ssh

2 files changed, 7 insertions, 17 deletions

diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index 4a412b4..e44e4a8 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -9,11 +9,6 @@
       };
 
       "caddy-env".file = ./caddy-env.age;
-
-      "wg-key" = {
-        file = ./ganymede-wg-key.age;
-        owner = "systemd-network";
-      };
     };
 
     terminal = {
@@ -40,10 +35,6 @@
             gateway = "192.168.50.1";
           };
         };
-        # tailscale = {
-        #   enable = true;
-        #   tailnet = "collinux.tailnet";
-        # };
         sshd = {
           enable = true;
           bind_host = "0.0.0.0";
@@ -61,12 +52,6 @@
           bind_host = "127.0.0.1";
           root_url = "ganymede.collinux.tailnet:8010";
         };
-
-        # headscale = {
-        #   enable = true;
-        #   root_url = "headscale.williamsfam.us.com";
-        #   caddy.enable = true;
-        # };
       };
     };
   };
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index cfe7883..7868a31 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -8,7 +8,6 @@ in {
   config = lib.mkIf cfg.enable {
     services.openssh = {
       enable = true;
-      openFirewall = false;
       hostKeys = [
         {
           path = "/etc/ssh/ssh_host_ed25519_key";
@@ -24,9 +23,15 @@ in {
       ];
 
       settings = {
-        PermitRootLogin = "prohibit-password";
+        PermitRootLogin = "prohibit-password"; # deploy-rs uses root account
         PasswordAuthentication = false;
       };
+
+      knownHosts = {
+        "mercury".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN";
+        "jupiter".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8";
+        "ganymede".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9";
+      };
     };
 
     systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {