{ config, lib, pkgs, ... }:
let
  cfg = config.os.core.ssh;
in
{
  options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup";
  config = lib.mkIf cfg.enable {
    services.tailscale.enable = true;

    services.openssh = {
      enable = true;
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
    };

    programs.gnupg.agent = {
      enable = true;
      enableSSHSupport = true;
      pinentryPackage = pkgs.pinentry-curses;
    };

    networking.firewall = {
      trustedInterfaces = [ "tailscale0" ];
      allowedUDPPorts = [ 41641 ];
    };
  };
}