nixos/ssh: add /etc/ssh/ssh_known_hosts2 to GlobalKnownHostsFile

[beviu]

The motivation is to have a way to add host keys without storing them in the NixOS configuration or Nix store, since /etc/ssh/ssh_known_hosts is already written to by the programs.ssh module.

The default for GlobalKnownHostsFile already contains /etc/ssh/ssh_known_hosts2 so this matches other distributions.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[drupol]

I understand the motivation behind this but I think the file naming should be updated.

[beviu]

I agree that the name is not great! But this is the same name as what upstream uses in the default configuration so it would not be a name that NixOS invented. I feel like it makes sense to use that name because then it aligns NixOS with other distributions that don't change the default configuration and already load that file if it exists.

[beviu]

Oh no, there was already discussion there that I missed: #146939 (comment) and there was commit 98c3d19 that explicitely removed this path. Sorry! I still think it would be helpful to add an option to add a known_hosts file outside of the store though, but maybe not with this path.