From bf260096d5474aaab7268d6b098ecfc1ab37b33f Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Mon, 7 Jul 2025 18:18:57 +0800
Subject: [PATCH 1/2] refactor(nixos/ssh): add authorizedKeys to ssh module &
 rm from users

---
 nix/modules/ssh.nix   | 26 ++++++++++++++++++--------
 nix/modules/users.nix |  3 ---
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/nix/modules/ssh.nix b/nix/modules/ssh.nix
index 4c8fde2..1adf4bc 100644
--- a/nix/modules/ssh.nix
+++ b/nix/modules/ssh.nix
@@ -1,10 +1,20 @@
+{ config, lib, ... }:
+let
+  cfg = config.flake;
+  inherit (lib.modules) mkMerge;
+  inherit (cfg.lib.modules) forAllUsers';
+in
 {
-  flake.modules.nixos.default = {
-    persistFiles = [
-      "/etc/ssh/ssh_host_ed25519_key"
-      "/etc/ssh/ssh_host_ed25519_key.pub"
-      "/etc/ssh/ssh_host_rsa_key"
-      "/etc/ssh/ssh_host_rsa_key.pub"
-    ];
-  };
+  flake.modules.nixos.default = mkMerge [
+    {
+      persistFiles = [
+        "/etc/ssh/ssh_host_ed25519_key"
+        "/etc/ssh/ssh_host_ed25519_key.pub"
+        "/etc/ssh/ssh_host_rsa_key"
+        "/etc/ssh/ssh_host_rsa_key.pub"
+      ];
+      users.users = forAllUsers' (_: value: { openssh.authorizedKeys.keys = [ value.pubkey ]; });
+    }
+    { users.users.root.openssh.authorizedKeys.keys = [ cfg.admin.pubkey ]; }
+  ];
 }
diff --git a/nix/modules/users.nix b/nix/modules/users.nix
index 2c1a5c9..b9ab8f7 100644
--- a/nix/modules/users.nix
+++ b/nix/modules/users.nix
@@ -11,8 +11,6 @@ in
       #TODO: move sudo/security options elsewhere
       # security.sudo.wheelNeedsPassword = false;
       # nix.settings.trusted-users = [ "@wheel" ];
-      #TODO: move ssh key settings elsewhere
-      # users.users.root.openssh.authorizedKeys.keys = [ owner.pubkey ];
       # persist uids and gids
       persistDirs = [ "/var/lib/nixos" ];
       users = {
@@ -23,7 +21,6 @@ in
             isNormalUser = true;
             hashedPasswordFile = config.sops.secrets."${name}/hashedPassword".path;
             extraGroups = optional (value.primary or false) "wheel";
-            openssh.authorizedKeys.keys = [ value.pubkey ];
           }
         );
       };

From 1fe332c30221702127a784afe4f89d8a34c18f49 Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Mon, 7 Jul 2025 18:25:43 +0800
Subject: [PATCH 2/2] feat(nix/persist): add impermanence to home-manager

---
 nix/modules/options/persist.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nix/modules/options/persist.nix b/nix/modules/options/persist.nix
index 2ce1993..4e298c0 100644
--- a/nix/modules/options/persist.nix
+++ b/nix/modules/options/persist.nix
@@ -48,4 +48,16 @@ in
         };
       };
     };
+  flake.modules.homeManager.default =
+    { config, ... }:
+    {
+      imports = [ inputs.impermanence.homeManagerModules.impermanence ];
+      options.persistDirs = mkOpts "directory" { };
+      options.persistFiles = mkOpts "file" { };
+      config.home.persistence."/persist${config.home.homeDirectory}" = {
+        allowOther = true;
+        directories = config.persistDirs;
+        files = config.persistFiles;
+      };
+    };
 }