SSH into your Mac, but only from home

#!/bin/bash
HOME_ROUTER_MACS="a4:2b:8c:1d:4e:6f"   # space-separated; add more if needed
LOG=/var/log/ssh-home-guard.log
STATE=/var/run/ssh-home-guard.state   # last observation, so we log changes, not ticks
log() { echo "$(date '+%F %T') $*" >> "$LOG"; }

# Normalize a MAC like "4:2b:8c:1d:4e:6f" -> "04:2b:8c:1d:4e:6f"
norm() { echo "$1" | tr 'A-F' 'a-f' | awk -F: '{for(i=1;i<=NF;i++){printf "%s%02s", (i>1?":":""), $i}; print ""}' | tr ' ' '0'; }

gw=$(route -n get default 2>/dev/null | awk '/gateway:/{print $2}')
mac=""
if [ -n "$gw" ]; then
  # ARP entry may not exist right after joining; nudge it.
  arp -n "$gw" 2>/dev/null | grep -q ' at ' || ping -c1 -W1 "$gw" >/dev/null 2>&1
  raw=$(arp -n "$gw" 2>/dev/null | awk '/ at /{print $4}')
  [ -n "$raw" ] && [ "$raw" != "(incomplete)" ] && mac=$(norm "$raw")
fi

want=off
for m in $HOME_ROUTER_MACS; do
  [ "$(norm "$m")" = "$mac" ] && want=on
done

# Current state: is sshd loaded in launchd? (systemsetup -setremotelogin needs
# Full Disk Access on modern macOS, so we drive launchd directly instead; the
# System Settings > Sharing > Remote Login toggle reflects the same state.)
SSHD=system/com.openssh.sshd
SSHD_PLIST=/System/Library/LaunchDaemons/ssh.plist
if launchctl print "$SSHD" >/dev/null 2>&1; then cur=on; else cur=off; fi

# Log every run whose observation differs from the last one (network change,
# someone toggling Sharing by hand, first run after boot) -- not every tick.
obs="gw=${gw:-none} mac=${mac:-none} sshd=$cur want=$want"
if [ "$obs" != "$(cat "$STATE" 2>/dev/null)" ]; then
  log "observed  $obs"
  echo "$obs" > "$STATE"
fi

if [ "$cur" != "$want" ]; then
  if [ "$want" = on ]; then
    out=$(launchctl enable "$SSHD" 2>&1; launchctl bootstrap system "$SSHD_PLIST" 2>&1)
  else
    out=$(launchctl bootout "$SSHD" 2>&1; launchctl disable "$SSHD" 2>&1)
  fi
  if launchctl print "$SSHD" >/dev/null 2>&1; then now=on; else now=off; fi
  if [ "$now" = "$want" ]; then
    log "flipped   remote login $cur -> $want${out:+  [$out]}"
  else
    log "FAILED    remote login $cur -> $want, still $now${out:+  [$out]}"
  fi
fi

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.dg.ssh-home-guard</string>
  <key>ProgramArguments</key>
  <array><string>/usr/local/sbin/ssh-home-guard.sh</string></array>
  <key>RunAtLoad</key><true/>
  <!-- fires on every network change (DNS config is rewritten on join/leave) -->
  <key>WatchPaths</key>
  <array>
    <string>/private/var/run/resolv.conf</string>
    <string>/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist</string>
  </array>
  <!-- safety net: re-check every 60s regardless -->
  <key>StartInterval</key><integer>60</integer>
  <key>StandardErrorPath</key><string>/var/log/ssh-home-guard.err</string>
</dict>
</plist>

~/ssh-home-guard/                        # your working copy, anywhere
├── ssh-home-guard.sh                    # FIG 2; the notify function is added later
└── com.dg.ssh-home-guard.plist          # FIG 3

/usr/local/sbin/
└── ssh-home-guard.sh                    # installed copy; root-owned, mode 755

/Library/LaunchDaemons/
└── com.dg.ssh-home-guard.plist          # installed copy; root-owned, mode 644

/var/log/
├── ssh-home-guard.log                   # observations and flips, written by the script
└── ssh-home-guard.err                   # anything the script prints to stderr

/var/run/
└── ssh-home-guard.state                 # last observation; cleared at boot

NTFY_TOPIC="your-private-topic"   # set to "" to disable phone push

notify() {  # $1=title $2=body
  local user uid
  user=$(stat -f %Su /dev/console 2>/dev/null); uid=$(id -u "$user" 2>/dev/null)
  if [ -n "$uid" ] && [ "$user" != "root" ]; then
    launchctl asuser "$uid" sudo -u "$user" osascript \
      -e "display notification \"$2\" with title \"$1\" sound name \"Glass\"" >/dev/null 2>&1 &
  fi
  if [ -n "$NTFY_TOPIC" ]; then
    curl -s -m 5 -H "Title: $1" -d "$2" "https://ntfy.sh/$NTFY_TOPIC" >/dev/null 2>&1 &
  fi
}

# after the log line inside the flip branch:
if [ "$want" = on ]; then
  notify "SSH: Remote Login ON" "Home router detected (gw $gw). sshd listening on port 22."
else
  notify "SSH: Remote Login OFF" "Not on home network (gw ${gw:-none}). Port 22 closed."
fi