treewide: separate ssh keys

nixos/common.nix

@@ -21,6 +21,7 @@ in
     ./hardware.nix
     ./impermanence.nix
     ./modules
+    ./openssh.nix
     ./programs.nix
     ./users.nix
     ./vm.nix
@@ -100,19 +101,6 @@ in
     };
   };
 
-  services = {
-    openssh = {
-      enable = true;
-
-      settings = {
-        ClientAliveInterval = 300;
-        KbdInteractiveAuthentication = false;
-        PasswordAuthentication = false;
-        PermitRootLogin = "no";
-      };
-    };
-  };
-
   virtualisation.podman.enable = true;
 
   zramSwap = {

nixos/openssh.nix

@@ -0,0 +1,17 @@
+{ self, ... }:
+{
+  services.openssh = {
+    enable = true;
+
+    settings = {
+      ClientAliveInterval = 300;
+      KbdInteractiveAuthentication = false;
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = builtins.attrValues {
+    inherit (import "${self}/lib/ssh/keys.nix") error javalsai;
+  };
+}

nixos/users.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, self, ... }:
 let
   users = [
     {
@@ -32,6 +32,15 @@ let
       isNormalUser = true;
       extraGroups = lib.optionals (options.admin or false) adminGroups;
       inherit uid;
+
+      openssh.authorizedKeys.keys =
+        let
+          keys = import "${self}/lib/ssh/keys.nix";
+        in
+        if (builtins.hasAttr name keys) then
+          [ keys.${name} ]
+        else
+          lib.warn "user ${name} declared without ssh key" [ ];
     };
 
     systemd.slices."user-${builtins.toString uid}".sliceConfig = {