alexion
f18b40091c
The operator's SSH client key existed only as a file created by hand on one laptop, so a reimage would destroy it and lock the operator out of the remote. It now lives in neogaia's own secrets file, encrypted to the admin identity and neogaia alone, and the client is pointed at the decrypted path rather than a copy in the user's home. Access becomes a policy over roles instead of a per-host list of keys. A new fleet declaration names each machine's role and client public key, and every machine derives what it authorizes from that: a workstation admits workstations alone, a server admits both, so a compromised server reaches no machine of the operator's own. Registering a machine is an entry in that one file. Only neogaia exists, so the server half of the policy is built rather than exercised. Two assertions reject a machine missing from the fleet and any entry whose role no policy defines.
9 lines
262 B
Nix
9 lines
262 B
Nix
# Every machine, its role, and the public half of the client key it
|
|
# authenticates with.
|
|
{
|
|
neogaia = {
|
|
role = "workstation";
|
|
sshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE contact@alexion.dev";
|
|
};
|
|
}
|