From 9a85dc9c31a10eaf0640d228230e9f2de79238b4 Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Thu, 24 Sep 2026 18:40:08 +0200
Subject: ...

---
 accounts/gkleen@skadhi/default.nix     |  2 +-
 accounts/gkleen@skadhi/ssh/default.nix | 26 ++++++++++++++++++++++++++
 system-profiles/openssh/default.nix    |  4 ++++
 user-profiles/core.nix                 |  9 +++++++--
 4 files changed, 38 insertions(+), 3 deletions(-)
 create mode 100644 accounts/gkleen@skadhi/ssh/default.nix

diff --git a/accounts/gkleen@skadhi/default.nix b/accounts/gkleen@skadhi/default.nix
index 80efa8d8..352a52d2 100644
--- a/accounts/gkleen@skadhi/default.nix
+++ b/accounts/gkleen@skadhi/default.nix
@@ -56,7 +56,7 @@ in {
     home-manager.users.${userName} = { sysConfig, config, ... }: {
       imports = [
         flakeInputs.nix-index-database.homeModules.nix-index
-        ./niri.nix ./shell ./emacs ./zsh
+        ./niri.nix ./shell ./emacs ./zsh ./ssh
       ];
 
       home.stateVersion = "26.05";
diff --git a/accounts/gkleen@skadhi/ssh/default.nix b/accounts/gkleen@skadhi/ssh/default.nix
new file mode 100644
index 00000000..93e4bdfa
--- /dev/null
+++ b/accounts/gkleen@skadhi/ssh/default.nix
@@ -0,0 +1,26 @@
+{ ... }:
+{
+  config = {
+    programs.ssh.matchBlocks = {
+      "surtr" = {
+        hostname = "surtr.yggdrasil";
+        identityFile = "~/.ssh/gkleen@skadhi.yggdrasil";
+      };
+      "surtr.yggdrasil.li" = {
+        identityFile = "~/.ssh/gkleen@skadhi.yggdrasil";
+      };
+      "sif" = {
+        hostname = "sif.yggdrasil";
+        identityFile = "~/.ssh/gkleen@skadhi.yggdrasil";
+      };
+      "vidhar" = {
+        hostname = "vidhar.yggdrasil";
+        identityFile = "~/.ssh/gkleen@skadhi.yggdrasil";
+      };
+      "ymir" = {
+        hostname = "ymir.yggdrasil.li";
+        identityFile = "~/.ssh/gkleen@skadhi.yggdrasil";
+      };
+    };
+  };
+}
diff --git a/system-profiles/openssh/default.nix b/system-profiles/openssh/default.nix
index e60e72d9..774c2f20 100644
--- a/system-profiles/openssh/default.nix
+++ b/system-profiles/openssh/default.nix
@@ -66,11 +66,15 @@ in {
     services.openssh = mkIf cfg.enable {
       startWhenNeeded = true;
       hostKeys = mkIf cfg.staticHostKeys (mkForce []); # done manually
+      authorizedKeysInHomedir = mkDefault false;
       settings = {
         inherit Ciphers Macs KexAlgorithms;
         HostKeyAlgorithms = concatStringsSep "," HostKeyAlgorithms;
         PubkeyAcceptedAlgorithms = concatStringsSep "," PubkeyAcceptedAlgorithms;
         CASignatureAlgorithms = concatStringsSep "," CASignatureAlgorithms;
+        TrustedUserCAKeys = toString (pkgs.writeText "trusted_user_ca_keys" ''
+          ${builtins.readFile ./ca/ca.pub}
+        '');
 
         LogLevel = "VERBOSE";
         RevokedKeys = toString ./ca/krl.bin;
diff --git a/user-profiles/core.nix b/user-profiles/core.nix
index 7034f17e..8b8da681 100644
--- a/user-profiles/core.nix
+++ b/user-profiles/core.nix
@@ -1,10 +1,15 @@
-{ flake, flakeInputs, sources, path, userName, config, lib, utils, ... }:
+{ flake, flakeInputs, sources, path, userName, hostName, config, lib, utils, ... }:
 
 with lib;
 
 {
   config = {
-    users.users.${userName} = {}; # Just make sure the user is created
+    users.users.${userName} = { # Make sure the user is created
+      openssh.authorizedPrincipals = [
+        "${userName}@${hostName}"
+        "${userName}@*"
+      ];
+    };
     home-manager.users.${userName} = let sysConfig = config; in { config, ... }: {
       config._module.args = {
         inherit sysConfig flake flakeInputs sources;
-- 
cgit v1.2.3