ssh: require public key authentication

flake.lock

@@ -108,10 +108,10 @@
     },
     "secrets": {
       "locked": {
-        "lastModified": 1769514557,
-        "narHash": "sha256-nJOWEsRw7C2hrrC9xf74oAq3dLJEXq71M2bbdO+DUpw=",
+        "lastModified": 1770625307,
+        "narHash": "sha256-kg3cWWbUBD0wPXR51vxpsRk0rlR4++qjsKELH32M70E=",
         "ref": "refs/heads/main",
-        "rev": "6aa45be13cc08dc2518b6b749df5e81975ed6df4",
+        "rev": "b46d84d1cc5b9fa6d0ca334b9b37a30dabdefec2",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@git.colorsky.fun/Sky/secrets"

host/macmini.nix

@@ -1,5 +1,7 @@
 {
   pkgs,
+  secrets,
+  lib,
   ...
 }:
 
@@ -26,6 +28,9 @@
   i18n.defaultLocale = "en_US.UTF-8";
 
   users.users.sky = {
+    openssh.authorizedKeys.keys = [
+      (lib.readFile secrets.files.keys.nixos-wsl-pub)
+    ];
     isNormalUser = true;
     extraGroups = [ "wheel" ];
     packages = with pkgs; [

modules/system/networking.nix

@@ -1,6 +1,10 @@
 { ... }:
 {
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    settings.KbdInteractiveAuthentication = false;
+  };
 
   networking = {
     hostName = "macmini";