Commit 7a25605f403d

Vincent Demeester <vincent@sbr.pm>
2026-07-29 14:08:22
feat(ssh): cross-trust aomi/kyushu TPM keys
Added trusted access between aomi-tpm and kyushu-tpm keys so each workstation accepts the other's TPM key. Managed authorized_keys via home-manager for Fedora hosts (aomi, kyushu) using the existing registry.
main
1 parent 6129e51
Changed files (2)
home
common
shell
openssh.nix
globals.nix
home/common/shell/openssh.nix
@@ -362,6 +362,11 @@ in
       IdentityFile ~/.ssh/id_ed25519
     '';
   };
+  # Fedora hosts have no NixOS openssh.authorizedKeys; manage via home-manager.
+  home.file.".ssh/authorized_keys" = lib.mkIf (isAomi || isKyushu) {
+    text =
+      lib.concatStringsSep "\n" (libx.authorizedKeysFor globals.ssh.vincent hostname "vincent") + "\n";
+  };
   home.file.".ssh/ssh_known_hosts".text = libx.sshKnownHosts globals.machines;
   home.file.".ssh/ssh_known_hosts.redhat".text = ''
     # Red Hat
globals.nix
@@ -80,14 +80,20 @@ _: {
       # Gated to git push+pull on carthage only.
       aomi-tpm = {
         key = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGEL1A++UUsFnGmnrIR8S6A8IUFkR5WyxDPol2bs02TY0O+sWOPJFJZIAKqcWVSUIkxRoktUBMRe0mMZyiHa3jw= vdemeest@aomi-tpm";
-        access.vincent.carthage = {
-          gated = "aomi-git";
+        access.vincent = {
+          carthage = {
+            gated = "aomi-git";
+          };
+          kyushu = "trusted";
         };
       };
       kyushu-tpm = {
         key = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBc8oKSsUPsgbOB+yrqLpxdI3lt0ONhlHhTwbnrobSgDat5J/w0ZOsHJUPNU/O2Hyqd9l0UXz3d7rnwfN1sO0tQ= vdemeest@kyushu-tpm";
-        access.vincent.carthage = {
-          gated = "kyushu-git";
+        access.vincent = {
+          carthage = {
+            gated = "kyushu-git";
+          };
+          aomi = "trusted";
         };
       };
       # aion host key: has automation (restic backup to aix).