Ehm… I’m also on Nixos and I’d say it’s super trivial.
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "no";
};
};
users.users.<name>.openssh.authorizedKeys.keys = [ list of pubkeys ideally read from file in repo ];




Why, by boasting that it’s so easy, just look at that, it is only two options you need to set thanks to the 80 custom modules I’ve written to abstract the abstractions from nixpkgs!
I WISH I could put an /s here, but I cannot.