Server/ssh: add ssh host key

flake.lock

@@ -377,11 +377,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1713107869,
-        "narHash": "sha256-TniJoCQfJ3OXrcqhH/8xcV6o4Sa5C/4KSRtk0c0/RK4=",
+        "lastModified": 1713776544,
+        "narHash": "sha256-EQW8P1TfkYQV0EEK1n3Gh9wRp9KlC0EbidH2j+niCaE=",
         "ref": "refs/heads/main",
-        "rev": "a00a07cd931b6eab722727a0606837cb895997f0",
-        "revCount": 11,
+        "rev": "61410d68f15b3b970067a3fdd39667fdd9a89edd",
+        "revCount": 12,
         "type": "git",
         "url": "ssh://forgejo@git.everest.sable-pancake.ts.net:4222/Toast/nix-secrets"
       },

roles/server/ssh.nix

@@ -1,10 +1,37 @@
-{...}: {
+{
+  flakeSelf,
+  config,
+  ...
+}: let
+  hostSecrets = "${flakeSelf.inputs.secrets}/" + config.networking.hostName + "/";
+  hostKeyPath = "/etc/ssh/everest_host_key";
+in {
+  age.secrets = {
+    everest-host-key = {
+      file = hostSecrets + "host-private-key.age";
+      path = hostKeyPath;
+      mode = "0400";
+    };
+    "everest-host-key.pub" = {
+      file = hostSecrets + "host-public-key.age";
+      path = hostKeyPath + ".pub";
+    };
+  };
+
   services.openssh = {
     enable = true;
     settings = {
+      UseDns = true;
       PermitRootLogin = "no";
       PasswordAuthentication = false;
     };
+    hostKeys = [
+      {
+        path = hostKeyPath;
+        type = "ed25519";
+        comment = "Everest host key";
+      }
+    ];
     startWhenNeeded = true;
   };
 }