Commit 4dd98d4aec84

Vincent Demeester <vincent@sbr.pm>
2026-07-02 09:55:04
feat(ssh): add carthage-admin alias for full shell access
Carthage's default ssh entry is pinned to the git-only TPM key gated by praetorian, so interactive shell access needs the unrestricted FIDO2 sk-key. Added a dedicated carthage-admin alias on aomi that selects the sk-key, providing a clean escape hatch without overriding the identity inline each time.
main
1 parent 1f3071f
Changed files (3)
dots
config
emacs
eshell
lastdir
.org-id-locations
home
common
shell
openssh.nix
dots/config/emacs/eshell/lastdir
@@ -1,16 +0,0 @@
-/home/vincent/src
-/home/vincent
-/home/vincent/desktop/downloads
-~/src/gitlab.com/chmouel/rc-config/aichat
-/ssh:aomi.home:~/src/home
-/sshx:aomi.home:~/src/home
-/ssh:aomi.home:~/src/home
-~/src/home
-~/src/tektoncd/pipeline
-/sshx:aomi.home:~/src/home
-~/src/home
-/home/vincent/src/tektoncd/pipeline/main
-~
-/home/vincent/src/home
-/home/vincent/src/tektoncd
-/home/vincent/src/home
dots/config/emacs/.org-id-locations
@@ -1,2 +0,0 @@
-
-(("~/desktop/org/todos.org" #("cebe49a8-26b3-4e0f-b19a-f59e26ae44c9" 0 36 (fontified t face org-property-value jinx--pending t)) #("c5879aee-78e9-42c3-b890-003a2e608930" 0 36 (fontified t face org-property-value jinx--pending t))) ("~/desktop/org/archive/work" #("a7964503-3312-4479-b86a-f9ae29307b9b" 0 28 (fontified t face org-property-value jinx--pending t) 28 36 (fontified nil face org-property-value)) #("7b899463-a336-46ef-9f85-ae1676d43108" 0 36 (fontified t face org-property-value jinx--pending t))))
home/common/shell/openssh.nix
@@ -177,6 +177,15 @@ in
             identityFile = "~/.ssh/id_tpm_ecdsa.pub";
             identitiesOnly = true;
           };
+          # Full interactive/admin access to carthage. The default carthage.vpn
+          # entry is pinned to the git-only TPM key, so shell access must go
+          # through the unrestricted FIDO2 sk-key (requires a Yubikey touch).
+          "carthage-admin" = {
+            hostname = "10.100.0.1";
+            user = "vincent";
+            identityFile = "~/.ssh/id_critical_infra_sk";
+            identitiesOnly = true;
+          };
         };
       in
       lib.recursiveUpdate