nixos-config/modules/ssh.nix

{ ... }:
let
  pubkeys = import ./pubkeys.nix;
in
{
  services.openssh = {
    enable = true;
    permitRootLogin = "yes";
    passwordAuthentication = false;
  };

  users.users.root.openssh.authorizedKeys.keys = [
    pubkeys."simon@nunotaba"
  ];
}