hosts/desktop/default.nix

@@ -26,7 +26,10 @@
     services = {
       gc.enable = true;
       sound.enable = true;
-      tailscale.enable = true;
+      tailscale = {
+        enable = true;
+        ssh.enable = true;
+      };
       nebula.node = {
         enable = true;
         address = "10.254.250.1";

hosts/laptop/default.nix

@@ -29,7 +29,10 @@
       wlan.enable = true;
       bluetooth.enable = true;
       sound.enable = true;
-      tailscale.enable = true;
+      tailscale = {
+        enable = true;
+        ssh.enable = true;
+      };
       nebula.node = {
         enable = true;
         address = "10.254.250.3";

hosts/vps-monitor/default.nix

@@ -21,7 +21,10 @@
     boot.loader.grub.enable = true;
 
     services = {
-      tailscale.enable = true;
+      tailscale = {
+        enable = true;
+        ssh.enable = true;
+      };
 
       nebula.node = {
         enable = true;

hosts/vps-private/default.nix

@@ -27,6 +27,7 @@
       services = {
         tailscale = {
           enable = true;
+          ssh.enable = true;
           exitNode.enable = true;
         };
 

hosts/vps-public/default.nix

@@ -21,7 +21,10 @@
     boot.loader.systemd-boot.enable = true;
 
     services = {
-      tailscale.enable = true;
+      tailscale = {
+        enable = true;
+        ssh.enable = true;
+      };
 
       nebula.node = {
         enable = true;

modules/home/programs/git.nix

@@ -39,11 +39,15 @@
         };
       };
 
-      lazygit.enable = true;
+      ssh = {
+        enable = true;
+        enableDefaultConfig = false;
+        matchBlocks =
+          config.custom.sops.secrets.ssh-key
+          |> lib.mapAttrs (name: _: { identityFile = config.sops.secrets."ssh-key/${name}".path; });
+      };
 
-      ssh.matchBlocks =
+      lazygit.enable = true;
-        config.custom.sops.secrets.ssh-key
-        |> lib.mapAttrs (name: _: { identityFile = config.sops.secrets."ssh-key/${name}".path; });
     };
   };
 }

modules/home/programs/ssh.nix

@@ -1,29 +0,0 @@
-{
-  config,
-  self,
-  lib,
-  ...
-}@moduleArgs:
-let
-  cfg = config.custom.programs.ssh;
-in
-{
-  options.custom.programs.ssh = {
-    enable = lib.mkEnableOption "";
-    hostName = lib.mkOption {
-      type = lib.types.nonEmptyStr;
-      default = moduleArgs.osConfig.networking.hostName or "";
-    };
-    publicKeyPath = lib.mkOption {
-      type = lib.types.path;
-      default = "${self}/users/${config.home.username}/@${cfg.hostName}/keys/ssh.pub";
-    };
-  };
-
-  config = lib.mkIf config.custom.programs.ssh.enable {
-    programs.ssh = {
-      enable = true;
-      enableDefaultConfig = false;
-    };
-  };
-}

modules/home/sops.nix

@@ -7,35 +7,36 @@
 }@moduleArgs:
 let
   cfg = config.custom.sops;
+
+  absoluteSecretsPath = "${self}/${cfg.secretsFile}";
 in
 {
   imports = [ inputs.sops.homeManagerModules.sops ];
 
   options.custom.sops = {
     enable = lib.mkEnableOption "";
+    agePublicKey = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = "";
+    };
     hostName = lib.mkOption {
       type = lib.types.nonEmptyStr;
       default = moduleArgs.osConfig.networking.hostName or "";
     };
-    agePublicKey = lib.mkOption {
-      type = lib.types.nonEmptyStr;
-      default =
-        "${self}/users/${config.home.username}/@${cfg.hostName}/keys/age.pub" |> lib.readFile |> lib.trim;
-    };
     secretsFile = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.nonEmptyStr;
-      default = "${self}/users/${config.home.username}/@${cfg.hostName}/secrets.json";
+      default = "users/${config.home.username}/@${cfg.hostName}/secrets.json";
     };
     secrets = lib.mkOption {
       type = lib.types.anything;
-      default = cfg.secretsFile |> lib.readFile |> lib.strings.fromJSON;
+      default = absoluteSecretsPath |> lib.readFile |> lib.strings.fromJSON;
     };
   };
 
