hosts/apollo/boot.nix

@@ -1,9 +1,10 @@
 { pkgs, lib, inputs, ... }:
 
 {
+  boot.kernelParams = [ "rd.luks.options=timeout=0,tries=1" ];
   boot.initrd = {
     supportedFilesystems = [ "ext4" "zfs" ];
-    availableKernelModules = [ "hid_apple" ];
+    availableKernelModules = [ "hid_apple" "igc" ];
     systemd = {
       enable = true;
       fido2.enable = true;
@@ -24,11 +25,33 @@
       crypttabExtraOpts = [ "fido2-device=auto" ];
     };
 
+    systemd.services."systemd-cryptsetup@" = {
+      overrideStrategy = "asDropin";
+      serviceConfig = {
+        Restart = "no";
+        OnFailureJobMode = "fail";
+      };
+    };
+
     systemd.services."zfs-import-nix-root" = {
       wants = [ "keys.mount" ];
       after = [ "keys.mount" ];
     };
 
+    network = {
+      enable = true;
+      ssh = {
+        enable = true;
+        port = 2222;
+        hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
+        
+        # Use an inline string to prepend the forced systemd command to your key
+        authorizedKeys = [
+          ''command="${pkgs.systemd}/bin/systemd-tty-ask-password-agent --watch" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjed9TzAaS6afEilS6CQAyz7DRJUNeLWGeboB3Ma3Rb remote-fido-unlock''
+        ];
+      };
+    };
+
   };
 
   systemd.services."zfs-import-nix-main" = {

hosts/apollo/default.nix

@@ -9,20 +9,4 @@
   networking.hostName = "apollo";
   networking.hostId = "40ced703";
   networking.networkmanager.insertNameservers = [ "10.5.0.1" "1.1.1.1" ];
-
-  programs.hyprland = {
-    enable = true;
-    withUWSM = true;
-    xwayland.enable = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-    kitty
-  ];
-
-  programs.zsh.loginShellInit = ''
-    if [[ $(tty) == "/dev/tty1" ] && uwsm check may-start; then 
-      exec uwsm start hyprland-uwsm.desktop
-    fi
-  '';
 }

hosts/base.nix

@@ -61,9 +61,6 @@
     variant = "";
   };
 
-  programs.zsh.enable = true;
-  users.defaultUserShell = pkgs.zsh;
-
   users.users.nyxerinys = {
     isNormalUser = true;
     description = "Nyx";