Adding sshd and mosh

.config/yadm/bootstrap##distro.arch

@@ -24,13 +24,50 @@ sudo pacman -S --needed --noconfirm \
   jq \
   bob \
   gvfs-smb \
-  pcmanfms \
-  wl-clipboard
+  pcmanfm \
+  wl-clipboard \
+  openssh \
+  mosh
 
 bob install nightly
 bob use nightly
 nvim --version
 
+# --- ssh / mosh: public-key-only access --------------------------------
+sudo systemctl enable --now sshd
+
+install -d -m 700 "$HOME/.ssh"
+touch "$HOME/.ssh/authorized_keys"
+chmod 600 "$HOME/.ssh/authorized_keys"
+
+# Public keys trusted for this account (safe to publish, no private key
+# material). Snapshot of `ssh-add -L` on 2026-08-14; appended if missing,
+# never removes keys added by other means.
+ssh_authorized_keys=(
+  "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQU7E/vo/+//WgeDPYX8wQudAQpx8FY2L7nv1wFCWaTrHqyUKL/ggmvtAXbkg9WqW/p6DmKbpDFNMKwKScK2OxjcxkPyQnmrmPW3SVU44RsN4R6Z0TKDSmVJ4wO35njYEfd8yKO4BDX8Q2T34lKHuBxqH/Q4Heknj4AEKB0l6xuHzfGumK4qN58qPZ6hFfPHffeOiYSh2hVWa/pRxbzD0ZDJ4eLXvUHPsQ+GVerLKv2ozVrhHOjouAQyuIFD86j8rUUnRp7keKawLUsmXvnO0IdJwi3c82j42+mUa8A3fb1glLGlax4glAhz3nw6v2NPk1V5BObCvT3zng3v6eteyEMW8E6qrUX3N9AUHABq4i8dkRKjQXL3V5dkAhTV0BzdxyBQ8/i8cWKGl2CZSPDzi37Si6RpiLboPtm3iY0mf74HbJPBUkA6YVYZEOLy0TPUkEQxkKVE/zI7GDe9CmGDRWOKm+naLSoQEr1/9xqAJlhz+HbWUkmam3MEaXXqDbY1s= wholteza_rsa"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIArtt5fhcXt2IVAmU2FWfQyrFiQmV/ym/cUM6jtpJ7CA ansible"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFFYS4L05dihHbrxX8NuPuOgAfRpMx7UJk95po5EdMQv HIT manually created id_ed25519"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxWpXrFMFtG4KlqfMZ2kYUTEZ1sMfvpNFSUlQBkaeq0 wholteza"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKIZHsSfRcBFdg1pmV5ig/zZ5ZEy9iS6GiLK7kOy0Vcu HIT zacmon001"
+)
+
+for key in "${ssh_authorized_keys[@]}"; do
+  grep -qxF "$key" "$HOME/.ssh/authorized_keys" || echo "$key" >> "$HOME/.ssh/authorized_keys"
+done
+
+# Public-key-only: no passwords, no keyboard-interactive fallback.
+# mosh's initial handshake goes through sshd, so this covers it too.
+sudo install -d -m 755 /etc/ssh/sshd_config.d
+sudo tee /etc/ssh/sshd_config.d/10-pubkey-only.conf > /dev/null <<'EOF'
+PubkeyAuthentication yes
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+ChallengeResponseAuthentication no
+AuthenticationMethods publickey
+EOF
+
+sudo systemctl reload sshd
+
 if [ ! -d "$HOME/repos/yay" ]; then
 	mkdir -p "$HOME/repos"
 	cd "$HOME/repos"