Commit ad2edb8adff1

Vincent Demeester <vincent@sbr.pm>
2026-07-29 14:12:37
fix(ssh): copy authorized_keys instead of symlinking
sshd StrictModes rejects the home-manager symlink to the Nix store. Use home.activation with install -m 600 to copy the file with correct permissions.
main
1 parent 7a25605
Changed files (1)
home
common
shell
openssh.nix
home/common/shell/openssh.nix
@@ -363,10 +363,16 @@ in
     '';
   };
   # Fedora hosts have no NixOS openssh.authorizedKeys; manage via home-manager.
-  home.file.".ssh/authorized_keys" = lib.mkIf (isAomi || isKyushu) {
-    text =
-      lib.concatStringsSep "\n" (libx.authorizedKeysFor globals.ssh.vincent hostname "vincent") + "\n";
-  };
+  # Can't use home.file because sshd rejects symlinks to the Nix store (StrictModes).
+  home.activation.authorizedKeys = lib.mkIf (isAomi || isKyushu) (
+    lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+      install -m 600 ${
+        pkgs.writeText "authorized_keys" (
+          lib.concatStringsSep "\n" (libx.authorizedKeysFor globals.ssh.vincent hostname "vincent") + "\n"
+        )
+      } "$HOME/.ssh/authorized_keys"
+    ''
+  );
   home.file.".ssh/ssh_known_hosts".text = libx.sshKnownHosts globals.machines;
   home.file.".ssh/ssh_known_hosts.redhat".text = ''
     # Red Hat