From 6ecb08df5f74998a8c41b522af05e88aeb348a09 Mon Sep 17 00:00:00 2001
From: waveringana <ana@nekomimi.pet>
Date: Fri, 16 Oct 2026 18:08:53 -0400
Subject: [PATCH] pia-exit: add sshd over tailnet for management

mirrors okami.mom/nixcfg f28e0ab (niri/pia-exit-sshd), adapted to ark
formatting. sshd + persistent host key + :22 + niri root key.
---
 hosts/valefar/pia-exit.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/hosts/valefar/pia-exit.nix b/hosts/valefar/pia-exit.nix
index 0b21e3a..a1ed245 100644
--- a/hosts/valefar/pia-exit.nix
+++ b/hosts/valefar/pia-exit.nix
@@ -149,6 +149,9 @@ in
           enable = true;
           checkReversePath = "loose";
           allowedUDPPorts = [ 41641 ];
+          # SSH management over the tailnet (niri, 2026-10-16). Guest firewall
+          # default-deny applies; this admits new inbound :22 only.
+          allowedTCPPorts = [ 22 ];
           # Default-deny OUTPUT. Everything leaves through the tunnel, except a
           # narrow control plane so the node can enroll and stay reachable.
           extraCommands = ''
@@ -290,6 +293,16 @@ in
             ip route replace 100.64.0.0/10 dev tailscale0 table main
           '';
         };
+        # SSH for management without nixos-container run (niri, 2026-10-16).
+        # The guest root is ephemeral across container restarts, so host keys
+        # live in the persistent per-container /var/lib instead of /etc/ssh.
+        services.openssh = {
+          enable = true;
+          hostKeys = [ { path = "/var/lib/ssh/pia-exit_ed25519_host_key"; type = "ed25519"; } ];
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ7Y9Je7H3gC72cgdEH4wifUDsmhKMeU5Z4oL1s1WcSE niri@nekomimi.pet"
+        ];
         system.stateVersion = "26.05";
       };
   };
-- 
2.51.2