0 Fork 0

mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00

Files

T

ryan4yin | 二花 7cfda39c2c feat: log in and sudo over SSH with a CanoKey touch

The CanoKey resident SSH key (`ryan@canokey-moe`, the backup once a new primary key is enrolled) is now authorized for ryan and root on every host, and sudo on server and agent hosts accepts its touch through the forwarded agent (`pam_rssh`). Without the key or a forwarded agent, sudo asks for the password and login falls back to the file keys. Only `canokeySshKeys` can satisfy sudo.

Risks to weigh:

- Colmena deploys need one touch per host connection, since the agent offers the CanoKey key first.
- Desktops now forward the agent to every `hostsAddr` alias, as they already did for `192.168.*`; while a session is open, root there can request signatures, each needing a touch.

### Verification

- `just test` exits 0; CI passed on the first commit.
- Evaluated: sudo PAM stack `rssh` → `unix` → `deny` on shoryu, kana, akane and k3s-test-1-master-1, ai-niri keeps `pam_u2f`; shoryu root and ryan list `ryan@canokey-moe`.
- Not yet verified on a running host.

### Manual step after merge

Deploy the servers, then `just niri`; close old multiplexed connections (`ssh -O exit <host>`) and try `sudo true` over SSH.

AI assistance: DeepSeek Harness (claude-opus-5-5).

Assisted-by: DeepSeek Harness (claude-opus-5-5)

2026-11-06 03:26:59 -06:00

base

feat: log in and sudo over SSH with a CanoKey touch

2026-11-06 03:26:59 -06:00

darwin

refactor(shells): use native Home Manager Nushell and Nushell login on non-desktop hosts (#513 )

2026-11-03 22:31:24 +08:00

hosts

feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516 )

2026-11-04 01:50:21 -06:00

linux

feat(nixpak): sandbox Steam and Heroic in ~/Gaming (#520 )

2026-11-06 02:18:33 -06:00

README.md

refactor: host profiles; give ruby, kana and aquamarine the TUI home (#512 )

2026-11-03 04:57:06 -06:00

README.md

Home Manager's Submodules

This directory contains all Home Manager configurations organized by platform and functionality.

Current Structure

home/
├── base/              # Cross-platform home manager configurations (see base/README.md)
├── linux/             # Linux-specific home manager configurations
│   ├── base/          # Linux base configurations
│   ├── gui/           # Linux GUI applications
│   │   ├── i3/        # i3 — headless computer-use session (see i3/README.md)
│   │   ├── niri/      # Niri window manager
│   │   └── ...
│   └── ...
├── hosts/             # Host-specific home manager entry modules
│   ├── linux/         # Linux host home modules (idols-ai, 12kingdoms-shoukei, idols-aquamarine, idols-kana, idols-ruby)
│   └── darwin/        # macOS host home modules (fern, frieren)
└── darwin/            # macOS-specific home manager configurations
    ├── proxy/         # Proxy configurations
    └── ...

Module Overview

base: The base module suitable for both Linux and macOS
- Cross-platform applications and settings
- Shared configurations for editors, shells, and essential tools
linux: Linux-specific configuration
- Desktop environments (Noctalia Shell, Niri compositor)
- Headless computer-use session (see linux/gui/i3/README.md)
- Linux-specific GUI applications
- System integration tools
darwin: macOS-specific configuration
- macOS applications and services
- Platform-specific integrations (Squirrel, etc.)
hosts: Host entry modules for Home Manager
- Each output should reference only one host home module file
- Host modules are responsible for importing shared stacks (home/linux/* or home/darwin) and applying host overrides