configured a spotify widget for waybar

hosts/falkenstein-1/default.nix

@@ -56,6 +56,10 @@
     ports = [ 2222 ];
     settings.PasswordAuthentication = false;
   };
+  security = {
+    audit.enable = true;
+    auditd.enable = true;
+  };
   users.users.root.openssh.authorizedKeys.keyFiles = [
     ../../keys/ssh/rouven-thinkpad
     ../../keys/ssh/rouven-pixel

hosts/nuc/default.nix

@@ -64,6 +64,11 @@
 
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
+  security = {
+    audit.enable = true;
+    auditd.enable = true;
+  };
+
 
   # firmware updates
   services.fwupd.enable = true;

hosts/thinkpad/default.nix

@@ -46,7 +46,6 @@
   sops.age.sshKeyPaths = lib.mkForce [ "/nix/persist/system/etc/ssh/ssh_host_ed25519_key" ];
   sops.gnupg.sshKeyPaths = lib.mkForce [ ];
 
-
   time.timeZone = "Europe/Berlin";
   i18n.defaultLocale = "en_US.UTF-8";
   console = {
@@ -87,7 +86,11 @@
   #hardware.pulseaudio.enable = true;
   hardware.bluetooth.enable = true;
 
-  security.polkit.enable = true;
+  security = {
+    polkit.enable = true;
+    audit.enable = true;
+    auditd.enable = true;
+  };
 
   services.pipewire = {
     enable = true;
@@ -120,7 +123,11 @@
       nssmdns = true;
     };
     fprintd.enable = true; # log in using fingerprint
-    openssh.enable = true; # enabled ssh to have the host keys
+    # enabled ssh to have the host keys
+    openssh = {
+      enable = true;
+      openFirewall = false;
+    };
     btrfs.autoScrub.enable = true; # periodically check filesystem and repair it
     fwupd.enable = true; # firmware updates
   };