feat(neogaia): restore the SSH host keys from sops (task 0011)

The host's SSH identity was generated by the daemon, so reimaging the
laptop would invalidate it and break `known_hosts` for every client that
had ever connected.

Add `secrets/neogaia.yaml`, the first per-host secrets file, encrypted to
the admin identity and `neogaia` alone so a compromised machine cannot
decrypt another's material. It holds both host private keys; the public
halves are committed in plaintext.

Clear `services.openssh.hostKeys` to stop generation and point `HostKey`
at the decrypted paths. These are ordinary secrets rather than the
pre-user ones the password uses, exercising the second decryption path.

hosts/neogaia/default.nix

@@ -1,6 +1,19 @@
-{ inputs, pkgs, ... }:
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
 # neogaia — Dell XPS 13 9380 laptop.
 # Disk layout is in ./disk.nix; `fileSystems` are derived from it, none declared here.
+let
+  # Read by the daemon at startup, so a re-key has to restart it to take effect.
+  sshHostKey = {
+    sopsFile = ../../secrets/neogaia.yaml;
+    mode = "0400";
+    restartUnits = [ "sshd.service" ];
+  };
+in
 {
   imports = [
     inputs.nixos-hardware.nixosModules.dell-xps-13-9380
@@ -29,6 +42,23 @@
   # So setup can be driven over the network.
   services.openssh.enable = true;
 
+  # This host's SSH identity is restored from secrets.
+  # Reimaging the machine therefore keeps its fingerprint, and every client's
+  # `known_hosts` entry stays valid.
+  # The matching public halves are committed in plaintext, since publishing
+  # them is their purpose.
+  sops.secrets = {
+    ssh-host-ed25519-key = sshHostKey;
+    ssh-host-rsa-key = sshHostKey;
+  };
+
+  # An empty list is what stops the daemon generating keys of its own.
+  services.openssh.hostKeys = [ ];
+  services.openssh.extraConfig = ''
+    HostKey ${config.sops.secrets.ssh-host-ed25519-key.path}
+    HostKey ${config.sops.secrets.ssh-host-rsa-key.path}
+  '';
+
   # fish as the login shell.
   modules.fish.enable = true;
   modules.fish.defaultShell = true;

hosts/neogaia/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJS+wp7K123+4BT6G4f954R6WyrbWveY7VlpoBUf6I5p root@neogaia

hosts/neogaia/ssh_host_rsa_key.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCo2wWUKxyAS4J5TqbWf8glDhJvS5XmdRqFhMeJwG3pOB+4AccZ1T8LU7ZN+RjtRi3j2qXBJvIHuzhtQNtmT59TxocvfobYiqOgJpvVO5K6yD8ZoUJs6ziDkIduI9w9mdRIESoi+dBbVu8n24r61cKDVh+jWX+yjzkOcWcOzqDyQhhkjqblZ1WMAdujEMuEPvif1i2LCxStUaZqRGcx09m/ME2fYcaJrpuxxxvX2+CPJNicoo6Rx9i7ZjAoNuvH+jui4KT62DzlQtQtCl2CFUOM0gCPSa+MbNQ9elfHPvGzEcwOIMo2cuy9KURUkQu+sAgaG8S1PEniDDTecskHtuRdmPZawnQGpIhzo919Q6wUgjT8scK4mmSXRWmGmkMt0GNA2tfj5tDks6r5Q8XsYqtWs4rsOEvfmxVSdM771w+fqDBAil99Jsh0ksPK9+Bwgg8cMDzLLFDn8JA5y2G1HocMMom+u5DYKwPXEKnCILkasB8y24+O3PhSu1EuWw277w6EUEXvU03rCf0Ak/ULjxp9a00EGlloEwSmFI7Aub9XHDr87IdbGInEn+PMqyBYADiN+3h6nE2JO+nMa6i/CHdebmT+T7YJvuTKHD9sjFmQsYaghlq03DZrhHcm4hgUvE1dqGojHrhk/WgA3EWTWtK/+BP0Vy2jXaaz+qAx+EGnhQ== root@neogaia