   config = lib.mkIf cfg.enable {
     sops = {
       age.sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ];
-      defaultSopsFile = cfg.secretsFile;
+      defaultSopsFile = absoluteSecretsPath;
     };
   };
 }

modules/system/services/nebula/sshd.nix

@@ -1,9 +1,4 @@
-{
+{ config, lib, ... }:
-  config,
-  self,
-  lib,
-  ...
-}:
 let
   cfg = config.custom.services.nebula.node;
 in
@@ -30,18 +25,13 @@ in
           addr = cfg.address;
           inherit (cfg.sshd) port;
         };
-        settings = {
-          PasswordAuthentication = false;
-          KbdInteractiveAuthentication = false;
-          PermitRootLogin = "no";
-        };
       };
 
       nebula.networks.mesh.firewall.inbound =
         config.custom.services.nebula.peers
         |> lib.filter (node: node.isClient)
         |> lib.map (nebula: {
-          inherit (cfg.sshd) port;
+          port = "22";
           proto = "tcp";
           host = nebula.name;
         });
@@ -51,14 +41,5 @@ in
       requires = [ "nebula@mesh.service" ];
       after = [ "nebula@mesh.service" ];
     };
-
-    users.users.seb.openssh.authorizedKeys.keyFiles =
-      self.nixosConfigurations
-      |> lib.filterAttrs (name: _: name != config.networking.hostName)
-      |> lib.attrValues
-      |> lib.filter (value: value.config |> lib.hasAttr "home-manager")
-      |> lib.map (value: value.config.home-manager.users.seb.custom.programs.ssh)
-      |> lib.filter (ssh: ssh.enable)
-      |> lib.map (ssh: ssh.publicKeyPath);
   };
 }

users/seb/@desktop/home.nix

@@ -3,7 +3,10 @@ _: {
 
   home.stateVersion = "23.11";
 
-  custom.theme = "dark";
+  custom = {
+    sops.agePublicKey = "age1p32cyzakxtcx346ej82ftln4r2aw2pcuazq3583s85nzsan4ygqsj32hjf";
+    theme = "dark";
+  };
 
   wayland.windowManager.hyprland.settings.monitor = [ "DP-1,2560x1440@180,0x0,1" ];
 }

users/seb/@desktop/keys/age.pub

@@ -1 +0,0 @@
-age1p32cyzakxtcx346ej82ftln4r2aw2pcuazq3583s85nzsan4ygqsj32hjf

users/seb/@desktop/keys/ssh.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBUORYC3AvTPQmtUEApTa9DvHoJy4mjuQy8abSjCcDd seb@desktop

users/seb/@laptop/home.nix

@@ -4,6 +4,7 @@ _: {
   home.stateVersion = "24.11";
 
   custom = {
+    sops.agePublicKey = "age190mf9wx4ct7qvne3ly9j3cj9740z5wnfhsl6vsc5wtfyc5pueuas9hnjtr";
     theme = "light";
     programs.brightnessctl.enable = true;
   };

users/seb/@laptop/keys/age.pub

@@ -1 +0,0 @@
-age190mf9wx4ct7qvne3ly9j3cj9740z5wnfhsl6vsc5wtfyc5pueuas9hnjtr

users/seb/@laptop/keys/ssh.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID1WFOdZCvfb1ZRycBGK0x+3viQpkkl6CQ3cV/Mf3gAJ seb@laptop

users/seb/home.nix

@@ -27,7 +27,6 @@
         aliases.enable = true;
         direnv.enable = true;
       };
-      ssh.enable = true;
       git.enable = true;
       kitty.enable = true;
       vscode.enable = true;