---
global:
  nofirewall: true
sysconfig:
  authorized_keys:
    "root@europlan": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExsWcA9hCbKBzc5YizjoMuoBhIvsAdSk7AXmKel9D9/"
    "sernix@it-zone": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMP8SI4rx8SdCJSBA5pIENBPVQIQuAtedRePiJxLwp52"
autorun:
  exec:
    100:
      path: "systemctl"
      parameters:
        - "start"
        - "sshd"
      wait: never
    200:
      path: "mkdir"
      parameters:
        - "-p"
        - "/nixpxe"
      wait: never
    300:
      path: "mount"
      parameters:
        - "/dev/disk/by-partlabel/NIXOS_STORAGE"
        - "/nixpxe"
      wait: never
      on_error: continue
    400:
      path: "rm"
      parameters:
        - "-f"
        - "/etc/ssh/ssh_host_*"
      wait: exit
    401:
      path: "curl"
      parameters:
        - "-o"
        - "/etc/ssh/ssh_host_ed25519_key"
        - "tftp://192.168.2.10/secrets/ssh_host_ed25519_key"
      wait: exit
    402:
      path: "curl"
      parameters:
        - "-o"
        - "/etc/ssh/ssh_host_ed25519_key.pub"
        - "tftp://192.168.2.10/secrets/ssh_host_ed25519_key.pub"
      wait: exit
    403:
      path: "chmod"
      parameters:
        - "600"
        - "/etc/ssh/ssh_host_ed25519_key"
      wait: exit
    404:
      path: "chmod"
      parameters:
        - "644"
        - "/etc/ssh/ssh_host_ed25519_key.pub"
      wait: exit
    410:
      path: "bash"
      parameters:
        - "-c"
        - "printf 'HostKey /etc/ssh/ssh_host_ed25519_key\\nHostKeyAlgorithms ssh-ed25519\\n' > /etc/ssh/sshd_config.d/ed25519-only.conf"
      wait: exit
    500:
      path: "systemctl"
      parameters:
        - "restart"
        - "sshd"
      wait: never
