1 files changed, 25 insertions, 4 deletions
diff --git a/modules/by-name/ba/backup/module.nix b/modules/by-name/ba/backup/module.nix
index ca7a469c..7ac6e081 100644
--- a/modules/by-name/ba/backup/module.nix
+++ b/modules/by-name/ba/backup/module.nix
@@ -113,10 +113,31 @@ in {
       };
     };
 
-    vhack.programs.ssh = lib.mkIf cfg.storagebox.enable {
-      enable = true;
-      rootKnownHosts = {
-        "[${cfg.storagebox.user}.your-storagebox.de]:23" = cfg.storagebox.sshHostKey;
+    systemd.tmpfiles.settings = lib.mkIf cfg.storagebox.enable {
+      "10-backup-module" = {
+        "/root/.ssh/config".f = let
+          knownHostsFile = pkgs.writeTextFile {
+            name = "known-hosts-file";
+            text = ''
+              [${cfg.storagebox.user}.your-storagebox.de]:23 ${cfg.storagebox.sshHostKey}
+            '';
+          };
+        in {
+          group = "root";
+          user = "root";
+          mode = "0755";
+
+          # Don't try to authenticate via password for these, because we need to use the
+          # forced commands, and they are only provided via the ssh key login.
+          # So password login is a footgun (it is, however, valid to use it for non-root
+          # use-cases)
+          argument = ''
+            Host *.your-storagebox.de
+              PasswordAuthentication no
+              Port 23
+              UserKnownHostsFile ${knownHostsFile}
+          '';
+        };
       };
     };