{ pkgs, ... }: {
  # Defines the SSH host key as a clan vars generator so that:
  #   - `clan vars generate <target>` creates and encrypts the key pair
  #   - The private key lives at vars/per-machine/<target>/openssh/ssh_host_ed25519_key/secret
  #     (sops binary-encrypted, admin-key-only; decrypted by the build script)
  #   - The public key lives at vars/per-machine/<target>/openssh/ssh_host_ed25519_key.pub/value
  #     (plaintext; used by sync-host-keys.sh to derive the sops age fingerprint)
  #
  # neededFor = "activation" means clan's deployment tool would upload this
  # before running nixos-rebuild/nixos-install (for VM/baremetal via
  # nixos-anywhere). For lxc-* hosts, the build script bakes it into the
  # tarball directly via NIXOS_HOST_KEYS_DIR -- the neededFor value here
  # simply ensures it is NOT mapped to sops.secrets (which would try to
  # decrypt it at runtime as a regular service secret, which is wrong: the
  # SSH host key reaches the container via the tarball, not sops).
  clan.core.vars.generators.openssh = {
    files."ssh_host_ed25519_key" = {
      secret = true;
      neededFor = "activation";
    };
    files."ssh_host_ed25519_key.pub" = {
      secret = false;
      neededFor = "activation";
    };
    runtimeInputs = [ pkgs.openssh ];
    script = ''
      ssh-keygen -t ed25519 -N "" -C "" -f "$out/ssh_host_ed25519_key"
    '';
  };
}