Commit a780d80

@@ -53,6 +53,9 @@
     includes = [
       ({user, ...}: {
         name = "core.openssh.access.user";
+        nixos.users.users.root.openssh.authorizedKeys.keys = lib.optionals (lib.elem "admins" user.groups) (
+          lib.concatMap (k: lib.optional (k.needVerify) k.key) user.identity.sshKeys
+        );
         user.openssh.authorizedKeys.keys = map (k: k.key) user.identity.sshKeys;
       })
     ];

@@ -30,9 +30,8 @@ in {
         path =
           inputs.deploy-rs.lib.${host.system}.activate.${host.class}
           self."${host.class}Configurations".${name};
-        sshUser = "hpcesia";
+        sshUser = "root";
         user = "root";
-        interactiveSudo = true;
       };
     })
     deployableHosts;

@@ -78,6 +78,11 @@
           tag = "hpcesia@kevin";
           key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMKaGC2I3an4AJDeWzVx5vhm63+kxi6zJNdh7yEp6CK";
         }
+        {
+          tag = "hpcesia@yubikey";
+          needVerify = true;
+          key = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIH6wZFUEv9pSV+MgzqZRJ08WwJvL5FRMhayp73kCnDckAAAABHNzaDo=";
+        }
       ];
     };
     system = {

@@ -1,5 +1,5 @@
 {lib, ...}: let
-  inherit (lib) mkOption types;
+  inherit (lib) mkOption mkEnableOption types;
 
   sshKeyType = types.submodule {
     options = {
@@ -8,6 +8,7 @@
         default = null;
         description = "Tag to categorize the SSH key (e.g., 'laptop', 'workstation', 'yubikey')";
       };
+      needVerify = mkEnableOption "Need verify before using this SSH key, e.g. passphase or security key's PIN";
       key = mkOption {
         type = types.str;
         description = "SSH public key string";