nixos/sshd: Disable authorizedKeysInHomedir if stateVersion >= 24.11

Co-authored-by: Valentin Gagarin <valentin@gagarin.work>

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -390,6 +390,9 @@
     * from `/var/log/private/gns3` to `/var/log/gns3`
   and to change the ownership of these directories and their contents to `gns3` (including `/etc/gns3`).
 
+- The `sshd` module now doesn't include `%h/.ssh/authorized_keys` as `AuthorizedKeysFile` unless
+  `services.openssh.authorizedKeysInHomedir` is set to `true` (the default is `false` for `stateVersion` 24.11 onwards).
+
 - Legacy package `stalwart-mail_0_6` was dropped, please note the
   [manual upgrade process](https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md)
   before changing the package to `pkgs.stalwart-mail` in

nixos/modules/services/networking/ssh/sshd.nix

@@ -302,7 +302,8 @@ in
 
       authorizedKeysInHomedir = lib.mkOption {
         type = lib.types.bool;
-        default = true;
+        default = lib.versionOlder config.system.stateVersion "24.11";
+        defaultText = lib.literalMD "`false` unless [](#opt-system.stateVersion) is 24.05 or older";
         description = ''
           Enables the use of the `~/.ssh/authorized_keys` file.
 

nixos/tests/openssh.nix

@@ -14,7 +14,10 @@ in {
       { ... }:
 
       {
-        services.openssh.enable = true;
+        services.openssh = {
+          enable = true;
+          authorizedKeysInHomedir = true;
+        };
         security.pam.services.sshd.limits =
           [ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];
         users.users.root.openssh.authorizedKeys.keys = [
@@ -39,7 +42,11 @@ in {
       { ... }:
 
       {
-        services.openssh = { enable = true; startWhenNeeded = true; };
+        services.openssh = {
+          enable = true;
+          startWhenNeeded = true;
+          authorizedKeysInHomedir = true;
+        };
         security.pam.services.sshd.limits =
           [ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];
         users.users.root.openssh.authorizedKeys.keys = [