From a4f17c0cce27b6f05234edfb2d545848937484c7 Mon Sep 17 00:00:00 2001
From: Mel <mel@rnrd.eu>
Date: Tue, 16 Jun 2026 21:38:48 +0200
Subject: Add agent identity on accessible fleet

Signed-off-by: Mel <mel@rnrd.eu>
---
 modules/foundation/agent.nix | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

(limited to 'modules/foundation/agent.nix')

diff --git a/modules/foundation/agent.nix b/modules/foundation/agent.nix
index 6ac25aa..9a9d295 100644
--- a/modules/foundation/agent.nix
+++ b/modules/foundation/agent.nix
@@ -10,6 +10,8 @@ let
   inherit (lib) mkEnableOption mkIf mkMerge;
   cfg = config.foundation.agent;
 
+  agentPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAppvnIQdnwggxcsNtm7ij85qjABRHe2b4/NGwCfzTr5 agent";
+
   # the set of tools the agent has access to by default.
   # it should also always be able to call `nix-shell` to gain access to more tools.
   agentPackages = with pkgs; [
@@ -61,7 +63,8 @@ in
   };
 
   config = mkMerge [
-    # both the home and each neighbor have a user for the agent.
+    # both the home and each neighbor have a user for the agent,
+    # the identity of the user is the same on the entire fleet.
     (mkIf (cfg.home || cfg.neighbor) {
       users = {
         groups.renard = { };
@@ -73,14 +76,28 @@ in
           createHome = true;
           shell = pkgs.bashInteractive;
           packages = agentPackages;
+
+          openssh.authorizedKeys.keys = [ agentPublicKey ];
         };
       };
+
+      systemd.tmpfiles.rules = [
+        "d /home/renard/.ssh 0700 renard renard - -"
+      ];
+
+      age.secrets.renard-agent-private-key = {
+        file = ../../secrets/agent/private-key.age;
+        path = "/home/renard/.ssh/id_ed25519";
+        owner = "renard";
+        group = "renard";
+        mode = "0600";
+      };
     })
 
     # the agent lives at home.
     (mkIf cfg.home {
-      age.secrets.renard-agent = {
-        file = ../../secrets/renard-agent.age;
+      age.secrets.renard-agent-environment = {
+        file = ../../secrets/agent/environment.age;
         owner = "renard";
         group = "renard";
         mode = "0440";
@@ -104,7 +121,7 @@ in
           # * OPENROUTER_API_KEY
           # * DISCORD_BOT_TOKEN
           # * DISCORD_ALLOWED_USERS
-          config.age.secrets.renard-agent.path
+          config.age.secrets.renard-agent-environment.path
         ];
 
         documents = {
-- 
cgit 1.4.1