Commit 0f1dd1956be5

Vincent Demeester <vincent@sbr.pm>
2026-06-11 12:55:55
feat(aomi): use TPM SSH key for auth and commit signing
Replace the dead vincent@aomi ed25519 key (private part lost in the Fedora reinstall) with the TPM-sealed ecdsa key in authorized_keys and git signing config, and sign commits by default on aomi since the TPM key needs no touch.
main
1 parent f519e2e
Changed files (2)
home
common
shell
git.nix
globals.nix
home/common/shell/git.nix
@@ -32,7 +32,8 @@ let
     kyushu = "${pkgs.writeText "yubikey5-fido2-signing" "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGF/BoGqFc5/pM40bF/2UhWzRFaDmS4hJ45VtpXjUh36AAAAC3NzaDpzaWduaW5n"}";
     # Okinawa uses a regular ed25519 key (no yubikey dependency)
     okinawa = "${pkgs.writeText "okinawa-ed25519" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILfT4qPT4nH+K6wfhnM4JCtflrUEIXPAYpqdN7W7TOBo vincent@okinawa-passage"}";
-    aomi = "${pkgs.writeText "aomi" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILJmTdMKYdgqpbQWBif58VBuwX+GqMGsMfB1ey1TKrM3 vincent@aomi"}";
+    # aomi (Fedora): TPM-sealed ecdsa key via ssh-tpm-agent (machine-bound, no touch)
+    aomi = "${pkgs.writeText "aomi-tpm" "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGEL1A++UUsFnGmnrIR8S6A8IUFkR5WyxDPol2bs02TY0O+sWOPJFJZIAKqcWVSUIkxRoktUBMRe0mMZyiHa3jw= vdemeest@aomi-tpm"}";
   };
   defaultSSHKey = sshkeyPerHost.kyushu;
   getSSHKeyForHost =
@@ -44,7 +45,7 @@ let
   ];
   # List of allowed SSH signing keys for git commit verification
   allowedSigners = ''
-    vincent@aomi ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILJmTdMKYdgqpbQWBif58VBuwX+GqMGsMfB1ey1TKrM3
+    vincent@aomi ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGEL1A++UUsFnGmnrIR8S6A8IUFkR5WyxDPol2bs02TY0O+sWOPJFJZIAKqcWVSUIkxRoktUBMRe0mMZyiHa3jw=
     vincent@kyushu sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGF/BoGqFc5/pM40bF/2UhWzRFaDmS4hJ45VtpXjUh36AAAAC3NzaDpzaWduaW5n
     vincent@okinawa ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILfT4qPT4nH+K6wfhnM4JCtflrUEIXPAYpqdN7W7TOBo
   '';
@@ -73,7 +74,8 @@ in
       # FIXME: This should change depending on the host (could be different yubikey, …)
       key = getSSHKeyForHost hostname;
       # key = "${pkgs.writeText "yubikey5-c1" "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGHMa4rHuBbQQYv+8jvlkFCD2VYRGA4+5fnZAhLx8iDirzfEPqHB60UJWcDeixnJCUlpJjzFbS4crNOXhfCTCTE="}";
-      signByDefault = false;
+      # Sign by default on aomi (TPM-backed, no touch); opt-in elsewhere.
+      signByDefault = hostname == "aomi";
     };
 
     attributes = [
globals.nix
@@ -14,7 +14,8 @@ _: {
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBqhe3iS2058Ro8jN0b5Sr1tb+fEyqwgEmEC7vCM0za4 vincent@kyushu-passage"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/CgISZ5XVyg8eYH7b56EWo4UGplOzzZKdtMKtkZqxc vincent@okinawa-passage"
       # Host keys (trusted machines)
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILJmTdMKYdgqpbQWBif58VBuwX+GqMGsMfB1ey1TKrM3 vincent@aomi"
+      # aomi user key: TPM-sealed ecdsa via ssh-tpm-agent (machine-bound, no touch)
+      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGEL1A++UUsFnGmnrIR8S6A8IUFkR5WyxDPol2bs02TY0O+sWOPJFJZIAKqcWVSUIkxRoktUBMRe0mMZyiHa3jw= vdemeest@aomi-tpm"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE3iD9Eaf5xglTyP+kIO9t8qQpF2H42rQ2AuUibs2hn7 vincent@aion"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGThdcaPfIaB7d+K5uODqEusLKGI5ZCye0aNOCaMoInO Kyushu's ssh key"
       # Boox (osaka) Termux