From deae5d223a5197d9c44f9ae032f571b40f2af760 Mon Sep 17 00:00:00 2001
From: John Lancaster <32917998+jsl12@users.noreply.github.com>
Date: Sat, 4 Jul 2026 22:25:28 -0500
Subject: [PATCH] ssh fallback keys during bootstrap

---
 modules/services/ssh.nix | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/modules/services/ssh.nix b/modules/services/ssh.nix
index f814fec..94b7f96 100644
--- a/modules/services/ssh.nix
+++ b/modules/services/ssh.nix
@@ -17,6 +17,32 @@ in
         type = lib.types.str;
         default = "ssh_host_ed25519_key";
       };
+      hostKeyType = lib.mkOption {
+        description = "OpenSSH host key type for ssh.hostKey.";
+        type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
+        default = "ed25519";
+      };
+      fallbackHostKeys = lib.mkOption {
+        description = "Additional non-certificate host keys that keep sshd reachable during certificate bootstrap.";
+        type = with lib.types; listOf (submodule {
+          options = {
+            path = lib.mkOption {
+              description = "Path to the host private key file.";
+              type = str;
+            };
+            type = lib.mkOption {
+              description = "OpenSSH host key type.";
+              type = enum [ "ed25519" "rsa" "ecdsa" ];
+            };
+          };
+        });
+        default = [
+          {
+            path = "${configDir}/ssh_host_rsa_key";
+            type = "rsa";
+          }
+        ];
+      };
       certificates = {
         enable = lib.mkEnableOption "Enable SSH host certificates";
         userCA = lib.mkOption {
@@ -35,12 +61,17 @@ in
     config = {
       services.openssh = {
         enable = true;
+        hostKeys = cfg.fallbackHostKeys ++ [
+          {
+            path = "${configDir}/${cfg.hostKey}";
+            type = cfg.hostKeyType;
+          }
+        ];
         # require public key authentication for better security
         settings = lib.mkMerge [
           {
             PasswordAuthentication = false;
             KbdInteractiveAuthentication = false;
-            HostKey = "${configDir}/${cfg.hostKey}";
           }
           (lib.mkIf cfg.certificates.enable {
             TrustedUserCAKeys = "${configDir}/${cfg.certificates.userCAFile}";