[vps] Extract sshd configuration into conf/vps/sshd.scm.

Move the inline openssh-configuration out of vps-system.scm into a
dedicated module.  Update settings to match the reference sshd_config:
port 72, disable password auth, tune keepalive timeouts, and accept
locale environment variables.  Only override fields that differ from
the Guix defaults.

Co-Authored-By: Claude <noreply@anthropic.com>

diff --git a/conf/vps/sshd.scm b/conf/vps/sshd.scm
new file mode 100644 (file)
index 0000000..38ab58e
--- /dev/null
+++ b/conf/vps/sshd.scm
@@ -0,0 +1,22 @@
+;;; Copyright (c) 2026 Jakub Czajka <jakub@ekhem.eu.org>
+;;; License: GPL-3.0 or later.
+
+(define-module (conf vps sshd)
+  #:use-module (gnu services)
+  #:use-module (gnu services ssh)
+  #:use-module (gnu packages ssh)
+  #:export (%openssh-config %ssh-service))
+
+(define %openssh-config
+  (openssh-configuration (openssh openssh-sans-x)
+                         (port-number 72)
+                         (password-authentication? #f)
+                         (accepted-environment '("LANG" "LC_*"))
+                         ;; No dedicated fields exist for these directives.
+                         (extra-content (string-append "PrintMotd no\n"
+                                         "ClientAliveInterval 120\n"
+                                         "ClientAliveCountMax 1\n"
+                                         "UseDNS no\n"))))
+
+(define %ssh-service
+  (service openssh-service-type %openssh-config))

diff --git a/vps-system.scm b/vps-system.scm
index b637240763489bd8778678dba1344551548810e1..7cb716ba40aaf4300ba5814edd050951c19921fd 100644 (file)
--- a/vps-system.scm
+++ b/vps-system.scm
@@ -7,16 +7,10 @@
 ;;;   guix system image --image-type=mbr-raw vps-system.scm
 
 (use-modules (gnu)
-             (nongnu packages linux))
+             (nongnu packages linux)
+             (conf vps sshd))
 
-(use-service-modules networking ssh)
-(use-package-modules ssh)
-
-(define %vps-openssh-config
-  (openssh-configuration (openssh openssh-sans-x)
-                         (port-number 22)
-                         (password-authentication? #f)
-                         (permit-root-login 'prohibit-password)))
+(use-service-modules networking)
 
 (operating-system
   (host-name "vps")
@@ -54,8 +48,8 @@
             ;; DHCP -- OVH delivers the static IP via DHCP
             (service dhcpcd-service-type)
 
-            ;; SSH -- key-only authentication
-            (service openssh-service-type %vps-openssh-config)
+            ;; SSH -- configured in conf/vps/sshd.scm
+            %ssh-service
 
             ;; NTP -- correct time is required for Guix substitutes
             (service ntp-service-type))