feat: new deploy system, allows for in-repo pii

modules/nixos/common/home-manager.nix

@@ -6,6 +6,14 @@
     home-manager = lib.mkIf config.swarselsystems.withHomeManager {
       useGlobalPkgs = true;
       useUserPackages = true;
+      verbose = true;
+      sharedModules = [
+        inputs.nix-index-database.hmModules.nix-index
+        inputs.sops-nix.homeManagerModules.sops
+        {
+          home.stateVersion = lib.mkDefault config.system.stateVersion;
+        }
+      ];
       extraSpecialArgs = { inherit (inputs) self; };
     };
   };

modules/nixos/common/lanzaboote.nix

@@ -10,7 +10,7 @@
       lanzaboote = lib.mkIf (!config.swarselsystems.initialSetup && config.swarselsystems.isSecureBoot) {
         enable = true;
         pkiBundle = "/var/lib/sbctl";
-        configurationLimit = 3;
+        configurationLimit = 6;
       };
     };
   };

modules/nixos/server/packages.nix

@@ -5,6 +5,7 @@
     environment.systemPackages = with pkgs; [
       gnupg
       nix-index
+      nvd
       ssh-to-age
       git
       emacs

modules/nixos/server/ssh.nix

@@ -4,6 +4,18 @@
   config = lib.mkIf config.swarselsystems.modules.server.ssh {
     services.openssh = {
       enable = true;
+      startWhenNeeded = lib.mkForce false;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "yes";
+      };
+      hostKeys = [
+        {
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          type = "ed25519";
+        }
+      ];
     };
     users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
       (self + /secrets/keys/ssh/yubikey.pub)