From e5b58133c49d7c99f96de9f2354cd3f10ecbbf60 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Sat, 24 Jan 2026 18:30:10 -0600
Subject: more ssh config

---
 flake.nix                                   |  5 ++---
 modules/services/nixos/selfhost/forgejo.nix |  4 ++--
 modules/services/nixos/ssh.nix              | 11 ++++-------
 3 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/flake.nix b/flake.nix
index 14af52d..31d663c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -77,10 +77,9 @@
       hostname = "mercury";
     };
 
-    deploy.nodes."ganymede" = {
-      hostname = "ganymede";
+    deploy.nodes."ganymede-deploy" = {
+      hostname = "ganymede-deploy";
       sshUser = "root";
-      sshOpts = ["-o" "RequestTTY=force"];
 
       profiles.system = {
         user = "root";
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
index 4571dca..1b02628 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/selfhost/forgejo.nix
@@ -19,9 +19,9 @@ in
           START_SSH_SERVER = true; # use builtin ssh server
           BUILTIN_SSH_SERVER_USER = "git";
           SSH_DOMAIN = "ganymede";
-          SSH_PORT = 2222; # don't conflict with system ssh
+          SSH_PORT = 2225; # don't conflict with system ssh
           SSH_LISTEN_HOST = cfg.bind_host;
-          SSH_LISTEN_PORT = 2222;
+          SSH_LISTEN_PORT = 2225;
         };
         service = {
           DISABLE_REGISTRATION = false;
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index 76b0d87..23f8fc5 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -73,13 +73,10 @@ in {
       |> (builtins.filter (x: x != null));
 
     users.users."root".openssh.authorizedKeys.keys =
-      if config.services.openssh.settings.PermitRootLogin == "prohibit-password"
-      then
-        hosts
-        |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
-        |> builtins.attrValues
-        |> (builtins.filter (x: x != null))
-      else {};
+      hosts
+      |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
+      |> builtins.attrValues
+      |> (builtins.filter (x: x != null)); # only possible over home network (:2222)
 
     systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
       after = lib.mkAfter ["network-online.target"];
-- 
cgit v1.3.1