From c571adaefb071b8f9a08cbf1e7343153d1288019 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Fri, 17 Apr 2026 11:39:57 +0000
Subject: [PATCH] nixos/sshd: remove 'moduliFile' option, in favour of
 settings.ModuliFile

Per RFC42.

As a result, /etc/ssh/moduli will no longer exist, and sshd_config's ModuliFile will point to /nix/store/...
---
 .../modules/services/networking/ssh/sshd.nix  | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index a948cd02bc4f..72702b605f3d 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -232,6 +232,10 @@ in
       "openssh"
       "banner"
     ] "Use services.openssh.settings.Banner instead.")
+    (lib.mkRenamedOptionModule
+      [ "services" "openssh" "moduliFile" ]
+      [ "services" "openssh" "settings" "ModuliFile" ]
+    )
   ];
 
   ###### interface
@@ -729,6 +733,14 @@ in
                 '';
                 example = "/etc/ssh/banner";
               };
+              ModuliFile = lib.mkOption {
+                type = lib.types.path;
+                default = "${config.services.openssh.package}/etc/ssh/moduli";
+                defaultText = lib.literalExpression ''"''${config.services.openssh.package}/etc/ssh/moduli"'';
+                description = ''
+                  Specifies the {manpage}`moduli(5)` file to use for Diffie-Hellman key exchange.
+                '';
+              };
             };
           }
         );
@@ -740,16 +752,6 @@ in
         description = "Verbatim contents of {file}`sshd_config`.";
       };
 
-      moduliFile = lib.mkOption {
-        example = "/etc/my-local-ssh-moduli;";
-        type = lib.types.path;
-        description = ''
-          Path to `moduli` file to install in
-          `/etc/ssh/moduli`. If this option is unset, then
-          the `moduli` file shipped with OpenSSH will be used.
-        '';
-      };
-
     };
 
     users.users = lib.mkOption {
@@ -770,14 +772,12 @@ in
       };
       users.groups.sshd = { };
 
-      services.openssh.moduliFile = lib.mkDefault "${cfg.package}/etc/ssh/moduli";
       services.openssh.sftpServerExecutable = lib.mkDefault "${cfg.package}/libexec/sftp-server";
 
       environment.etc =
         authKeysFiles
         // authPrincipalsFiles
         // {
-          "ssh/moduli".source = cfg.moduliFile;
           "ssh/sshd_config".source = sshconf;
         };