backwards/pinwheel: Add SSH key for backwards to access pinwheel

Pinwheel's sshd had no way to accept keys from other hosts. Give it the
same `authorizedKeysCommand` setup as backwards and manatee, and authorize
a new `alex.backwards-pinwheel` key that backwards uses for `ssh pinwheel`.

hosts/backwards/modules/ssh/default.nix

@@ -31,6 +31,13 @@ in
             Port = 1122;
           };
 
+          "pinwheel" = {
+            HostName = "pinwheel";
+            User = "alex";
+            IdentityFile = "/home/alex/.ssh/alex.backwards-pinwheel";
+            Port = 1122;
+          };
+
           "git.ppp.pm" = {
             HostName = "git.ppp.pm";
             IdentityFile = "/home/alex/.ssh/alex.backwards-git.ppp.pm";
@@ -115,6 +122,19 @@ in
         group = "users";
       };
 
+      "alex.backwards-pinwheel" = {
+        file = ../../../../secrets/backwards/alex.backwards-pinwheel.age;
+        path = "/home/alex/.ssh/alex.backwards-pinwheel";
+        owner = "alex";
+        group = "users";
+      };
+      "alex.backwards-pinwheel.pub" = {
+        file = ../../../../secrets/backwards/alex.backwards-pinwheel.pub.age;
+        path = "/home/alex/.ssh/alex.backwards-pinwheel.pub";
+        owner = "alex";
+        group = "users";
+      };
+
       "alex.pinwheel-backwards.pub" = {
         file = ../../../../secrets/pinwheel/alex.pinwheel-backwards.pub.age;
         path = "${authorizedKeysPath}/alex.pinwheel-backwards.pub";

hosts/pinwheel/modules/ssh/default.nix

@@ -1,4 +1,7 @@
 { pkgs, ... }:
+let
+  authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
+in
 {
   # Enable gnome-keyring at system level for PAM integration
   services.gnome.gnome-keyring.enable = true;
@@ -154,6 +157,21 @@
       owner = "alex";
       group = "users";
     };
+
+    "alex.backwards-pinwheel.pub" = {
+      file = ../../../../secrets/backwards/alex.backwards-pinwheel.pub.age;
+      path = "${authorizedKeysPath}/alex.backwards-pinwheel.pub";
+    };
+  };
+
+  environment.etc."ssh/authorized_keys_command" = {
+    mode = "0755";
+    text = ''
+      #!${pkgs.bash}/bin/bash
+      for file in ${authorizedKeysPath}/*; do
+        ${pkgs.coreutils}/bin/cat "$file"
+      done
+    '';
   };
 
   services.openssh = {
@@ -166,5 +184,8 @@
         type = "ed25519";
       }
     ];
+
+    authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
+    authorizedKeysCommandUser = "root";
   };
 }

secrets/secrets.nix

@@ -56,6 +56,8 @@ in {
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-manatee.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-manatee.pub.age".publicKeys = [ backwards manatee alex ];
+  "backwards/alex.backwards-pinwheel.age".publicKeys = [ backwards alex ];
+  "backwards/alex.backwards-pinwheel.pub.age".publicKeys = [ backwards pinwheel alex ];
   "backwards/alex.backwards-git.ppp.pm.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-git.ppp.pm.pub.age".publicKeys = [ backwards alex ];
   "backwards/wireless-network-secrets.age".publicKeys = [ backwards alex ];