2 files changed, 14 insertions, 2 deletions

diff --git a/flakes/private/system/flake.lock b/flakes/private/system/flake.lock
index 49fb3b5..a675105 100644
--- a/flakes/private/system/flake.lock
+++ b/flakes/private/system/flake.lock
@@ -19,7 +19,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-VO82m/95IcX3xxJ63wcLh3hXzXDRFKUohYil/18pBSY=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../environment",
         "type": "path"
       },
@@ -69,7 +69,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-etK0kcWYmiCmdex+9CjWWqn4q8EonDutUP0yFH+odrE=",
+        "narHash": "sha256-r3UkR0dalaU+FjmDcrMkXeT3BOJryAVzX7Sp8pihjno=",
         "path": "../../mypackages",
         "type": "path"
       },
diff --git a/flakes/private/system/flake.nix b/flakes/private/system/flake.nix
index ad6c58c..9010140 100644
--- a/flakes/private/system/flake.nix
+++ b/flakes/private/system/flake.nix
@@ -30,6 +30,17 @@
           secrets.deleteSecretsVars = true;
           secrets.secretsVars = "/run/keys/vars.yml";
 
+          programs.ssh.package = lib.mkDefault (
+            pkgs.openssh.overrideAttrs(old: rec {
+              patches = old.patches ++ [
+                # Mitigation for CVE https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
+                (pkgs.fetchpatch {
+                  url = "https://raw.githubusercontent.com/NixOS/nixpkgs/342bfe5c431fd7828fee8fa7e07a4d8fbfd18618/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch";
+                  sha256 = "sha256-B3Wz/eWSdOnrOcVzDv+QqzLGdFlb3jivQ8qZMC3d0Qw=";
+                })
+              ];
+            })
+          );
           services.openssh.enable = true;
 
           nixpkgs.overlays =
@@ -54,6 +65,7 @@
           users.users.acme.uid = myuids.lib.uids.acme;
           environment.systemPackages = [
             pkgs.inetutils
+            pkgs.btop
             pkgs.htop
             pkgs.iftop
             pkgs.bind.dnsutils