NixOS SSH configuration

{
  pkgs,
  config,
  lib,
  ...
}:
let
  cfg = config.mjm.ssh;
in
{
  imports = [ ../common/ssh.nix ];

  config = lib.mkIf cfg.enable {
    <<config>>
  };

  _class = "nixos";
}

This module extends the common SSH module for all machines (not just NixOS):

=> common/ssh

services.openssh = {
  enable = true;
  extraConfig = ''
    TrustedUserCAKeys ${cfg.trustedKeys}
  '';
};

The SSH server is enabled by default on all of my machines. They are also configured to trust clients with certificates signed by my Vault server. This makes it possible for me to use SSH keys to log in to any of my NixOS machines without needing to maintain or set up an authorized keys file.

environment.systemPackages = [
  pkgs.ghostty.terminfo
];

I use Ghostty as my terminal, and it runs with TERM=xterm-ghostty. This variable carries over to SSH connections, which misbehaves if the remote machine doesn't have the terminfo for Ghostty. For this reason, I install the terminfo on all of my machines that have SSH enabled.

An alternative would be to set TERM=xterm or something when calling SSH, but I think that would cause a degradation in features for Ghostty. Since I manage most of the servers I'm logging in to, I prefer just making sure the terminfo is there.