1 files changed, 15 insertions, 54 deletions
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix
index d36df00..63b2034 100644
--- a/os/srv/ssh.nix
+++ b/os/srv/ssh.nix
@@ -10,11 +10,7 @@ let
 in
 {
   options.os.srv.ssh = {
-    server = {
-      enable = lib.mkEnableOption "enables the ssh server module";
-      enableInitrd = lib.mkEnableOption "enables ssh access during initrd";
-      microvm.enable = lib.mkEnableOption "enables ssh for microvms";
-    };
+    server.enable = lib.mkEnableOption "enables the ssh server module";
     client = {
       enable = lib.mkEnableOption "enables the ssh client module";
       createAliases = lib.mkEnableOption "enables system-wide SSH shortcuts";
@@ -32,19 +28,19 @@ in
             addr = "127.0.0.1";
             port = 22;
           }
-          {
-            addr = config.os.core.network.lan.ip;
-            port = 22;
-          }
-          {
-            addr = config.os.core.network.wg.ip;
-            port = 22;
-          }
-          {
-            addr = config.os.core.network.hs.ip;
-            port = 22;
-          }
-        ];
+        ]
+        ++ lib.optional (config.os.core.network ? lan.ip) {
+          addr = config.os.core.network.lan.ip;
+          port = 22;
+        }
+        ++ lib.optional (config.os.core.network ? wg.ip) {
+          addr = config.os.core.network.wg.ip;
+          port = 22;
+        }
+        ++ lib.optional (config.os.core.network ? hs.ip) {
+          addr = config.os.core.network.hs.ip;
+          port = 22;
+        };
         hostKeys = [
           {
             path = "/etc/ssh/ssh_host_ed25519_key";
@@ -54,7 +50,7 @@ in
         settings = {
           PasswordAuthentication = false;
           KbdInteractiveAuthentication = false;
-          PermitRootLogin = if cfg.server.microvm.enable then "prohibit-password" else "no";
+          PermitRootLogin = "no";
 
           PubkeyAcceptedAlgorithms = "ssh-ed25519";
         };
@@ -69,41 +65,6 @@ in
       );
     })
 
-    (lib.mkIf (cfg.server.enable && cfg.server.microvm.enable) {
-      users.users.root.openssh.authorizedKeys.keys = [
-        "${keys.main} adikro@disroot.org"
-      ];
-    })
-
-    (lib.mkIf (cfg.server.enable && cfg.server.enableInitrd) {
-      assertions = [
-        {
-          assertion = config.os.srv.sops.enable;
-          message = "required for storing the ssh key";
-        }
-      ];
-      sops.secrets."initrd_ssh_key" = {
-        path = "/etc/secrets/initrd/ssh_host_ed25519_key";
-      };
-      boot = {
-        initrd = {
-          secrets = {
-            "/etc/secrets/initrd/ssh_host_ed25519_key" = config.sops.secrets.initrd_ssh_key.path;
-          };
-          network = {
-            enable = true;
-            ssh = {
-              enable = true;
-              port = 2222;
-              authorizedKeys = [ "${keys.main}" ];
-              hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
-            };
-          };
-        };
-        kernelParams = [ "ip=dhcp" ];
-      };
-    })
-
     (lib.mkIf cfg.client.enable {
       programs.ssh.startAgent = true;
       services.gnome.gcr-ssh-agent.enable = false;