nixos-configuration/shared/base/modules/security/ssh.nix

# /nix/store/<hash>/etc/ssh/ssh_config & /nix/store/<hash>/etc/ssh/authorized_keys
{
  systemConfig,
  systems,
  common,
  ...
}:
with builtins;
let
  domain = "dns.${common.domain}";
in
{
  programs.ssh.knownHosts = listToAttrs (
    map (system: {
      name = system.hostName;
      value = {
        extraHostNames = [
          "${system.hostName}.${domain}"
        ];
        publicKey = system.ssh.publicKey;
      };
    }) systems
  );
  users.users.${systemConfig.username}.openssh.authorizedKeys.keys = (
    map (system: system.ssh.publicKey) systems
  );
}