use multiple env variables to force git https

git seems to fail with ssh, at least to github

hosts/swan/default.nix

@@ -19,6 +19,7 @@ nixpkgs.lib.nixosSystem {
     disko.nixosModules.disko
     {
       server = true;
+      zfs.enable = true;
       gui.enable = false;
       theme = { colors = (import ../../colorscheme/gruvbox).dark; };
       nixpkgs.overlays = overlays;
@@ -36,9 +37,9 @@ nixpkgs.lib.nixosSystem {
 
       neovim.enable = true;
 
-      boot.zfs.enabled = true;
-      boot.kernelPackages =
-        config.boot.zfs.package.latestCompatibleLinuxPackages;
+      # boot.zfs.enabled = true;
+      # boot.kernelPackages =
+      # config.boot.zfs.package.latestCompatibleLinuxPackages;
       # boot.zfs.extraPools = [ "mypool" ];
       # services.zfs.autoScrub.enable = true;
       # services.zfs.autoScrub.interval = "daily";

hosts/swan/hardware-configuration.nix

@@ -12,6 +12,16 @@
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "vfat";
+  };
+
   swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

modules/common/repositories/dotfiles.nix

@@ -14,7 +14,13 @@
           [ "writeBoundary" ] ''
             if [ ! -d "${config.dotfilesPath}" ]; then
                 $DRY_RUN_CMD mkdir --parents $VERBOSE_ARG $(dirname "${config.dotfilesPath}")
-                $DRY_RUN_CMD ${pkgs.git}/bin/git clone ${config.dotfilesRepo} "${config.dotfilesPath}"
+
+                # Force HTTPS because anonymous SSH doesn't work
+                GIT_CONFIG_COUNT=1 \
+                    GIT_CONFIG_KEY_0="url.https://github.com/.insteadOf" \
+                    GIT_CONFIG_VALUE_0="git@github.com:" \
+                    $DRY_RUN_CMD \
+                    ${pkgs.git}/bin/git clone ${config.dotfilesRepo} "${config.dotfilesPath}"
             fi
           '';
 

modules/nixos/hardware/default.nix

@@ -10,6 +10,7 @@
     ./server.nix
     ./sleep.nix
     ./wifi.nix
+    ./zfs.nix
   ];
 
   options = {

modules/nixos/hardware/zfs.nix

@@ -0,0 +1,14 @@
+{ config, pkgs, lib, ... }: {
+
+  options = { zfs.enable = lib.mkEnableOption "ZFS file system."; };
+
+  config =
+    lib.mkIf (pkgs.stdenv.isLinux && config.server && config.zfs.enable) {
+
+      # Only use compatible Linux kernel, since ZFS can be behind
+      boot.kernelPackages =
+        config.boot.zfs.package.latestCompatibleLinuxPackages;
+
+    };
+
+}

modules/nixos/services/sshd.nix

@@ -17,11 +17,13 @@
       services.openssh = {
         enable = true;
         ports = [ 22 ];
-        passwordAuthentication = false;
-        gatewayPorts = "no";
-        forwardX11 = false;
         allowSFTP = true;
-        permitRootLogin = config.permitRootLogin;
+        settings = {
+          GatewayPorts = "no";
+          X11Forwarding = false;
+          PasswordAuthentication = false;
+          PermitRootLogin = config.permitRootLogin;
+        };
       };
 
       users.users.${config.user}.openssh.authorizedKeys.keys =