Arg, fucking port forwarding is shit

lib/fudo/hosts.nix

@@ -4,21 +4,28 @@ with lib;
 let
   hostOpts = { hostname, ... }: {
     options = with types; {
-      hostname = mkOption {
-        type = types.str;
-        description = "Hostname (without domain name).";
-        default = hostname;
-      };
-
       domain = mkOption {
-        type = types.str;
+        type = str;
         description =
-          "Domain to which the host belongs, in the form of a domain name.";
+          "Primary domain to which the host belongs, in the form of a domain name.";
         default = "fudo.org";
       };
 
+      extra-domains = mkOption {
+        type = listOf str;
+        description = "Extra domain in which this host is reachable.";
+        default = [ ];
+      };
+
+      aliases = mkOption {
+        type = listOf str;
+        description =
+          "Host aliases used by the current host. Note this will be multiplied with extra-domains.";
+        default = [ ];
+      };
+
       site = mkOption {
-        type = types.str;
+        type = str;
         description = "Site at which the host is located.";
       };
 
@@ -50,7 +57,7 @@ let
       };
 
       description = mkOption {
-        type = types.str;
+        type = str;
         description = "Description of this host.";
         default = "Another Fudo Host.";
       };
@@ -92,6 +99,13 @@ let
           "List of services which should exist for this host, if it belongs to a realm.";
         default = [ "ssh" "host" ];
       };
+
+      ssh-pubkey = mkOption {
+        type = nullOr str;
+        description =
+          "SSH key of the host. Find with `ssh-keyscan`. Skip the hostname, just type and key.";
+        default = null;
+      };
     };
   };
 
@@ -136,5 +150,32 @@ in {
       enableOnBoot = true;
       autoPrune.enable = true;
     };
+
+    programs.ssh.knownHosts = let
+      keyed-hosts =
+        filterAttrs (host: opts: opts.ssh-pubkey != null) config.fudo.hosts;
+
+      traceOut = obj: builtins.trace obj obj;
+
+      crossProduct = f: list0: list1:
+        concatMap (el0: map (el1: f el0 el1) list1) list0;
+
+      getHostnames = hostOpts:
+        [ hostOpts.hostname ]
+        ++ (crossProduct (host: domain: "${host}.${domain}")
+          ([ hostOpts.hostname ] ++ hostOpts.aliases)
+          ([ hostOpts.domain ] ++ hostOpts.extra-domains));
+
+      getHostEntryPairs = host:
+        map (hostname: nameValuePair hostname { publicKey = host.ssh-pubkey; })
+        (getHostnames host);
+
+      hostAttrsToList = hostAttrs:
+        mapAttrsToList (hostname: opts: { hostname = hostname; } // opts)
+        hostAttrs;
+
+      getKnownHosts = hosts:
+        concatMap getHostEntryPairs (hostAttrsToList hosts);
+    in listToAttrs (getKnownHosts keyed-hosts);
   };
 }