feat(ssh): initial ssh config

system/modules/default.nix

@@ -14,6 +14,7 @@
     ./pipewire.nix
     ./security.nix
     ./services
+    ./ssh.nix
   ];
 
 

system/modules/networking.nix

@@ -13,10 +13,6 @@ in
     networking.firewall.allowedTCPPorts = [57621]; # Spotify
 
     services = {
-      openssh = {
-        enable = true;
-        settings.UseDns = true;
-      };
       resolved.enable = true;
     };
 

system/modules/ssh.nix

@@ -0,0 +1,32 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.systemModules.openssh;
+  key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBn3ff3HaZHIyH4K13k8Mwqu/o7jIABJ8rANK+r2PfJk";
+in
+
+{
+  options.systemModules = {
+    openssh = {
+      enable = lib.mkEnableOption "enable openssh system module";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.sessionVariables.SSH_AUTH_SOCK = "~/.1password/agent.sock";
+
+    users.users.ooks.openssh.authorizedKeys.keys = [ key ];
+
+    services.openssh = {
+      enable = true;
+      settings = {
+        UseDns = true;
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        StreamLocalBindUnlink = "yes";
+      };
+    };
+    
+  };
+  
+}

system/profiles/base/default.nix

@@ -21,6 +21,7 @@ in
       bootloader.systemd.enable = true;
       programs.gnomeServices.enable = true;
       displayManager.tuigreet.enable = true;
+      openssh.enable = true;
     };
 
     environment.systemPackages = [pkgs.git];