From b4a23fc1ca4026c8c4023b2e1b551153de2af23d Mon Sep 17 00:00:00 2001
From: Jakub Czajka <jakub@ekhem.eu.org>
Date: Mon, 13 Jul 2026 22:06:32 +0000
Subject: [PATCH] [vps] Extract sshd configuration into conf/vps/sshd.scm.

Move the inline openssh-configuration out of vps-system.scm into a
dedicated module.  Update settings to match the reference sshd_config:
port 72, disable password auth, tune keepalive timeouts, and accept
locale environment variables.  Only override fields that differ from
the Guix defaults.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 conf/vps/sshd.scm | 22 ++++++++++++++++++++++
 vps-system.scm    | 19 ++++++-------------
 2 files changed, 28 insertions(+), 13 deletions(-)
 create mode 100644 conf/vps/sshd.scm

diff --git a/conf/vps/sshd.scm b/conf/vps/sshd.scm
new file mode 100644
index 0000000..caf9384
--- /dev/null
+++ b/conf/vps/sshd.scm
@@ -0,0 +1,22 @@
+;;; Copyright (c) 2026 Jakub Czajka <jakub@ekhem.eu.org>
+;;; License: GPL-3.0 or later.
+
+(define-module (conf vps sshd)
+  #:use-module (gnu services)
+  #:use-module (gnu services ssh)
+  #:use-module (gnu packages ssh)
+  #:export (%ssh-service))
+
+(define %openssh-config
+  (openssh-configuration (openssh openssh-sans-x)
+                         (port-number 72)
+                         (password-authentication? #f)
+                         (accepted-environment '("LANG" "LC_*"))
+                         ;; No dedicated fields exist for these directives.
+                         (extra-content (string-append "PrintMotd no\n"
+                                         "ClientAliveInterval 120\n"
+                                         "ClientAliveCountMax 1\n"
+                                         "UseDNS no\n"))))
+
+(define %ssh-service
+  (service openssh-service-type %openssh-config))
diff --git a/vps-system.scm b/vps-system.scm
index b637240..20ee846 100644
--- a/vps-system.scm
+++ b/vps-system.scm
@@ -7,16 +7,10 @@
 ;;;   guix system image --image-type=mbr-raw vps-system.scm
 
 (use-modules (gnu)
-             (nongnu packages linux))
+             (nongnu packages linux)
+             (conf vps sshd))
 
-(use-service-modules networking ssh)
-(use-package-modules ssh)
-
-(define %vps-openssh-config
-  (openssh-configuration (openssh openssh-sans-x)
-                         (port-number 22)
-                         (password-authentication? #f)
-                         (permit-root-login 'prohibit-password)))
+(use-service-modules networking)
 
 (operating-system
   (host-name "vps")
@@ -51,13 +45,12 @@
   
   (services
    (append (list
-            ;; DHCP -- OVH delivers the static IP via DHCP
+            ;; DHCP
             (service dhcpcd-service-type)
 
-            ;; SSH -- key-only authentication
-            (service openssh-service-type %vps-openssh-config)
+            %ssh-service
 
-            ;; NTP -- correct time is required for Guix substitutes
+            ;; NTP
             (service ntp-service-type))
 
            %base-services))
-- 
2.47.3