WIP: SSH configuration restructure

Backup of SSH reorganization changes for future reference.

nixos/common/global/ssh.nix

@@ -1,12 +0,0 @@
-{...}: {
-  services.openssh = {
-    enable = true;
-    settings = {
-      PermitRootLogin = "no";
-      PasswordAuthentication = false;
-      LogLevel = "VERBOSE";
-    };
-    ports = [22];
-    openFirewall = true;
-  };
-}

nixos/common/global/ssh/default.nix

@@ -0,0 +1,43 @@
+{inputs, ...}: {
+  # SSH server configuration
+  services.openssh = {
+    enable = true;
+
+    settings = {
+      PermitRootLogin = "no";           # Disable root login for security
+      PasswordAuthentication = false;   # Require key-based authentication
+      LogLevel = "VERBOSE";             # Enhanced logging for security auditing
+    };
+
+    ports = [22];                       # Standard SSH port
+    openFirewall = true;                # Allow SSH through firewall
+  };
+
+  # Trusted host keys for internal infrastructure
+  programs.ssh.knownHosts = {
+    # Desktop workstation (fuchsia)
+    "fuchsia-ed25519" = {
+      hostNames = ["fuchsia"];
+      publicKeyFile = "${inputs.self}/nixos/fuchsia/ssh_host_ed25519_key.pub";
+    };
+    "fuchsia-rsa" = {
+      hostNames = ["fuchsia"];
+      publicKeyFile = "${inputs.self}/nixos/fuchsia/ssh_host_rsa_key.pub";
+    };
+
+    # Server (viridian)
+    "viridian-ed25519" = {
+      hostNames = ["viridian"];
+      publicKeyFile = "${inputs.self}/nixos/viridian/ssh_host_ed25519_key.pub";
+    };
+    "viridian-rsa" = {
+      hostNames = ["viridian"];
+      publicKeyFile = "${inputs.self}/nixos/viridian/ssh_host_rsa_key.pub";
+    };
+  };
+
+  # External backup provider (BorgBase)
+  programs.ssh.knownHostsFiles = [
+    ./borgbase_hosts
+  ];
+}

nixos/fuchsia/services/borgbackup/offsite.nix

@@ -78,9 +78,4 @@
       monthly = 12;   # Keep 12 monthly backups (1 year)
     };
   };
-
-  # SSH host keys for borgbase.com
-  programs.ssh.knownHostsFiles = [
-    ./borgbase_hosts
-  ];
 }

nixos/fuchsia/services/borgbackup/onsite.nix

@@ -76,9 +76,4 @@ in {
       monthly = 12;
     };
   };
-
-  # SSH host keys for viridian
-  programs.ssh.knownHostsFiles = [
-    ./viridian_hosts
-  ];
 }

nixos/viridian/services/borgbackup/offsite.nix

@@ -81,9 +81,4 @@
       monthly = 12;   # Keep 12 monthly backups (1 year)
     };
   };
-
-  # SSH host keys for borgbase.com
-  programs.ssh.knownHostsFiles = [
-    ./borgbase_hosts
-  ];
 }