profiles/common-ssh: Migrate common SSH config to profile and pin SSH public hosts keys for net.clerie.de

configuration/common/default.nix

@@ -8,7 +8,6 @@
     ./locale.nix
     ./networking.nix
     ./programs.nix
-    ./ssh.nix
     ./systemd.nix
     ./user.nix
   ];

configuration/common/ssh.nix

@@ -1,16 +0,0 @@
-{ lib, ... }:
-
-{
-
-  services.openssh.enable = true;
-  services.openssh.settings = {
-    PasswordAuthentication = false;
-    KbdInteractiveAuthentication = false;
-    PermitRootLogin = lib.mkDefault "no";
-  };
-  services.openssh.hostKeys = lib.mkForce [
-    # Only create ed25519 host keys
-    { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
-  ];
-
-}

profiles/common-ssh/default.nix

@@ -0,0 +1,29 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+
+  options.profiles.clerie.common-ssh = {
+    enable = mkEnableOption "Common ssh config";
+  };
+
+  config = mkIf config.profiles.clerie.common-ssh.enable {
+
+    services.openssh.enable = true;
+    services.openssh.settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = lib.mkDefault "no";
+    };
+    services.openssh.hostKeys = lib.mkForce [
+      # Only create ed25519 host keys
+      { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+    ];
+
+    programs.ssh.knownHostsFiles = [
+      (pkgs.clerie-ssh-known-hosts + "/known_hosts")
+    ];
+
+  };
+}

profiles/common/default.nix

@@ -11,10 +11,9 @@ with lib;
   config = mkIf config.profiles.clerie.common.enable {
 
     profiles.clerie.common-dns.enable = mkDefault true;
-
     profiles.clerie.common-networking.enable = mkDefault true;
     profiles.clerie.common-nix.enable = mkDefault true;
-
+    profiles.clerie.common-ssh.enable = mkDefault true;
     profiles.clerie.common-webserver.enable = mkDefault true;
 
     profiles.clerie.hetzner-storage-box-client.enable = mkDefault true;

profiles/default.nix

@@ -7,6 +7,7 @@
     ./common-dns
     ./common-networking
     ./common-nix
+    ./common-ssh
     ./common-webserver
     ./cybercluster-vm
     ./desktop