diff options
Diffstat (limited to 'modules/foundation/agent.nix')
| -rw-r--r-- | modules/foundation/agent.nix | 25 |
1 files changed, 21 insertions, 4 deletions
diff --git a/modules/foundation/agent.nix b/modules/foundation/agent.nix index 6ac25aa..9a9d295 100644 --- a/modules/foundation/agent.nix +++ b/modules/foundation/agent.nix @@ -10,6 +10,8 @@ let inherit (lib) mkEnableOption mkIf mkMerge; cfg = config.foundation.agent; + agentPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAppvnIQdnwggxcsNtm7ij85qjABRHe2b4/NGwCfzTr5 agent"; + # the set of tools the agent has access to by default. # it should also always be able to call `nix-shell` to gain access to more tools. agentPackages = with pkgs; [ @@ -61,7 +63,8 @@ in }; config = mkMerge [ - # both the home and each neighbor have a user for the agent. + # both the home and each neighbor have a user for the agent, + # the identity of the user is the same on the entire fleet. (mkIf (cfg.home || cfg.neighbor) { users = { groups.renard = { }; @@ -73,14 +76,28 @@ in createHome = true; shell = pkgs.bashInteractive; packages = agentPackages; + + openssh.authorizedKeys.keys = [ agentPublicKey ]; }; }; + + systemd.tmpfiles.rules = [ + "d /home/renard/.ssh 0700 renard renard - -" + ]; + + age.secrets.renard-agent-private-key = { + file = ../../secrets/agent/private-key.age; + path = "/home/renard/.ssh/id_ed25519"; + owner = "renard"; + group = "renard"; + mode = "0600"; + }; }) # the agent lives at home. (mkIf cfg.home { - age.secrets.renard-agent = { - file = ../../secrets/renard-agent.age; + age.secrets.renard-agent-environment = { + file = ../../secrets/agent/environment.age; owner = "renard"; group = "renard"; mode = "0440"; @@ -104,7 +121,7 @@ in # * OPENROUTER_API_KEY # * DISCORD_BOT_TOKEN # * DISCORD_ALLOWED_USERS - config.age.secrets.renard-agent.path + config.age.secrets.renard-agent-environment.path ]; documents = { |