ssh fallback keys during bootstrap

modules/services/ssh.nix

@@ -17,6 +17,32 @@ in
         type = lib.types.str;
         default = "ssh_host_ed25519_key";
       };
+      hostKeyType = lib.mkOption {
+        description = "OpenSSH host key type for ssh.hostKey.";
+        type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
+        default = "ed25519";
+      };
+      fallbackHostKeys = lib.mkOption {
+        description = "Additional non-certificate host keys that keep sshd reachable during certificate bootstrap.";
+        type = with lib.types; listOf (submodule {
+          options = {
+            path = lib.mkOption {
+              description = "Path to the host private key file.";
+              type = str;
+            };
+            type = lib.mkOption {
+              description = "OpenSSH host key type.";
+              type = enum [ "ed25519" "rsa" "ecdsa" ];
+            };
+          };
+        });
+        default = [
+          {
+            path = "${configDir}/ssh_host_rsa_key";
+            type = "rsa";
+          }
+        ];
+      };
       certificates = {
         enable = lib.mkEnableOption "Enable SSH host certificates";
         userCA = lib.mkOption {
@@ -35,12 +61,17 @@ in
     config = {
       services.openssh = {
         enable = true;
+        hostKeys = cfg.fallbackHostKeys ++ [
+          {
+            path = "${configDir}/${cfg.hostKey}";
+            type = cfg.hostKeyType;
+          }
+        ];
         # require public key authentication for better security
         settings = lib.mkMerge [
           {
             PasswordAuthentication = false;
             KbdInteractiveAuthentication = false;
-            HostKey = "${configDir}/${cfg.hostKey}";
           }
           (lib.mkIf cfg.certificates.enable {
             TrustedUserCAKeys = "${configDir}/${cfg.certificates.userCAFile}";