configuration.nix

{ ... }:

let
  pkgs-unstable = import (builtins.fetchurl https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz) { config = {}; };
  secrets = import ./secrets.nix;
in {
  environment.systemPackages = [ pkgs-unstable.hello ];
  programs.ssh.knownHosts = [
    { hostNames = [ "github.com" ]; publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; }
  ] ++ secrets.knownHosts;
  users.users.clever.initialPasswordHash = secrets.pass_hash;
}

secrets.nix

{
  knownHosts = [
    { hostNames = [ "192.168.2.1" "router.localnet" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSvyvC18BHfivZJDhWSm7VU3kEElfNfMIfeohkil614"; }
  ];
  pass_hash = "foo!";
}