bin/ipset restore -file /home/grey/nixos/assets/geo-whitelist.ipset
+    iptables -I INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP
+  '';
 }

hosts/takamaki/modules/sudo.nix

@@ -27,10 +27,18 @@
           command = "${pkgs.efibootmgr}/bin/efibootmgr";
           options = [ "NOPASSWD" ];
         }
+        {
+          command = "/run/current-system/sw/bin/efibootmgr";
+          options = [ "NOPASSWD" ];
+        }
         {
           command = "${pkgs.efibootmgr}/bin/efibootdump";
           options = [ "NOPASSWD" ];
         }
+        {
+          command = "${pkgs.efibootmgr}/sbin/efibootdump";
+          options = [ "NOPASSWD" ];
+        }
       ];
       users = [ "grey" ];
     }];