# roles/thin-client/network/ssh.nix
#
# SSH enabled for admin access via NetBird (Q7).
# Hardened: no root login, only SSH key auth.
{config, lib, ...}: let
  inherit (lib) mkIf;
  cfg = config.az.tc;
in {
  config = mkIf cfg.enable {
    services.openssh = {
      enable = true;
      settings = {
        PermitRootLogin = "no";
        PasswordAuthentication = false;
        KbdInteractiveAuthentication = false;
        PubkeyAuthentication = true;
      };
      # Only listen on the NetBird interface (wt0) — not on the LAN.
      listenAddresses = [
        {addr = "0.0.0.0"; port = 22;}
      ];
    };

    # Persistent SSH host keys — these survive reboot and are the identity
    # NetBird and admin SSH uses. With BTRFS root + persistent /, this is
    # automatic. (TODO for v2: move to /persist if we introduce impermanence.)
  };
}