From 2be6ce2ef9ab45333fc67f5b685451c2f37b56da Mon Sep 17 00:00:00 2001
From: Paul Zinselmeyer <info@pfzetto.de>
Date: Wed, 28 Aug 2024 11:43:25 +0200
Subject: [PATCH] ssh + root password change

---
 stube-pc/system.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/stube-pc/system.nix b/stube-pc/system.nix
index 87ddf5d..09e94fd 100644
--- a/stube-pc/system.nix
+++ b/stube-pc/system.nix
@@ -17,7 +17,10 @@
   time.timeZone = "Europe/Berlin";
 
   users.mutableUsers = false;
-  users.users.root.password = "start1234";
+  users.users.root = {
+    hashedPassword = "$y$j9T$0pAghPO9710DDgMEznC/I0$S2cMkfV2NpytDAk58oV75pT0G1Lnq/T3BAiO9gXeuOB";
+    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDbsWgnT1W25H5fDCekspaXzlIwvKh+rHygTId8xHotU" ];
+  };
   users.users.stube = {
     isNormalUser = true;
     extraGroups = [ "networkmanager" ];
@@ -84,5 +87,11 @@
 
   security.polkit.enable = true;
 
+  services.openssh = {
+    enable = true;
+    openFirewall = true;
+    settings.PermitRootLogin = "prohibit-password";
+  };
+
   system.stateVersion = "24.05";
 }