common/default.nix

@@ -30,9 +30,7 @@ in
 
   services.openssh = {
     enable = true;
-    settings = {
-      PasswordAuthentication = false;
-    };
+    passwordAuthentication = false;
   };
   programs.mosh.enable = true;
 
@@ -72,9 +70,7 @@ in
   users.users.root = {
     openssh.authorizedKeys.keys = sshHigherTrustKeys;
   };
-  nix.settings = {
-    trusted-users = [ "root" "googlebot" ];
-  };
+  nix.trustedUsers = [ "root" "googlebot" ];
 
   nix.gc.automatic = true;
 

common/network/default.nix

@@ -9,7 +9,6 @@ in
   imports = [
     ./hosts.nix
     ./pia-openvpn.nix
-    ./ping.nix
     ./tailscale.nix
     ./vpn.nix
     ./zerotier.nix

common/network/hosts.nix

@@ -3,10 +3,6 @@
 with builtins;
 
 let
-  # TODO: remove when all systems are updated to new enough nixpkgs
-  concatMapAttrs =
-    f: with lib; flip pipe [ (mapAttrs f) attrValues (foldl' mergeAttrs { }) ];
-
   system = (import ../ssh.nix).system;
 
   # hostnames that resolve on clearnet for LUKS unlocking
@@ -22,18 +18,13 @@ let
     ponyo = "cfamr6artx75qvt7ho3rrbsc7mkucmv5aawebwflsfuorusayacffryd.onion";
     s0 = "r3zvf7f2ppaeithzswigma46pajt3hqytmkg3rshgknbl3jbni455fqd.onion";
   };
-
-  zerotierHosts = {
-    "s0.zt.neet.dev" = "172.30.145.180";
-    "ponyo.zt.neet.dev" = "172.30.109.9";
-    "ray.zt.neet.dev" = "172.30.189.212";
-  };
 in {
-  # some DNS providers filter local ip results from DNS request
-  networking.hosts = concatMapAttrs (host: ip: {ip = [host];}) zerotierHosts;
-
-  # TODO only add if zerotier is enabled
-  keepalive-ping.hosts = attrNames zerotierHosts;
+  networking.hosts = {
+    # some DNS providers filter local ip results from DNS request
+    "172.30.145.180" = [ "s0.zt.neet.dev" ];
+    "172.30.109.9" = [ "ponyo.zt.neet.dev" ];
+    "172.30.189.212" = [ "ray.zt.neet.dev" ];
+  };
 
   programs.ssh.knownHosts = {
     liza = {
@@ -104,7 +95,12 @@ in {
 
   # prebuilt cmds for easy ssh LUKS unlock
   environment.shellAliases =
-    concatMapAttrs (host: addr: {"unlock-over-tor_${host}" = "torsocks ssh root@${addr}";}) unlock-onion-hosts
-      //
-    concatMapAttrs (host: addr: {"unlock_${host}" = "torsocks ssh root@${addr}";}) unlock-clearnet-hosts;
+    let
+      # TODO: remove when all systems are updated to new enough nixpkgs
+      concatMapAttrs =
+        f: with lib; flip pipe [ (mapAttrs f) attrValues (foldl' mergeAttrs { }) ];
+    in
+      concatMapAttrs (host: addr: {"unlock-over-tor_${host}" = "torsocks ssh root@${addr}";}) unlock-onion-hosts
+        //
+      concatMapAttrs (host: addr: {"unlock_${host}" = "torsocks ssh root@${addr}";}) unlock-clearnet-hosts;
 }

common/network/zerotier.nix

@@ -4,8 +4,6 @@ let
   cfg = config.services.zerotierone;
 in {
   config = lib.mkIf cfg.enable {
-    keepalive-ping.enable = true;
-
     services.zerotierone.joinNetworks = [
       "565799d8f6d654c0"
     ];