After some discussion on #guix, this seems to be the easier way to fix the problem:
Vivien
From d029179554fc2f9656f708e5315bca52928e9254 Mon Sep 17 00:00:00 2001 From: Vivien Kraus <viv...@planete-kraus.eu> Date: Fri, 29 Oct 2021 18:25:24 +0200 Subject: [PATCH] gnu: openssh-service: Collect all keys for all users. * gnu/services/ssh.scm: (authorized-key-directory)[build]: ensure that no key is forgotten. --- gnu/services/ssh.scm | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index a018052eeb..1309e062ce 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -532,10 +532,16 @@ (define (openssh-pam-services config) (define (extend-openssh-authorized-keys config keys) "Extend CONFIG with the extra authorized keys listed in KEYS." - (openssh-configuration - (inherit config) - (authorized-keys - (append (openssh-authorized-keys config) keys)))) + (let ((all-keys (make-hash-table))) + (for-each + (match-lambda + ((user keys ...) + (hash-set! all-keys user (append (hash-ref all-keys user '()) keys)))) + (append (openssh-authorized-keys config) keys)) + (openssh-configuration + (inherit config) + (authorized-keys + (hash-map->list cons all-keys))))) (define openssh-service-type (service-type (name 'openssh) -- 2.33.1
