From 4d0977c482060ac160412477f4d28e54dcd9508c Mon Sep 17 00:00:00 2001
From: Alexander Heldt <me@alexanderheldt.se>
Date: Tue, 20 Oct 2026 21:59:21 +0200
Subject: [PATCH] backwards/pinwheel: Add SSH key for backwards to access
 pinwheel

Pinwheel's sshd had no way to accept keys from other hosts. Give it the
same `authorizedKeysCommand` setup as backwards and manatee, and authorize
a new `alex.backwards-pinwheel` key that backwards uses for `ssh pinwheel`.
---
 hosts/backwards/modules/ssh/default.nix       |  20 +++++++++++++++++
 hosts/pinwheel/modules/ssh/default.nix        |  21 ++++++++++++++++++
 secrets/backwards/alex.backwards-pinwheel.age | Bin 0 -> 786 bytes
 .../backwards/alex.backwards-pinwheel.pub.age | Bin 0 -> 537 bytes
 secrets/secrets.nix                           |   2 ++
 5 files changed, 43 insertions(+)
 create mode 100644 secrets/backwards/alex.backwards-pinwheel.age
 create mode 100644 secrets/backwards/alex.backwards-pinwheel.pub.age

diff --git a/hosts/backwards/modules/ssh/default.nix b/hosts/backwards/modules/ssh/default.nix
index ef0ae92..eb9e551 100644
--- a/hosts/backwards/modules/ssh/default.nix
+++ b/hosts/backwards/modules/ssh/default.nix
@@ -31,6 +31,13 @@ in
             Port = 1122;
           };
 
+          "pinwheel" = {
+            HostName = "pinwheel";
+            User = "alex";
+            IdentityFile = "/home/alex/.ssh/alex.backwards-pinwheel";
+            Port = 1122;
+          };
+
           "git.ppp.pm" = {
             HostName = "git.ppp.pm";
             IdentityFile = "/home/alex/.ssh/alex.backwards-git.ppp.pm";
@@ -115,6 +122,19 @@ in
         group = "users";
       };
 
+      "alex.backwards-pinwheel" = {
+        file = ../../../../secrets/backwards/alex.backwards-pinwheel.age;
+        path = "/home/alex/.ssh/alex.backwards-pinwheel";
+        owner = "alex";
+        group = "users";
+      };
+      "alex.backwards-pinwheel.pub" = {
+        file = ../../../../secrets/backwards/alex.backwards-pinwheel.pub.age;
+        path = "/home/alex/.ssh/alex.backwards-pinwheel.pub";
+        owner = "alex";
+        group = "users";
+      };
+
       "alex.pinwheel-backwards.pub" = {
         file = ../../../../secrets/pinwheel/alex.pinwheel-backwards.pub.age;
         path = "${authorizedKeysPath}/alex.pinwheel-backwards.pub";
diff --git a/hosts/pinwheel/modules/ssh/default.nix b/hosts/pinwheel/modules/ssh/default.nix
index 1f75335..6b60305 100644
--- a/hosts/pinwheel/modules/ssh/default.nix
+++ b/hosts/pinwheel/modules/ssh/default.nix
@@ -1,4 +1,7 @@
 { pkgs, ... }:
+let
+  authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
+in
 {
   # Enable gnome-keyring at system level for PAM integration
   services.gnome.gnome-keyring.enable = true;
@@ -154,6 +157,21 @@
       owner = "alex";
       group = "users";
     };
+
+    "alex.backwards-pinwheel.pub" = {
+      file = ../../../../secrets/backwards/alex.backwards-pinwheel.pub.age;
+      path = "${authorizedKeysPath}/alex.backwards-pinwheel.pub";
+    };
+  };
+
+  environment.etc."ssh/authorized_keys_command" = {
+    mode = "0755";
+    text = ''
+      #!${pkgs.bash}/bin/bash
+      for file in ${authorizedKeysPath}/*; do
+        ${pkgs.coreutils}/bin/cat "$file"
+      done
+    '';
   };
 
