From 7d549a9c176eb8e8f16ae988b52b6e541d4112df Mon Sep 17 00:00:00 2001
From: Berwn <alexander@grabowski.email>
Date: Tue, 28 Jul 2026 17:17:56 +0700
Subject: [PATCH] Migrate deprecated admin service to sshd + users

sshd carries the admin SSH keys and now also CA-signed host certificates
(TOFU-less verification via the shared openssh-ca); the users service
generates per-machine root passwords (share = false, no prompts).
---
 clan.nix | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/clan.nix b/clan.nix
index 5ab0d5e..47badb2 100644
--- a/clan.nix
+++ b/clan.nix
@@ -25,15 +25,30 @@ in
 
   inventory.instances = {
 
-    admin = {
-      roles.default.tags.all = { };
-      roles.default.settings.allowedKeys = {
+    # Admin SSH keys + root password, split per the clan-core migration off
+    # the deprecated `admin` service (sshd handles keys, users the password).
+    sshd = {
+      roles.server.tags.all = { };
+      roles.server.settings.authorizedKeys = {
         "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENAjhGQGraQoAjJzsomKP8GAmQPeGL1rNRNHgRcLqtT";
         "kurogeek" =
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
       };
     };
 
+    root-user = {
+      module = {
+        name = "users";
+        input = "clan-core";
+      };
+      roles.default.tags.all = { };
+      roles.default.settings = {
+        user = "root";
+        prompt = false; # auto-generate, like the old admin service
+        share = false; # per-machine password, not fleet-wide
+      };
+    };
+
     zerotier = {
       roles.controller.machines."control" = { };
       roles.peer.tags.all = { };