diff --git a/config/hosts.nix b/config/hosts.nix
index 0012d47..ecc90d5 100644
--- a/config/hosts.nix
+++ b/config/hosts.nix
@@ -132,9 +132,17 @@
 
     spark = {
       description = "Niten's backup desktop.";
+      ssh-fingerprints = [
+        "1 1 d26812dee9b26a19a52c38d2b346442979093142"
+        "1 2 981db46fdd0ad1639651c700a527602425237c1d4999265372ed92e093a965b3"
+        "4 1 67fa0a36e51fd4a5ed2b71ff9817cb9a372d0a63"
+        "4 2 c17d46061d722e1e6c878341b8e3c0bf87ea6e0e1426c54a989107dfb604d81b"
+      ];
       rp = "niten";
       admin-email = "niten@fudo.org";
       enable-gui = true;
+      ssh-pubkey =
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO67/CNhiG9UynaflmZUUK7f3O/GwFpnXri/PxpgHcPa";
     };
 
     upstairs-desktop = {
@@ -153,9 +161,17 @@
 
     zbox = {
       description = "Niten's primary desktop.";
+      ssh-fingerprints = [
+        "1 1 3aff8c913615c81512be3a42fc83daeb90d94a3d"
+        "1 2 39c7500f08022963f3f2db4f3ebb7aad08c92d0cc937984ba86c4eba204ed493"
+        "4 1 862842d99f5afb33db4f073d2f3d1154c6417110"
+        "4 2 373536d3d59f2354b1bfc25c02120c86e9b3af574b6c1984210d9e9c1d5244e3"
+      ];
       rp = "niten";
       admin-email = "niten@fudo.org";
       enable-gui = true;
+      ssh-pubkey =
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKVhHfRf2086SAqOmu2dNbsJI9UUAQWop+1lrcJlNgl8";
     };
   };
 }
diff --git a/config/profiles/common.nix b/config/profiles/common.nix
index 19df54d..647bb48 100644
--- a/config/profiles/common.nix
+++ b/config/profiles/common.nix
@@ -53,20 +53,6 @@ in {
         GSSAPIKeyExchange yes
         GSSAPIStoreCredentialsOnRekey yes
       '';
-      # FIXME: add all the hosts we know about
-      knownHosts = {
-        # publicKey, hostNames
-      };
-    };
-
-    lshd = {
-      enable = true;
-      portNumber = 2112;
-      rootLogin = true;
-      srpKeyExchange = true;
-      tcpForwarding = false;
-      publicKeyAuthentication = true;
-      passwordAuthentication = false;
     };
 
     fail2ban = {
diff --git a/home-manager/niten.nix b/home-manager/niten.nix
index b883a69..58eeb6c 100644
--- a/home-manager/niten.nix
+++ b/home-manager/niten.nix
@@ -26,6 +26,7 @@ let
     imagemagick
     ipfs
     iptables
+    jdk
     jq
     leiningen
     libisofs
diff --git a/lib/fudo/sites.nix b/lib/fudo/sites.nix
index 61179bb..03599be 100644
--- a/lib/fudo/sites.nix
+++ b/lib/fudo/sites.nix
@@ -2,58 +2,62 @@
 
 with lib;
 let
+  hostname = config.instance.hostname;
+  site-name = config.fudo.hosts.${hostname}.site;
+  site-cfg = config.fudo.sites.${site-name};
+
   siteOpts = { site, ... }: {
-    options = {
+    options = with types; {
       site = mkOption {
-        type = types.str;
+        type = str;
         description = "Site name.";
         default = site;
       };
 
       network = mkOption {
-        type = types.str;
+        type = str;
         description = "Network to be treated as local.";
       };
 
       dynamic-network = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Network to be allocated by DHCP.";
         default = null;
       };
 
       gateway-v4 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Gateway to use for public ipv4 internet access.";
         default = null;
       };
 
       gateway-v6 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Gateway to use for public ipv6 internet access.";
         default = null;
       };
 
       gateway-host = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Identity of the host to act as a gateway.";
         default = null;
       };
 
       local-groups = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description = "List of groups which should exist at this site.";
         default = [ ];
       };
 
       local-users = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description =
           "List of users which should exist on all hosts at this site.";
         default = [ ];
       };
 
       local-admins = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description =
           "List of admin users which should exist on all hosts at this site.";
         default = [ ];
@@ -63,16 +67,34 @@ let
         mkEnableOption "Enable site-wide monitoring with prometheus.";
 
       nameservers = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description = "List of nameservers to be used by hosts at this site.";
         default = [ ];
       };
 
       timezone = mkOption {
-        type = types.str;
+        type = str;
         description = "Timezone of the site.";
         example = "America/Winnipeg";
       };
+
+      deploy-pubkey = mkOption {
+        type = nullOr str;
+        description = "SSH pubkey of site deploy key. Used by dropbear daemon.";
+        default = null;
+      };
+
+      dropbear-rsa-key-path = mkOption {
+        type = str;
+        description = "Location of Dropbear RSA key.";
+        default = "/etc/dropbear/host_rsa_key";
+      };
+
+      dropbear-ecdsa-key-path = mkOption {
+        type = str;
+        description = "Location of Dropbear ECDSA key.";
+        default = "/etc/dropbear/host_ecdsa_key";
+      };
     };
   };
 
@@ -82,4 +104,45 @@ in {
     description = "Site configurations for all sites known to the system.";
     default = { };
   };
+
+  config = mkIf (site-cfg.deploy-pubkey != null) {
+    environment.etc."dropbear/authorized_keys" = {
+      text = "root@deploy ${site-cfg.deploy-pubkey}";
+      mode = "0400";
+    };
+
+    systemd.services = let dropbear-port = 2112;
+    in {
+
+      dropbear-init = {
+        wantedBy = [ "multi-user.target" ];
+        script = ''
+          if [ ! -d /etc/dropbear ]; then
+            mkdir /etc/dropbear
+            chmod 700 /etc/dropbear
+          fi
+
+          if [ ! -f ${site-cfg.dropbear-rsa-key-path} ]; then
+            ${pkgs.dropbear}/bin/dropbearkey -t rsa -f ${site-cfg.dropbear-rsa-key-path}
+            ${pkgs.coreutils}/bin/chmod 0400 ${site-cfg.dropbear-rsa-key-path}
+          fi
+
+          if [ ! -f ${site-cfg.dropbear-ecdsa-key-path} ]; then
+            ${pkgs.dropbear}/bin/dropbearkey -t ecdsa -f ${site-cfg.dropbear-ecdsa-key-path}
+            ${pkgs.coreutils}/bin/chmod 0400 ${site-cfg.dropbear-ecdsa-key-path}
+          fi
+        '';
+      };
+
+      dropbear = {
+        requires = [ "dropbear-init.service" ];
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          type = "simple";
+          ExecStart = "${pkgs.dropbear} -F -m -s -j -k -p ${dropbear-port}";
+        };
+      };
+    };
+  };
 }