From 9a85dc9c31a10eaf0640d228230e9f2de79238b4 Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Thu, 24 Sep 2026 18:40:08 +0200
Subject: ...

---
 system-profiles/openssh/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'system-profiles/openssh/default.nix')

diff --git a/system-profiles/openssh/default.nix b/system-profiles/openssh/default.nix
index e60e72d9..774c2f20 100644
--- a/system-profiles/openssh/default.nix
+++ b/system-profiles/openssh/default.nix
@@ -66,11 +66,15 @@ in {
     services.openssh = mkIf cfg.enable {
       startWhenNeeded = true;
       hostKeys = mkIf cfg.staticHostKeys (mkForce []); # done manually
+      authorizedKeysInHomedir = mkDefault false;
       settings = {
         inherit Ciphers Macs KexAlgorithms;
         HostKeyAlgorithms = concatStringsSep "," HostKeyAlgorithms;
         PubkeyAcceptedAlgorithms = concatStringsSep "," PubkeyAcceptedAlgorithms;
         CASignatureAlgorithms = concatStringsSep "," CASignatureAlgorithms;
+        TrustedUserCAKeys = toString (pkgs.writeText "trusted_user_ca_keys" ''
+          ${builtins.readFile ./ca/ca.pub}
+        '');
 
         LogLevel = "VERBOSE";
         RevokedKeys = toString ./ca/krl.bin;
-- 
cgit v1.2.3