From e326c34f82a567d3c3a8cd25177e96fe433f494c Mon Sep 17 00:00:00 2001
From: nyxerinys <nyxerinys5@gmail.com>
Date: Thu, 1 Oct 2026 19:37:53 -0500
Subject: [PATCH] add remote encryption unlock

---
 hosts/apollo/boot.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hosts/apollo/boot.nix b/hosts/apollo/boot.nix
index 5892121..5494345 100644
--- a/hosts/apollo/boot.nix
+++ b/hosts/apollo/boot.nix
@@ -27,6 +27,20 @@
       wants = [ "keys.mount" ];
       after = [ "keys.mount" ];
     };
+
+    network = {
+    enable = true;
+    ssh = {
+      enable = true;
+      port = 2222;
+      hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
+      
+      # Use an inline string to prepend the forced systemd command to your key
+      authorizedKeys = [
+        ''command="${pkgs.systemd}/bin/systemd-tty-ask-password-agent --watch" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjed9TzAaS6afEilS6CQAyz7DRJUNeLWGeboB3Ma3Rb remote-fido-unlock''
+      ];
+    };
+  };
   };
 
   systemd.services."zfs-import-nix-main" = {