Restructure networking configuration to per-machine modules

- Move networking configs to modules/network/ directory
- Create network-<machine-name>.nix files for each machine
- Add common.nix for shared networking configuration
- Update import paths in machine configurations
- Reduce duplication by using common networking settings

Network modules:
- modules/network/common.nix: Shared settings (nftables, SSH, tailscale)
- modules/network/network-congenital-optimist.nix: Workstation specific
- modules/network/network-sleeper-service.nix: File server specific

machines/congenital-optimist/configuration.nix

@@ -7,10 +7,10 @@
 }: {
   imports = [
     ./hardware-configuration.nix
+    ../../modules/network/network-congenital-optimist.nix
     
     # System modules
     ../../modules/system/fonts.nix
-    ../../modules/system/network.nix
     ../../modules/system/applications.nix
     
     # Hardware modules

machines/sleeper-service/configuration.nix

@@ -1,6 +1,7 @@
 { config, pkgs, inputs, unstable, ... }: {
   imports = [
     ./hardware-configuration.nix
+    ../../modules/network/network-sleeper-service.nix
   ];
 
   # Boot configuration
@@ -11,12 +12,6 @@
     devices = [ "nodev" ];
   };
 
-  # Network configuration
-  networking.hostName = "sleeper-service";
-  networking.networkmanager.enable = true;
-  services.tailscale.enable = true;
-  networking.firewall.enable = true;
-
   # Time and locale
   time.timeZone = "Europe/Oslo";
   i18n.defaultLocale = "en_US.UTF-8";
@@ -30,15 +25,6 @@
   # Enable unfree packages
   nixpkgs.config.allowUnfree = true;
 
-  # SSH access (headless server)
-  services.openssh = {
-    enable = true;
-    settings = {
-      PermitRootLogin = "no";
-      PasswordAuthentication = false;
-    };
-  };
-
   # Basic system packages
   environment.systemPackages = with pkgs; [
     wget

modules/network/common.nix

@@ -0,0 +1,33 @@
+# Common Network Configuration
+# Shared networking settings across all machines
+{ config, pkgs, ... }:
+
+{
+  # Common networking settings
+  networking = {
+    # Enable nftables by default for all machines
+    nftables.enable = true;
+    
+    # Common firewall settings
+    firewall = {
+      enable = true;
+      # SSH is allowed by default on all machines
+      allowedTCPPorts = [ 22 ];
+    };
+  };
+
+  # Common services available on all machines
+  services = {
+    # Tailscale VPN for secure remote access
+    tailscale.enable = true;
+    
+    # SSH access with secure defaults
+    openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+      };
+    };
+  };
+}

modules/network/network-congenital-optimist.nix

@@ -0,0 +1,27 @@
+# Networking Configuration - congenital-optimist
+# AMD Threadripper workstation network setup
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./common.nix
+  ];
+
+  # Machine-specific network configuration
+  networking = {
+    hostName = "congenital-optimist";
+    hostId = "8425e349";
+    networkmanager.enable = true;
+    
+    # Additional firewall ports for workstation services
+    firewall.allowedTCPPorts = [ 
+      9091  # Transmission RPC
+    ];
+  };
+
+  # ZFS services for this machine
+  services.zfs = {
+    autoScrub.enable = true;
+    trim.enable = true;
+  };
+}

modules/network/network-sleeper-service.nix

@@ -0,0 +1,21 @@
+# Networking Configuration - sleeper-service
+# Xeon file server network setup  
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./common.nix
+  ];
+
+  # Machine-specific network configuration
+  networking = {
+    hostName = "sleeper-service";
+    networkmanager.enable = true;
+    
+    # Additional firewall ports for file server services
+    # (Add specific ports as needed for file sharing services)
+    firewall.allowedTCPPorts = [ 
+      # Add additional ports here as needed
+    ];
+  };
+}

modules/system/network.nix

@@ -1,26 +0,0 @@
-{ config, pkgs, ... }: {
-  # Network configuration
-  networking = {
-    hostName = "congenital-optimist";
-    hostId = "8425e349";
-    networkmanager.enable = true;
-    nftables.enable = true;
-    
-    # Firewall configuration
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 22 ];
-      allowedUDPPorts = [ 22 ];
-    };
-  };
-
-  # VPN and remote access
-  services.tailscale.enable = true;
-  services.openssh.enable = true;
-
-  # ZFS services
-  services.zfs = {
-    autoScrub.enable = true;
-    trim.enable = true;
-  };
-}

modules/system/transmission.nix

@@ -14,7 +14,7 @@
       download-dir = "/mnt/storage";
       #rpc-whitelist-enabled = true;
       rpc-whitelist = "127.0.0.1,10.0.0.*,100.*.*.*";
-      rpc-host-whitelist = "idea,files,nixos-work,server1";
+      rpc-host-whitelist = "congenital-optimist,localhost";
     };
   };
 }