feat(users): define authorized SSH keys

users/Sk7Str1p3/about.json

@@ -3,16 +3,19 @@
   "shell": "nushell",
   "realName": "ENC[AES256_GCM,data:KBIRbQWsz6n1nAZ2rtGfCdSoQiTrRchpqA==,iv:mD0Rx4GHSJcQhPCa4fxZgYgqYkwzaRQVe50I+bgML04=,tag:ZcrOoRAVOoUKPktL5Dpi/g==,type:str]",
   "session": "co:niri",
+  "sshKeys": [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNa67UTAxxZX4/PJxe/Fx3K0VOiY36ipUcLrDrDaOuj Sk7Str1p3@fennecBox"
+  ],
   "sops": {
     "age": [
       {
-        "recipient": "age180qx2rwyelak4wtdljcy9eqxkskfcfk4fvq26nuqqz8rtjdyyyzqlr8dt8",
-        "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Skp6cGdweFBaZUM2eXRC\nTHExSmtCZU53OXZWZDl3VFFMb1FSdFhkaUhnCnhiSUNQSkZZQ2htTTVxd1Nleitq\nSVV4WmFrdXNUVVU5L0RONHpMUlB2UDgKLS0tIE9UTC9qeEQ0MFlSUFhwdW9NeXYw\nelVGZ0ZYUzFoVXdibmpjTyt1ZHYxaTgKnD3m3Ceq0OT27s2OAWF+gLh5f6Xv3cpp\n28Q3JLG+FpYlBaszOdsWInouCf50tYItWHhQU3gmkhrJsA9gljOAOw==\n-----END AGE ENCRYPTED FILE-----\n"
+        "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Skp6cGdweFBaZUM2eXRC\nTHExSmtCZU53OXZWZDl3VFFMb1FSdFhkaUhnCnhiSUNQSkZZQ2htTTVxd1Nleitq\nSVV4WmFrdXNUVVU5L0RONHpMUlB2UDgKLS0tIE9UTC9qeEQ0MFlSUFhwdW9NeXYw\nelVGZ0ZYUzFoVXdibmpjTyt1ZHYxaTgKnD3m3Ceq0OT27s2OAWF+gLh5f6Xv3cpp\n28Q3JLG+FpYlBaszOdsWInouCf50tYItWHhQU3gmkhrJsA9gljOAOw==\n-----END AGE ENCRYPTED FILE-----\n",
+        "recipient": "age180qx2rwyelak4wtdljcy9eqxkskfcfk4fvq26nuqqz8rtjdyyyzqlr8dt8"
       }
     ],
-    "lastmodified": "2026-05-07T15:31:42Z",
-    "mac": "ENC[AES256_GCM,data:ouXlr7xwQj05RtKc1VKByybKSuXtLk9UXxnE7JSofmVdXzPc7k4atejrWyrWa6weJonpPMldnuyXBiy2RzIHLF8nyvbyCik8o5r4pJ7LlgCHvxM5B2itN/nWCR8Ave9ijBrMk1HQLE4wodUstehnigwkmfMn6phsQEnWY9vYV2c=,iv:vX1/zN+RUDvJnrnMC/KFDKRkWJdFNd12MdH32Y4nNlY=,tag:3aP34p6oaAX8luIUc7eilA==,type:str]",
     "encrypted_regex": "^realName$",
-    "version": "3.12.1"
+    "lastmodified": "2026-07-25T16:54:28Z",
+    "mac": "ENC[AES256_GCM,data:UVScJ6TQNn80U8wWRq5c11r5JmyQu4VjzOrzhFp04nvD3uWORLmbDBi+kO1kblayE7uyxyIvsc4nZpr5KNKxZgQQvkcTQU+5hE8HzdIxVEeUS0tzgmcThQjCpzkJhvEfT1OvagKnQG2BVnxyQ1SJs1Aiq69IshjN837UF8xv94k=,iv:xUJ4KsZJ+m4s6xdGtI8goACrGKL49X3EoSOZ0wifTqs=,tag:NakmTNkskqnkD5Vsgwm8VQ==,type:str]",
+    "version": "3.13.2"
   }
 }

users/default.nix

@@ -8,6 +8,7 @@
   - `extraGroups`: groups (optionally)
   - `shell`: User's shell
   - `session`: User's default graphical session (optionally)
+  - `sshKeys`: User's authorized SSH keys (optionally)
 
   Session must have format of "{type}:{session}" where type is one of `co` (short for "compositor") and `de` (short for "desktop environment").
   This `type` is actually important, because it depends where nix will search corresponding option for enabling your session.
@@ -64,6 +65,7 @@ lib.foldl' (acc: obj: lib.recursiveUpdate acc obj) { } (
           isNormalUser = true;
           shell = pkgs."${cfg.shell}";
           extraGroups = cfg.extraGroups or [ ];
+          openssh.authorizedKeys.keys = cfg.sshKeys or [ ];
         };
     }) cfg.usersList)