feat: new deploy system, allows for in-repo pii

modules/nixos/server/packages.nix

@@ -5,6 +5,7 @@
     environment.systemPackages = with pkgs; [
       gnupg
       nix-index
+      nvd
       ssh-to-age
       git
       emacs

modules/nixos/server/ssh.nix

@@ -4,6 +4,18 @@
   config = lib.mkIf config.swarselsystems.modules.server.ssh {
     services.openssh = {
       enable = true;
+      startWhenNeeded = lib.mkForce false;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "yes";
+      };
+      hostKeys = [
+        {
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          type = "ed25519";
+        }
+      ];
     };
     users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
       (self + /secrets/keys/ssh/yubikey.pub)