1{lib, ...}: {
 2  den.aspects.core.openssh = {
 3    persist = {config, ...}: {
 4      files =
 5        builtins.concatMap
 6        (key: [key.path] ++ ["${key.path}.pub"])
 7        config.services.openssh.hostKeys;
 8    };
 9    persistUser = {
10      directories = [
11        {
12          directory = ".ssh";
13          mode = "0700";
14        }
15      ];
16    };
17
18    nixos = {
19      services.openssh = {
20        generateHostKeys = true;
21        hostKeys = [
22          {
23            path = "/etc/ssh/ssh_host_ed25519_key";
24            type = "ed25519";
25          }
26          {
27            path = "/etc/ssh/ssh_host_rsa_key";
28            type = "rsa";
29            bit = 4096;
30          }
31        ];
32      };
33    };
34
35    homeManager = {
36      programs.ssh = {
37        enable = true;
38        enableDefaultConfig = false;
39
40        settings = {
41          "*".AddKeysToAgent = "yes";
42          "github.com" = {
43            HostName = "ssh.github.com";
44            Port = 443;
45            User = "git";
46          };
47        };
48      };
49    };
50  };
51
52  den.aspects.core.openssh.access = {
53    includes = [
54      ({user, ...}: {
55        name = "core.openssh.access.user";
56        nixos.users.users.root.openssh.authorizedKeys.keys = lib.optionals (lib.elem "admins" user.groups) (
57          lib.concatMap (k: lib.optional (k.needVerify) k.key) user.identity.sshKeys
58        );
59        user.openssh.authorizedKeys.keys = map (k: k.key) user.identity.sshKeys;
60      })
61    ];
62
63    settings = {
64      port = lib.mkOption {
65        description = "Port to open for SSH access.";
66        type = lib.types.port;
67        default = 22;
68      };
69    };
70
71    nixos = {host, ...}: {
72      services.openssh = {
73        enable = true;
74        # Serve on 22 port for Tailscale
75        ports = lib.unique [22 host.settings.core.openssh.access.port];
76        settings = {
77          PermitRootLogin = "prohibit-password";
78          PasswordAuthentication = false;
79        };
80        # Mannualy open filewall
81        openFirewall = false;
82      };
83
84      networking.firewall.allowedTCPPorts = [host.settings.core.openssh.access.port];
85
86      environment.enableAllTerminfo = true;
87    };
88  };
89}