alexion
42ff195556
The sops secret declarations, the empty `hostKeys`, and the `HostKey` lines were boilerplate sitting in the host, and every future host restoring its identity would have repeated them. `modules.ssh` takes the encrypted file and the key types, deriving the secret names and the `HostKey` lines from one list, so the daemon and the secrets cannot disagree about where a key lives. The resulting system derivation is unchanged. Also record two gotchas: reading PR review comments needs the Gitea API rather than tea, and host keys are not user authentication keys.