(defun authorized-keys (user)
  (sprintf "/home/%s/.ssh/authorized_keys" user))

  (let ((me "jjl")
        (my-ak (authorized-keys me)))

  (let* ((me "jjl")
         (my-dot-ssh (sprintf "/home/%s/.ssh" me))
         (my-ak (sprintf "%s/%s" my-dot-ssh "authorized_keys")))

    (dir-exists my-dot-ssh "755" me me)

     my-ak "0644" me me

     my-ak "644" me me

  (package-installed "doas")

  (package-installed "doas" nil)

   "/usr/local/etc/doas.conf" "0644" "root" "wheel"

   "/usr/local/etc/doas.conf" "644" "root" "wheel"

     "/boot/loader.conf.d/fibs.conf" "0644" "root" "wheel"

     "/boot/loader.conf.d/fibs.conf" "644" "root" "wheel"

         (file-contents (string-join "\n" loads)))

         (file-contents (apply string-join "\n" loads)))

     "0644" "root" "wheel"
     (sprintf "load modules: %s" (string-join " " module-names))

     "644" "root" "wheel"
     (sprintf "load modules: %s" (apply string-join " " module-names))

   "/etc/devfs.rules" "0600" "root" "wheel"

   "/etc/devfs.rules" "600" "root" "wheel"

(defun openssh-listen-only-on ips
  (let ((c "/etc/ssh/sshd_config")
        (lines
         (string-join "\n" (mapcar
                            (lambda (a) (sprintf "ListenAddress %s" a))
                            ips))))
    (delete-lines-matching c "^ListenAddress")
    (insert-line-before c lines "^#ListenAddress")))

(defun host-common-bits ()
  (add-jjl)
  (doas-for-wheel)
  (FreeBSD-boot-fibs 3)
  (FreeBSD-boot-load-modules "redundancy" '("carp" "pfsync"))
  (FreeBSD-devfs-firewall-jail-rules)
  (sysrc :set "sshd_enable" "YES")
  (sysrc :set "ntpd_enable" "YES")
  ;; NTP sync on start is not going to work because our route out is
  ;; via the jail which we haven't started yet eh.
  (sysrc :set "powerd_enable" "YES")
  (sysrc :set "jail_enable" "YES")
  (sysrc :set "cloned_interfaces" "epair72")
  ;; this isn't going to get an address before the jail starts but i
  ;; think that's ok.
  (sysrc :set "ifconfig_epair72_ipv6" "accept_rtadv"))