Commit `b52ad45d9b73`

Vincent Demeester <vincent@sbr.pm>

2026-06-30 11:23:35

feat(ssh): route aomi carthage access via TPM key

Point carthage.vpn and carthage.sbr.pm at the TPM key on aomi so git push and pull run unattended without a touch prompt. The server-side praetorian gate restricts this no-touch key to git over ~/git, which makes routing carthage through it safe.

main

1 parent 40d3087

Changed files (1)

home

common

shell

openssh.nix

@@ -165,6 +165,18 @@ in
             identityFile = "~/.ssh/id_tpm_ecdsa.pub";
             identitiesOnly = true;
           };
+          # carthage gates the aomi TPM key to git push+pull (praetorian), so route
+          # carthage through it instead of the touch-required critical-infra key:
+          # unattended git works without a touch prompt, and the server-side gate
+          # makes the no-touch key safe (only git over ~/git is allowed).
+          "carthage.vpn" = {
+            identityFile = "~/.ssh/id_tpm_ecdsa.pub";
+            identitiesOnly = true;
+          };
+          "carthage.sbr.pm" = {
+            identityFile = "~/.ssh/id_tpm_ecdsa.pub";
+            identitiesOnly = true;
+          };
         };
       in
       lib.recursiveUpdate

Commit b52ad45d9b73

Commit `b52ad45d9b73`