sys/auth: support root deployment keys

2 files changed, 20 insertions, 8 deletions

diff --git a/sys/auth/openssh.nix b/sys/auth/openssh.nix
index 0c23c81..3bc3a78 100644
--- a/sys/auth/openssh.nix
+++ b/sys/auth/openssh.nix
@@ -18,6 +18,11 @@ in
           default = false;
         };
       }) [ "ecdsa" "ed25519" "rsa" ]);
+
+    withDeployKeys = mkOption {
+      type = types.bool;
+      default = false;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -71,16 +76,22 @@ in
       '';
     };
 
-    users.users.tunnel = mkIf cfg.tunnel.enable {
-      uid = 1100;
-      group = "nogroup";
-      isSystemUser = true;
+    users.users = {
+      root = mkIf cfg.withDeployKeys {
+        openssh.authorizedKeys.keyFiles = [ ./ssh-key.pub ];
+      };
 
-      # Requiere oath
-      password = "tunnel";
+      tunnel = mkIf cfg.tunnel.enable {
+        uid = 1100;
+        group = "nogroup";
+        isSystemUser = true;
 
-      home = "/var/empty";
-      shell = "${pkgs.coreutils}/bin/true";
+        # Requiere oath
+        password = "tunnel";
+
+        home = "/var/empty";
+        shell = "${pkgs.coreutils}/bin/true";
+      };
     };
   };
 }
diff --git a/sys/auth/ssh-key.pub b/sys/auth/ssh-key.pub
new file mode 100644
index 0000000..1bb3788
--- /dev/null
+++ b/sys/auth/ssh-key.pub
@@ -0,0 +1 @@
+# This file has been lustrated.