From 40a0d5aa7010ff41f68e03608d00492fde542327 Mon Sep 17 00:00:00 2001
From: Patrick Mulligan <patjmulligan@protonmail.com>
Date: Sun, 1 Mar 2026 21:38:56 -0500
Subject: [PATCH] feat(deploy): enable root SSH key access on douro

Allow key-only root login (PermitRootLogin prohibit-password) and add
authorized SSH key for remote administration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 deploy/nixos/configuration.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/deploy/nixos/configuration.nix b/deploy/nixos/configuration.nix
index 678f658..193a73a 100644
--- a/deploy/nixos/configuration.nix
+++ b/deploy/nixos/configuration.nix
@@ -134,10 +134,15 @@
     enable = true;
     settings = {
       PasswordAuthentication = false;
-      PermitRootLogin = "no";
+      PermitRootLogin = "prohibit-password";
     };
   };
 
+  # Root SSH key access
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIES8I43AgXppATvtBqnUycakMMs68T2J52cTwNt6qPak padreug@gizmo"
+  ];
+
   # Auto-updates (optional - disabled by default for stability)
   # system.autoUpgrade.enable = false;