From 4fc9253fadf533ddd4439fcde2122465014807d5 Mon Sep 17 00:00:00 2001
From: osbm <osbm@osbm.dev>
Date: Sun, 21 Dec 2025 22:00:08 +0300
Subject: [PATCH] permit root login

---
 modules/nixos/services/backup-server.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/nixos/services/backup-server.nix b/modules/nixos/services/backup-server.nix
index f0ad322..dcdb933 100644
--- a/modules/nixos/services/backup-server.nix
+++ b/modules/nixos/services/backup-server.nix
@@ -22,6 +22,10 @@ in
         ;
     };
 
+    # Allow root SSH login for backup clients to pull data
+    # Note: Configure root's authorized keys via users.users.root.openssh.authorizedKeys.keys
+    services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
+
     # Ensure SSH is enabled for backup access
     assertions = [
       {