1{lib, ...}: {
 2  den.aspects.core.openssh = {
 3    persist = {config, ...}: {
 4      files =
 5        builtins.concatMap
 6        (key: [key.path] ++ ["${key.path}.pub"])
 7        config.services.openssh.hostKeys;
 8    };
 9    persistUser = {
10      directories = [
11        {
12          directory = ".ssh";
13          mode = "0700";
14        }
15      ];
16    };
17
18    nixos = {
19      services.openssh = {
20        generateHostKeys = true;
21        hostKeys = [
22          {
23            path = "/etc/ssh/ssh_host_ed25519_key";
24            type = "ed25519";
25          }
26          {
27            path = "/etc/ssh/ssh_host_rsa_key";
28            type = "rsa";
29            bit = 4096;
30          }
31        ];
32      };
33    };
34
35    homeManager = {
36      programs.ssh = {
37        enable = true;
38        enableDefaultConfig = false;
39
40        settings = {
41          "*".AddKeysToAgent = "yes";
42          "github.com" = {
43            HostName = "ssh.github.com";
44            Port = 443;
45            User = "git";
46          };
47        };
48      };
49    };
50  };
51
52  den.aspects.core.openssh.access = {
53    includes = [
54      ({user, ...}: {
55        name = "core.openssh.access.user";
56        user.openssh.authorizedKeys.keys = map (k: k.key) user.identity.sshKeys;
57      })
58    ];
59
60    settings = {
61      port = lib.mkOption {
62        description = "Port to open for SSH access.";
63        type = lib.types.port;
64        default = 22;
65      };
66    };
67
68    nixos = {host, ...}: {
69      services.openssh = {
70        enable = true;
71        # Serve on 22 port for Tailscale
72        ports = lib.unique [22 host.settings.core.openssh.access.port];
73        settings = {
74          PermitRootLogin = "prohibit-password";
75          PasswordAuthentication = false;
76        };
77        # Mannualy open filewall
78        openFirewall = false;
79      };
80
81      networking.firewall.allowedTCPPorts = [host.settings.core.openssh.access.port];
82
83      environment.enableAllTerminfo = true;
84    };
85  };
86}