max / alloy

preset: keep sshd on, and say so This changes no state. openssh-server is in fedora-bootc:43 and Fedora enables sshd.service in 90-default.preset, which this file never overrode, so Alloy has been shipping sshd enabled on every install all along. What changes is that it is now a decision rather than something inherited from a server base and never looked at. Kept on because a machine you cannot reach when the display stack is the thing that broke is a machine you debug with a USB stick. That is as true on a laptop as on the always-on build host that prompted the question. The comment states the exposure rather than eliding it, including the part that is wider than expected: sshd -T reports passwordauthentication yes, so the account the installer creates is reachable by password. Whether that stays true is a separate decision, tracked as item 2 on GoingsOn alloy d1fed0d7.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-25 17:29 UTC

Signed with PGP, not checked

Commit: e9767ba84ae6fc3be21cc8bb3b8a023eb658f00b

Parent: 36e9516

1 file changed, +24 insertions, -0 deletions

M etc/systemd/system-preset/50-alloy.preset +24

			@@ -57,4 +57,28 @@
57	57		# simply collects nothing.
58	58		enable rasdaemon.service
59	59
	60	+	# sshd was already on before this line existed: openssh-server is in
	61	+	# fedora-bootc:43 and Fedora enables it in 90-default.preset, which this file
	62	+	# never overrode. So the state does not change here. What changes is that it
	63	+	# is now a decision (Max, 2026-07-25) rather than something inherited from a
	64	+	# server base and never looked at.
	65	+	#
	66	+	# Kept on because a machine you cannot reach when the display stack is the
	67	+	# thing that broke is a machine you debug with a USB stick. That argument is
	68	+	# not specific to the bench build host; it is the same on a laptop.
	69	+	#
	70	+	# The exposure is real and worth stating rather than eliding: a listening
	71	+	# daemon on every install, on any network the machine joins. And it is wider
	72	+	# than "you need a key" — `sshd -T` on fedora-bootc:43 reports
	73	+	# `passwordauthentication yes`. Root is key-only (`permitrootlogin
	74	+	# without-password`) and keyboard-interactive is off, but the uid 1000 account
	75	+	# `alloy install` creates is reachable with its password from anywhere that can
	76	+	# route to the machine. Whether that stays true is a separate decision from
	77	+	# this line; see GoingsOn alloy d1fed0d7.
	78	+	#
	79	+	# Note this is the opposite default from tailscaled below, which is opt-in:
	80	+	# tailscale reaches OUT to a service and is a privacy question, sshd listens
	81	+	# and is an access question, and they do not resolve the same way.
	82	+	enable sshd.service
	83	+
60	84		disable tailscaled.service