From 1b682b430f2e7bd3de25ad111d0c4979f46d8688 Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Wed, 7 Oct 2026 20:10:44 -0400
Subject: [PATCH] fix(nixos): scope SSH lint suppressions

---
 configs/nixos/modules/network/ssh.nix | 142 ++++++++++++--------------
 1 file changed, 66 insertions(+), 76 deletions(-)

diff --git a/configs/nixos/modules/network/ssh.nix b/configs/nixos/modules/network/ssh.nix
index 2669dbd..3718011 100644
--- a/configs/nixos/modules/network/ssh.nix
+++ b/configs/nixos/modules/network/ssh.nix
@@ -6,82 +6,72 @@
 }:
 # Configures inbound and outbound SSH access.
 let
-  cfg = config.modules.network.ssh; # NOLINT(let_order)
-  defaultAuthorizedKeys = lib.flatten (
-    clientKeysFor fleet.workstationNames
-    ++ lib.optional fleet.isServer (clientKeysFor fleet.serverNames)
-  );
-  clientKeysFor =
-    names: lib.filter (key: key != null) (map (name: fleet.targets.${name}.clientKey) names);
+  cfg = config.modules.network.ssh;
+  user = config.user.name; # NOLINT(let_order)
 
-  fleet =
-    # Keep fleet policy and target construction in conceptual order.
-    # NOLINT(let_order)
-    let
-      workstationNames = [
-        "neogaia"
-        "zeus"
+  # NOLINT(let_order)
+  workstationNames = [
+    "neogaia"
+    "zeus"
+  ];
+  serverNames = [ "pikachu" ];
+  managedHostNames = workstationNames ++ serverNames; # NOLINT(let_order)
+  isWorkstation = lib.elem config.networking.hostName workstationNames; # NOLINT(let_order)
+  isServer = lib.elem config.networking.hostName serverNames; # NOLINT(let_order)
+
+  # NOLINT(let_order)
+  clientKeyFor = host: builtins.readFile (../../hosts + "/${host}/ssh_user_ed25519_key.pub");
+  hostKeysFor =
+    host:
+    map builtins.readFile [
+      (../../hosts + "/${host}/ssh_host_ed25519_key.pub")
+      (../../hosts + "/${host}/ssh_host_rsa_key.pub")
+    ];
+  # NOLINT(let_order)
+  managedTargets = lib.genAttrs managedHostNames (name: {
+    hostName = registry.address.${name}.self;
+    clientKey = clientKeyFor name;
+    hostKeys = hostKeysFor name;
+  });
+  extraTargets = {
+    # TODO: Pin Gitea's host key after migrating it from Proxmox.
+    gitea = {
+      hostName = "git.alexion.dev";
+      port = 2022;
+      user = "gitea";
+      aliases = [
+        "gitea"
+        "git.alexion.dev"
       ];
-      serverNames = [ "pikachu" ];
-      managedHostNames = workstationNames ++ serverNames;
-      isWorkstation = lib.elem config.networking.hostName workstationNames;
-      isServer = lib.elem config.networking.hostName serverNames;
-
-      clientKeyFor = host: builtins.readFile (../../hosts + "/${host}/ssh_user_ed25519_key.pub");
-      hostKeysFor =
-        host:
-        map builtins.readFile [
-          (../../hosts + "/${host}/ssh_host_ed25519_key.pub")
-          (../../hosts + "/${host}/ssh_host_rsa_key.pub")
-        ];
-      managedTargets = lib.genAttrs managedHostNames (name: {
-        hostName = registry.address.${name}.self;
-        clientKey = clientKeyFor name;
-        hostKeys = hostKeysFor name;
-      });
-      extraTargets = {
-        # TODO: Pin Gitea's host key after migrating it from Proxmox.
-        gitea = {
-          hostName = "git.alexion.dev";
-          port = 2022;
-          user = "gitea";
-          aliases = [
-            "gitea"
-            "git.alexion.dev"
-          ];
-        };
-      };
-      mkTarget = name: target: {
-        hostName = target.hostName or name;
-        user = target.user or user;
-        port = target.port or 22;
-        aliases = target.aliases or [ name ];
-        clientKey = target.clientKey or null;
-        hostKeys = target.hostKeys or [ ];
-      };
-      targets = lib.mapAttrs mkTarget (managedTargets // extraTargets);
-      outboundTargetNames =
-        let
-          groupTargets =
-            if isServer then
-              [ "gitea" ] ++ serverNames
-            else if isWorkstation then
-              [ "gitea" ] ++ serverNames ++ workstationNames
-            else
-              [ "gitea" ];
-        in
-        lib.filter (name: name != config.networking.hostName) groupTargets;
-    in
-    {
-      inherit
-        isServer
-        outboundTargetNames
-        serverNames
-        targets
-        workstationNames
-        ;
     };
-  user = config.user.name;
+  };
+  # NOLINT(let_order)
+  mkTarget = name: target: {
+    hostName = target.hostName or name;
+    user = target.user or user;
+    port = target.port or 22;
+    aliases = target.aliases or [ name ];
+    clientKey = target.clientKey or null;
+    hostKeys = target.hostKeys or [ ];
+  };
+  targets = lib.mapAttrs mkTarget (managedTargets // extraTargets); # NOLINT(let_order)
+
+  clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names); # NOLINT(let_order)
+  # NOLINT(let_order)
+  defaultAuthorizedKeys = lib.flatten (
+    clientKeysFor workstationNames ++ lib.optional isServer (clientKeysFor serverNames)
+  );
+  outboundTargetNames = # NOLINT(let_order)
+    let
+      groupTargets =
+        if isServer then
+          [ "gitea" ] ++ serverNames
+        else if isWorkstation then
+          [ "gitea" ] ++ serverNames ++ workstationNames
+        else
+          [ "gitea" ];
+    in
+    lib.filter (name: name != config.networking.hostName) groupTargets;
 
   knownHosts = lib.listToAttrs (
     lib.concatLists (
@@ -94,7 +84,7 @@ let
             publicKey = keyWithoutComment key;
           }
         ) target.hostKeys
-      ) fleet.targets
+      ) targets
     )
   );
   knownHostNamesFor =
@@ -109,7 +99,7 @@ let
   sshSettingsFor =
     name:
     let
-      target = fleet.targets.${name};
+      target = targets.${name};
     in
     {
       header = "Host ${lib.concatStringsSep " " target.aliases}";
@@ -174,7 +164,7 @@ in
           enable = true;
           enableDefaultConfig = false;
           settings = lib.mapAttrs (name: _: sshSettingsFor name) (
-            lib.genAttrs fleet.outboundTargetNames (name: name)
+            lib.genAttrs outboundTargetNames (name: name)
           );
         };
       }