From b6826c238eeacff7147288a076a98ba138f1f839 Mon Sep 17 00:00:00 2001
From: Guanran Wang <guanran928@outlook.com>
Date: Wed, 5 Jun 2024 17:50:46 +0800
Subject: [PATCH] hosts/blacksteel: use colmena

---
 flake.nix                              |  7 +++++-
 hosts/blacksteel/default.nix           |  2 ++
 nixos/profiles/common/core/default.nix | 32 +++++++++++++++-----------
 3 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/flake.nix b/flake.nix
index 74fffe1..dc24e69 100644
--- a/flake.nix
+++ b/flake.nix
@@ -224,7 +224,12 @@
 
         "lightsail-tokyo" = {
           imports = [./hosts/lightsail-tokyo];
-          deployment.targetHost = "ny4.dev";
+          deployment.targetHost = "tyo0.ny4.dev";
+        };
+
+        "blacksteel" = {
+          imports = [./hosts/blacksteel];
+          deployment.targetHost = "blacksteel"; # thru tailscale
         };
       };
     });
diff --git a/hosts/blacksteel/default.nix b/hosts/blacksteel/default.nix
index 7152e33..0ed5bd7 100644
--- a/hosts/blacksteel/default.nix
+++ b/hosts/blacksteel/default.nix
@@ -23,6 +23,8 @@
   time.timeZone = "Asia/Shanghai";
   system.stateVersion = "23.11";
 
+  services.openssh.settings.PermitRootLogin = "prohibit-password";
+
   ######## Secrets
   sops = {
     secrets = builtins.mapAttrs (_name: value: value // {sopsFile = ./secrets.yaml;}) {
diff --git a/nixos/profiles/common/core/default.nix b/nixos/profiles/common/core/default.nix
index 00fc093..7d8c356 100644
--- a/nixos/profiles/common/core/default.nix
+++ b/nixos/profiles/common/core/default.nix
@@ -73,19 +73,25 @@
       "[    5.996722] amdgpu 0000:67:00.0: Fatal error during GPU init"}
   '';
 
-  users.users."guanranwang" = {
-    isNormalUser = true;
-    description = "Guanran Wang";
-    hashedPasswordFile = config.sops.secrets."hashed-passwd".path;
-    shell = pkgs.fish;
-    extraGroups = [
-      "wheel"
-      "nix-access-tokens"
-    ];
-    openssh.authorizedKeys.keys = [
-      # same as git signing
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMmd/uqiBahzKcKMJ+gT3dkUIdrWQgudspsDchDlx1E/ guanran928@outlook.com"
-    ];
+  users.users = rec {
+    "guanranwang" = {
+      isNormalUser = true;
+      description = "Guanran Wang";
+      hashedPasswordFile = config.sops.secrets."hashed-passwd".path;
+      shell = pkgs.fish;
+      extraGroups = [
+        "wheel"
+        "nix-access-tokens"
+      ];
+      openssh.authorizedKeys.keys = [
+        # same as git signing
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMmd/uqiBahzKcKMJ+gT3dkUIdrWQgudspsDchDlx1E/ guanran928@outlook.com"
+      ];
+    };
+
+    "root" = {
+      openssh.authorizedKeys.keys = guanranwang.openssh.authorizedKeys.keys;
+    };
   };
 
   programs.dconf.enable = true;