From 531afa134dd204b61cb506a425959dcf68949c9d Mon Sep 17 00:00:00 2001
From: Kleidi Bujari <mail@4kb.net>
Date: Sat, 5 Sep 2026 13:20:52 -0700
Subject: [nixos/sshd] fix pubkey accepted types and hostkey location

---
 modules/sshd.nix | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

(limited to 'modules')

diff --git a/modules/sshd.nix b/modules/sshd.nix
index 6afec3f..421ab7f 100644
--- a/modules/sshd.nix
+++ b/modules/sshd.nix
@@ -33,7 +33,7 @@ in
       startWhenNeeded = true;
       openFirewall = true;
       hostKeys = lib.singleton {
-        path = "/persist/certs/ssh/ssh_host_ed25519_key";
+        path = "/var/lib/sshd/ssh_host_ed25519_key";
         type = "ed25519";
       };
       settings = {
@@ -41,6 +41,7 @@ in
         X11Forwarding = false;
         PermitRootLogin = "prohibit-password";
         PasswordAuthentication = mkDefault false;
+        KbdInteractiveAuthentication = false;
         # Ciphers = [ "chacha20-poly1305@openssh.com" ];
         # Macs = [ "hmac-sha2-512-etm@openssh.com" ];
         # KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
@@ -50,15 +51,14 @@ in
         "-f AUTHPRIV"
         "-l INFO"
       ];
-      # extraConfig =
-      #   let
-      #     pubkeyTypes = lib.strings.concatStringsSep "," [
-      #       "sk-ssh-ed25519-cert-v01@openssh.com"
-      #       "ssh-ed25519-cert-v01@openssh.com"
-      #       "ssh-ed25519"
-      #     ];
-      #   in
-      #   "PubkeyAcceptedKeyTypes ${pubkeyTypes}";
+      extraConfig =
+        let
+          pubkeyTypes = lib.strings.concatStringsSep "," [
+            "sk-ssh-ed25519@openssh.com"
+            "ssh-ed25519"
+          ];
+        in
+        "PubkeyAcceptedKeyTypes ${pubkeyTypes}";
     };
 
     users.users.root.openssh.authorizedKeys.keys = [
-- 
cgit v1.3.1