From 7dea751cbda0e39fc7db60c312e80e2722e161a1 Mon Sep 17 00:00:00 2001
From: Seongmin Lee <git@boltless.me>
Date: Thu, 04 Dec 2025 14:02:57 +0000
Subject: [PATCH] nix/modules/knot: block openssh password authentication

Signed-off-by: Seongmin Lee <git@boltless.me>
---
 nix/modules/knot.nix | 2 ++
 1 file(s) changed, 2 insertion(s)(+), 0 deletion(s)(-)

diff --git a/nix/modules/knot.nix b/nix/modules/knot.nix
--- a/nix/modules/knot.nix
+++ b/nix/modules/knot.nix
@@ -195,6 +195,8 @@
           Match User ${cfg.gitUser}
               AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper
               AuthorizedKeysCommandUser nobody
+              ChallengeResponseAuthentication no
+              PasswordAuthentication no
         '';
       };
 

--
tangled.sh