docs(tasks): add task 0019, user SSH keys and an access policy #5

alexion · 2026-07-20T09:29:55-04:00

alexion commented

2026-07-20 09:29:55 -04:00

Task: .claude/tasks/0019-user-ssh-keys-and-access-policy.md

Planning only — no configuration changes. Deliberately carries no spec field.

The operator's SSH client key currently exists only as a hand-created file on one laptop, in no secrets file and no module, so a reimage destroys it. That is worse than losing a host key: a lost host key makes clients complain about known_hosts, while a lost client key locks the operator out of the remote until a new key is generated and registered through the web interface.

Per-machine identities, not one shared across the fleet. The private half lives in that machine's own secrets file, so a compromised machine surrenders only its own key and withdrawing access is removing one public key rather than re-keying every other machine.

Access as a role policy, not a per-host list of authorized keys:

a workstation may reach every machine
a server may reach other servers only

So every machine authorizes the workstation keys, servers additionally authorize the server keys, and a workstation never authorizes a server's key — a compromised server cannot reach the operator's own machines. This wants one declaration of the fleet naming each machine's role and public key, so registering a machine is a role declaration rather than an edit to every other host.

Only neogaia exists, so the server half has nothing to act on and is recorded rather than exercised.

The task adopts the key already on neogaia instead of generating a fresh one, since it is already registered with the remote — replacing it would require registering the new key before the old one stops being used, an ordering that locks the operator out if it goes wrong.

Blocked by #4, which introduces the per-host secrets file and its recipient rule. It also settles the gap task 0010 left open, where the daemon accepts connections but authorizes no key.

— Claude

Task: `.claude/tasks/0019-user-ssh-keys-and-access-policy.md` Planning only — no configuration changes. Deliberately carries no `spec` field. The operator's SSH client key currently exists only as a hand-created file on one laptop, in no secrets file and no module, so a reimage destroys it. That is worse than losing a host key: a lost host key makes clients complain about `known_hosts`, while a lost client key locks the operator out of the remote until a new key is generated and registered through the web interface. **Per-machine identities**, not one shared across the fleet. The private half lives in that machine's own secrets file, so a compromised machine surrenders only its own key and withdrawing access is removing one public key rather than re-keying every other machine. **Access as a role policy**, not a per-host list of authorized keys: - a workstation may reach every machine - a server may reach other servers only So every machine authorizes the workstation keys, servers additionally authorize the server keys, and a workstation never authorizes a server's key — a compromised server cannot reach the operator's own machines. This wants one declaration of the fleet naming each machine's role and public key, so registering a machine is a role declaration rather than an edit to every other host. Only `neogaia` exists, so the server half has nothing to act on and is recorded rather than exercised. The task adopts the key already on `neogaia` instead of generating a fresh one, since it is already registered with the remote — replacing it would require registering the new key before the old one stops being used, an ordering that locks the operator out if it goes wrong. Blocked by #4, which introduces the per-host secrets file and its recipient rule. It also settles the gap task 0010 left open, where the daemon accepts connections but authorizes no key. — Claude

alexion referenced this pull request

2026-07-20 09:30:13 -04:00

feat(neogaia): restore the SSH host keys from sops (task 0011) #4

alexion added 1 commit 2026-07-20 09:51:51 -04:00

docs(tasks): add task 0019, user SSH keys and an access policy 11d7cb053c

Per-machine client identities, so a compromised machine surrenders only
its own key, plus a role-based rule for which machines may reach which.
Only neogaia exists, so the server half is recorded rather than exercised.

alexion force-pushed task-0019-user-ssh-keys-and-access-policy from cb7cd3d4b0 to 11d7cb053c

2026-07-20 09:51:51 -04:00

Compare

alexion merged commit 11d7cb053c into main

2026-07-20 09:52:06 -04:00

alexion deleted branch task-0019-user-ssh-keys-and-access-policy

2026-07-20 09:52:06 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: alexion/dotfiles#5