{ outputs, lib, config, ... }:

let
  inherit (config.networking) hostName;
  hosts = outputs.nixosConfigurations;
  #pubKey = host: ../../${host}/ssh_host_ed25519_key.pub;
  #gitHost = hosts."alcyone".config.networking.hostName;

  # Sops needs acess to the keys before the persist dirs are even mounted; so
  # just persisting the keys won't work, we must point at /persist
  #hasOptinPersistence = config.environment.persistence ? "/persist";
in
{
  services.openssh = {
    enable = true;
    #settings = {
      # Harden
    #  PasswordAuthentication = false;
    #  PermitRootLogin = "no";
      # Automatically remove stale sockets
      # StreamLocalBindUnlink = "yes";
      # Allow forwarding ports to everywhere
      #GatewayPorts = "clientspecified";
    };

    #hostKeys = [{
    #  path = "${lib.optionalString hasOptinPersistence "/persist"}/etc/ssh/ssh_host_ed25519_key";
     # type = "ed25519";
    #}];
  #};

#  programs.ssh = {
    # Each hosts public key
#    knownHosts = builtins.mapAttrs
#      (name: _: {
#        publicKeyFile = pubKey name;
#        extraHostNames =
#          (lib.optional (name == hostName) "localhost"); #++ # Alias for localhost if it's the same host
#	  })
#      hosts;
#  };

  # Passwordless sudo when SSH'ing with keys
#  security.pam.enableSSHAgentAuth = true;
}
