Add agent identity on accessible fleet

Signed-off-by: Mel <mel@rnrd.eu>

4 files changed, 24 insertions, 5 deletions

diff --git a/modules/foundation/agent.nix b/modules/foundation/agent.nix
index 6ac25aa..9a9d295 100644
--- a/modules/foundation/agent.nix
+++ b/modules/foundation/agent.nix
@@ -10,6 +10,8 @@ let
   inherit (lib) mkEnableOption mkIf mkMerge;
   cfg = config.foundation.agent;
 
+  agentPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAppvnIQdnwggxcsNtm7ij85qjABRHe2b4/NGwCfzTr5 agent";
+
   # the set of tools the agent has access to by default.
   # it should also always be able to call `nix-shell` to gain access to more tools.
   agentPackages = with pkgs; [
@@ -61,7 +63,8 @@ in
   };
 
   config = mkMerge [
-    # both the home and each neighbor have a user for the agent.
+    # both the home and each neighbor have a user for the agent,
+    # the identity of the user is the same on the entire fleet.
     (mkIf (cfg.home || cfg.neighbor) {
       users = {
         groups.renard = { };
@@ -73,14 +76,28 @@ in
           createHome = true;
           shell = pkgs.bashInteractive;
           packages = agentPackages;
+
+          openssh.authorizedKeys.keys = [ agentPublicKey ];
         };
       };
+
+      systemd.tmpfiles.rules = [
+        "d /home/renard/.ssh 0700 renard renard - -"
+      ];
+
+      age.secrets.renard-agent-private-key = {
+        file = ../../secrets/agent/private-key.age;
+        path = "/home/renard/.ssh/id_ed25519";
+        owner = "renard";
+        group = "renard";
+        mode = "0600";
+      };
     })
 
     # the agent lives at home.
     (mkIf cfg.home {
-      age.secrets.renard-agent = {
-        file = ../../secrets/renard-agent.age;
+      age.secrets.renard-agent-environment = {
+        file = ../../secrets/agent/environment.age;
         owner = "renard";
         group = "renard";
         mode = "0440";
@@ -104,7 +121,7 @@ in
           # * OPENROUTER_API_KEY
           # * DISCORD_BOT_TOKEN
           # * DISCORD_ALLOWED_USERS
-          config.age.secrets.renard-agent.path
+          config.age.secrets.renard-agent-environment.path
         ];
 
         documents = {
diff --git a/secrets/renard-agent.age b/secrets/agent/environment.age
index 0409f71..0409f71 100644
--- a/secrets/renard-agent.age
+++ b/secrets/agent/environment.age
Binary files differdiff --git a/secrets/agent/private-key.age b/secrets/agent/private-key.age
new file mode 100644
index 0000000..3fc501d
--- /dev/null
+++ b/secrets/agent/private-key.age
Binary files differdiff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 9b09574..24a4abb 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -27,10 +27,12 @@ in
     renard
   ] ++ allAdmins;
 
-  "renard-agent.age".publicKeys = [
+  "agent/environment.age".publicKeys = [
     renard
   ] ++ allAdmins;
 
+  "agent/private-key.age".publicKeys = allSystems ++ allAdmins;
+
   "mullvad-gluetun.age".publicKeys = [
     corsac
   ] ++ allAdmins;