From 9d64892ddd708ec01657744538cbd122dfe5e61e Mon Sep 17 00:00:00 2001
From: Hadi <112569860+anotherhadi@users.noreply.github.com>
Date: Fri, 11 Sep 2026 13:41:49 +0200
Subject: [PATCH] cloudflare ssh tunnel fix

Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>
---
 server-modules/cloudflared.nix | 1 +
 server-modules/ssh.nix         | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/server-modules/cloudflared.nix b/server-modules/cloudflared.nix
index 196b3949..5eba6d9d 100644
--- a/server-modules/cloudflared.nix
+++ b/server-modules/cloudflared.nix
@@ -40,5 +40,6 @@
   # At the moment (2025), for support of browser rendering of the tunnels, this line is required:
   services.openssh.settings.Macs = [
     "hmac-sha2-256"
+    "hmac-sha2-512"
   ];
 }
diff --git a/server-modules/ssh.nix b/server-modules/ssh.nix
index ae98bfb3..5eae0724 100644
--- a/server-modules/ssh.nix
+++ b/server-modules/ssh.nix
@@ -20,11 +20,19 @@ in {
       KexAlgorithms = [
         "curve25519-sha256"
         "curve25519-sha256@libssh.org"
+        "ecdh-sha2-nistp256"
+        "ecdh-sha2-nistp384"
+        "ecdh-sha2-nistp521"
       ];
       Ciphers = [
         "chacha20-poly1305@openssh.com"
         "aes256-gcm@openssh.com"
+        "aes128-gcm@openssh.com"
+        "aes256-ctr"
+        "aes192-ctr"
+        "aes128-ctr"
       ];
+      HostKeyAlgorithms = "ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa";
     };
   };