Commit `0e3a3b0c1a31`

Vincent Demeester <vincent@sbr.pm>

2026-06-10 22:44:20

fix(ssh): use resident FIDO2 keys on aomi

aomi (Fedora) has resident FIDO2 sk-keys but was treated as a non-FIDO2 host, forcing the nonexistent ~/.ssh/id_ed25519 with IdentitiesOnly, so homelab and vpn hosts (e.g. carthage.vpn) failed with Permission denied (publickey). Marked aomi as a FIDO2 host and removed it from the non-FIDO2 overrides so the critical-infra and homelab keys are used.

main

1 parent 63a9bd4

Changed files (1)

home

common

shell

openssh.nix

@@ -9,17 +9,30 @@
 }:
 let
   # FIDO2 keys are only available on hosts with Yubikey attached
-  hasFido2Keys = hostname == "kyushu";
+  hasFido2Keys = hostname == "kyushu" || hostname == "aomi";
   isAomi = hostname == "aomi";
   isAion = hostname == "aion";
   isOkinawa = hostname == "okinawa";
 in
 {
-  home.packages = with pkgs; [
-    sshfs
-  ];
-  # Using NixOS programs.ssh.startAgent instead (has proper SSH_ASKPASS support for FIDO2)
-  services.ssh-agent.enable = false;
+  home.packages =
+    with pkgs;
+    [
+      sshfs
+    ]
+    # aomi is Fedora (no NixOS programs.ssh.startAgent); provide a GTK askpass
+    # so FIDO2 sk-key PIN prompts work with the home-manager ssh-agent.
+    ++ lib.optionals isAomi [ openssh-askpass ];
+
+  # NixOS hosts use programs.ssh.startAgent (proper SSH_ASKPASS for FIDO2).
+  # aomi has no NixOS layer, so run a home-manager systemd user ssh-agent.
+  services.ssh-agent.enable = isAomi;
+
+  # FIDO2 sk-keys spawn ssh-sk-helper which needs an askpass for the PIN.
+  home.sessionVariables = lib.mkIf isAomi {
+    SSH_ASKPASS = "${pkgs.openssh-askpass}/libexec/gtk-ssh-askpass";
+    SSH_ASKPASS_REQUIRE = "prefer";
+  };
   programs.ssh = {
     enable = true;
     enableDefaultConfig = false;
@@ -73,7 +86,7 @@ in
             mkOverride = id: lib.nameValuePair id { identityFile = "~/.ssh/id_ed25519"; };
             mkShpoolOverride = id: lib.nameValuePair "${id}/*" { identityFile = "~/.ssh/id_ed25519"; };
           in
-          lib.optionalAttrs (isAomi || isAion || isOkinawa) (
+          lib.optionalAttrs (isAion || isOkinawa) (
             builtins.listToAttrs (map mkOverride allHostIds ++ map mkShpoolOverride allHostIds)
           );
       in

Commit 0e3a3b0c1a31

Commit `0e3a3b0c1a31`