   services.openssh = {
@@ -166,5 +184,8 @@
         type = "ed25519";
       }
     ];
+
+    authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
+    authorizedKeysCommandUser = "root";
   };
 }
diff --git a/secrets/backwards/alex.backwards-pinwheel.age b/secrets/backwards/alex.backwards-pinwheel.age
new file mode 100644
index 0000000000000000000000000000000000000000..e285517b95c379bf2d3636f932e6a24eed48da2a
GIT binary patch
literal 786
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+C^hg1PglrG4Aalf
zkMs=A3^GkC@CgquFYqleO$yHNb1u(`G<UKH4mS)73JfgEF6PQMb<Z|SNew7+(k}8d
zjqp$LjPmkxGp@)?ElG1stn#l2Nv*1Ki!AUr&PKOQJKrzSBT&KA!=ozStk}ofUq7TY
zJ0icL%F8Q5J2@!HxWrW3D7Dzk+u1$I$S=n{Jd!J4+tMpLDI_r`q}(ISIA1#}!lTNt
zs4&Md(l}4QD7nhqsW{1}yx63y(veG7S69I+HKM{Gq%hL4!Z<s}sl+I(B+u2XI58+M
z$SL1B-z7UzKi@dJJToK6KbvdQ;eD3_SDyA!{W;BcspP63b!8_GNLEzFG`DAeR@<yq
zk}Q4jginB=NAX+D@YulC$%Vf?%CmQ$nRw@dtV8*2hJT+04c_;c+<mLsGv{!J*`bRk
z&h~vew(MQQ#cH9fpQ?E=>iPy#roLqe3Sygnh{NGwuGy24{@DlawG`PX)_(uM_``Zu
z%o6(uxw;%i?gx@n8pQhN`u+L7T0?jai;163_O8XYZecfM-w0hl^i{b^wz_Kd#rf89
zDvy}5v)6UVu{Vjo7M47+*m0(UU&8*leIhBJ4n+Gdi`)9Hz4!Kpz<t^^G2dpba*EJp
zZrH3)zU)#(t;bK6ne9i5BGRil%-W}{xs=3n^{l^o|LqI=PCm1f+E{P%VSx<8i9hz`
z4w1qZ_WA9VJ#+tY_2`;iVEO-PSqtykC9-=NeCINGWX|hQx%uX6nB1!$?7Z=7`@cFJ
z%D61SH9hu$nDZ)!FvBkHyp7E_xOF1$yxQ&as;FpcUV7V??UEc%mR<eoRM>FhZ>wWq
zXY-cYI?vO;dY(+P=4NOtYoFxc&1dDGwaO^`<n6js#&bFjtc?B}`=RNn#cpHAg7RF2
zCqW{6f5sU_f60yI7V@>-wr1X^Y}p(BrM%y^XSMvbRFBB5S4;EZ{^jkHw4x+NSz^UK
X1FJHjg(vTadMjobIIQbdUMLO#&WKI|

literal 0
HcmV?d00001

diff --git a/secrets/backwards/alex.backwards-pinwheel.pub.age b/secrets/backwards/alex.backwards-pinwheel.pub.age
new file mode 100644
index 0000000000000000000000000000000000000000..5016233bb3a9fa8d8220bbef0d3b44fdb6800a88
GIT binary patch
literal 537
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+C^hg1PggK0^~=r;
z4Rj844hqn=w5$kp_A9lph;;GtwKUGxPxW&vG<PzwaPn{oE9NruGI1+(_B8T0N(&4v
zOV_T<v`i^7t_n*x@HDE*3(>9!4NOZe@l6XdG(fkltRf&ODqW#UyP(X~)xsw%I59HN
z%*W8jGf=-uyP_)7q}VmX#Um%swIs(g#6KV~+=8nzyD}rK$g9fBFg3l@HO<vO$Ga%f
z-8(1E!X?ntqbRXBFFYg1!Xh$1uo&Go?R>vPk3fZrEb|agfAjF1()661B<J$nAU|Wr
z0{v7c3zMWEa}WRYf&!!99Pi3J_eiclgNWSxV0UA~3gbdI<0wb3O2_Q*Br|8Hs>-M^
z11A#?#}L!Jq)2~{ykah0U0sEc2+txfpY;4Fr-)4Fw8&z&aKm(iFq6zmiz=Taw{#cR
zV%KsvV`pa<r*f{kdzri~`~N&XGu^qOh;@Z(&kTl8{YA~3?2W5mXMMNwiV@1PTfTSx
z?~<s5Z!G=6!4DYaP3sgL&I!(ReP?E=tnz;QnrWBTMB8z4gx!4Ut(q0Pqg^oQO}6NY
z+0v?Z%;yCPjw+Q*P}wf_E4KbulV0Ne2hT57<V`FN;#LaT_tI>K?WD!K+V=!#9(WA^
DBUQcQ

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 23c8cb0..aacccf1 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -56,6 +56,8 @@ in {
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-manatee.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-manatee.pub.age".publicKeys = [ backwards manatee alex ];
+  "backwards/alex.backwards-pinwheel.age".publicKeys = [ backwards alex ];
+  "backwards/alex.backwards-pinwheel.pub.age".publicKeys = [ backwards pinwheel alex ];
   "backwards/alex.backwards-git.ppp.pm.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-git.ppp.pm.pub.age".publicKeys = [ backwards alex ];
   "backwards/wireless-network-secrets.age".publicKeys = [ backwards alex ];