From d54387fcd0ccd62acebb6ed02bdf60e749207f44 Mon Sep 17 00:00:00 2001
From: andre4ik3 <andre4ik3@fastmail.com>
Date: Sun, 10 Aug 2025 05:21:10 +0000
Subject: [PATCH] nixos/systemd/userdbd: add SSH integration support

---
 nixos/modules/system/boot/systemd/userdbd.nix | 36 +++++++++++++++++--
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/system/boot/systemd/userdbd.nix b/nixos/modules/system/boot/systemd/userdbd.nix
index 0161a7c2c681..8d70afea7f55 100644
--- a/nixos/modules/system/boot/systemd/userdbd.nix
+++ b/nixos/modules/system/boot/systemd/userdbd.nix
@@ -4,15 +4,45 @@ let
   cfg = config.services.userdbd;
 in
 {
-  options.services.userdbd.enable = lib.mkEnableOption ''
-    the systemd JSON user/group record lookup service
-  '';
+  options.services.userdbd = {
+    enable = lib.mkEnableOption ''
+      the systemd JSON user/group record lookup service
+    '';
+
+    enableSSHSupport = lib.mkEnableOption ''
+      exposing OpenSSH public keys defined in userdb. Be aware that this
+      enables modifying public keys at runtime, either by users managed by
+      {option}`services.homed`, or globally via drop-in files
+    '';
+  };
+
   config = lib.mkIf cfg.enable {
+    assertions = lib.singleton {
+      assertion = cfg.enableSSHSupport -> config.security.enableWrappers;
+      message = "OpenSSH userdb integration requires security wrappers.";
+    };
+
     systemd.additionalUpstreamSystemUnits = [
       "systemd-userdbd.socket"
       "systemd-userdbd.service"
     ];
 
     systemd.sockets.systemd-userdbd.wantedBy = [ "sockets.target" ];
+
+    # OpenSSH requires AuthorizedKeysCommand to be owned only by root.
+    # Referencing `userdbctl` directly from the Nix store won't work, as
+    # `/nix/store` is owned by the `nixbld` group.
+    security.wrappers = lib.mkIf cfg.enableSSHSupport {
+      userdbctl = {
+        owner = "root";
+        group = "root";
+        source = lib.getExe' config.systemd.package "userdbctl";
+      };
+    };
+
+    services.openssh = lib.mkIf cfg.enableSSHSupport {
+      authorizedKeysCommand = "/run/wrappers/bin/userdbctl ssh-authorized-keys %u";
+      authorizedKeysCommandUser = "root";
+    };
   };
 }