Ehm… I’m also on Nixos and I’d say it’s super trivial. services.openssh = { enable = true; settings = { PasswordAuthentication = false; PermitRootLogin = "no"; }; }; users.users..openssh.authorizedKeys.keys = [ list of pubkeys ideally read from file in repo ];