Commit f730bbc4ba9f

@@ -121,6 +121,14 @@ in
           lib.optionalAttrs (isAion || isOkinawa) (
             builtins.listToAttrs (map mkOverride allHostIds ++ map mkShpoolOverride allHostIds)
           );
+        # aomi: route GitHub through the TPM key (served by ssh-tpm-agent) instead
+        # of the FIDO2 sk-key, so pushes work unattended without a touch prompt.
+        aomiOverrides = lib.optionalAttrs isAomi {
+          "github.com" = {
+            identityFile = "~/.ssh/id_tpm_ecdsa.pub";
+            identitiesOnly = true;
+          };
+        };
       in
       lib.recursiveUpdate
         (
@@ -261,9 +269,11 @@ in
           }
         )
         (
-          lib.recursiveUpdate criticalInfraOverrides (
-            lib.recursiveUpdate kyushuOverrides (lib.recursiveUpdate okinawaOverrides nonFido2Overrides)
-          )
+          lib.recursiveUpdate
+            (lib.recursiveUpdate criticalInfraOverrides (
+              lib.recursiveUpdate kyushuOverrides (lib.recursiveUpdate okinawaOverrides nonFido2Overrides)
+            ))
+            aomiOverrides
         );
     extraConfig = ''
       # IdentityAgent /run/user/1000/yubikey-agent/yubikey-agent.sock