modules/nixos/ssh.nix

@@ -9,14 +9,10 @@ in
     enable = mkEnableOption "ssh";
   };
   config = mkIf cfg.enable {
-    services.openssh = {
+    services.openssh.enable = true;
-      enable = true;
+    # TODO: Is this default configuration secure?
-      settings = {
+
-        PasswordAuthentication = false;
+    services.openssh.hostKeys = mkIf (config.modules.impermanence.enable) [
-        KbdInteractiveAuthentication = false;
-        PermitRootLogin = "no";
-      };
-      hostKeys = mkIf (config.modules.impermanence.enable) [
       {
         type = "ed25519";
         path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
@@ -28,5 +24,4 @@ in
       }
     ];
   };
-  };
 }

profiles/nixos/vm.nix

@@ -33,8 +33,7 @@ in
     };
 
     # Local user
-    modules.secrets.secrets."ssh-keys/admin-pub" = { };
+    sops.secrets."ssh-keys/admin-pub" = { };
-    modules.secrets.secrets."passwords/local-hashed".neededForUsers = true;
     services.getty.autologinUser = "local";
     security.sudo.extraRules = [
       {
@@ -44,7 +43,6 @@ in
     ];
     users.mutableUsers = false;
     users.users.local = {
-      hashedPasswordFile = config.sops.secrets."passwords/local-hashed".path;
       extraGroups = [ "wheel" ];
       openssh.authorizedKeys.keyFiles = [
         config.sops.secrets."ssh-keys/admin-pub".path