### /usr/lib/dracut/modules.d/46sshd/module-setup.sh
#!/bin/bash

check() {
    require_binaries sshd || return 1
    # 0 enables by default, 255 only on request
    return 0
}

depends() {
	echo systemd-networkd
}

install() {
	local key_type ssh_host_key authorized_keys

	# copy keys from host
	for key_type in dsa ecdsa ed25519 rsa; do
		ssh_host_key=/etc/ssh/"$key_prefix"ssh_host_"$key_type"_key
		if [ -f "$ssh_host_key" ]; then
			inst_simple "$ssh_host_key".pub /etc/ssh/ssh_host_"$key_type"_key.pub
			/usr/bin/install -m 600 "$ssh_host_key" \
				"$initdir/etc/ssh/ssh_host_${key_type}_key"
		fi
	done

	# copy authorized_keys from root
	authorized_keys=/root/.ssh/authorized_keys
	if [ ! -r "$authorized_keys" ]; then
		dfatal "No authorized_keys for root user found!"
		return 1
	fi

	mkdir -p -m 0700 "$initdir/root"
	mkdir -p -m 0700 "$initdir/root/.ssh"
	/usr/bin/install -m 600 "$authorized_keys" \
		"$initdir/root/.ssh/authorized_keys"

	# create privilege seperation directory
	mkdir -p -m 0755 "$initdir/run/sshd"

	# copy sshd and gpg
	inst_simple /usr/sbin/sshd
	inst_simple /usr/bin/gpg
	inst_simple /usr/bin/gpg-agent
	inst_simple /usr/bin/gpgconf
	inst_simple /etc/default/ssh
	inst_simple "${moddir}/sshd_config" /etc/ssh/sshd_config
	inst_simple /etc/default/ssh
	grep '^sshd:' /etc/passwd >> "$initdir/etc/passwd"
	grep '^sshd:' /etc/group  >> "$initdir/etc/group"
	inst_simple /root/.gnupg/pubring.kbx

	# enable sshd service
	inst_simple "${moddir}/sshd.service" "$systemdsystemunitdir/sshd.service"
	systemctl --root "$initdir" enable sshd

	# copy network config
	inst_multiple -o /etc/systemd/network/*

	# copy root key and script
	inst_simple /usr/sbin/cryptsetup
	inst_simple /root/root-keyfile.gpg
    inst_simple "${moddir}/mount.sh" /root/mount.sh

	# bash config
	echo systemd-tty-ask-password-agent >> "$initdir/root/.bash_history"
	chmod 600 "$initdir/root/.bash_history"

	return 0
}


### /usr/lib/dracut/modules.d/46sshd/mount.sh
#!/bin/sh

set -e

gpg --output /tmp/root-keyfile --decrypt /root/root-keyfile.gpg

cryptsetup luksOpen --key-file /tmp/root-keyfile /dev/nvme0n1p3 nvme0n1p3_crypt

systemctl stop systemd-cryptsetup@nvme0n1p3_crypt.service

### /usr/lib/dracut/modules.d/46sshd/sshd_config
SyslogFacility                  AUTHPRIV
PermitRootLogin                 prohibit-password
AuthorizedKeysFile              .ssh/authorized_keys
AuthenticationMethods           publickey
ChallengeResponseAuthentication no
UsePAM                          no
X11Forwarding                   no
PrintMotd                       no
AcceptEnv                       LANG LC_*
StreamLocalBindUnlink           yes

### /usr/lib/dracut/modules.d/46sshd/sshd.service
[Unit]
Description=OpenBSD Secure Shell server
Documentation=man:sshd(8) man:sshd_config(5)
DefaultDependencies=no
Before=cryptsetup.target

[Service]
EnvironmentFile=-/etc/default/ssh
ExecStartPre=/usr/sbin/sshd -t
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
ExecReload=/usr/sbin/sshd -t
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartPreventExitStatus=255
Type=notify
RuntimeDirectory=sshd
RuntimeDirectoryMode=0755

[Install]
WantedBy=sysinit.target
Alias=sshd.service