scripts/tank-automount.sh (run on the Mac, password on stdin) adds a /-
direct map and root-owned /etc/auto_smb pointing at //Administrator@
192.168.0.173/tank with soft. Mounts on first access, unmounts idle, so
the laptop can leave the LAN without hung Finder or login dialogs.
Findings baked in:
- macOS automount does not create direct-map trigger dirs -> mkdir -p
- automounted fs are always nobrowse (man auto_master): shows as a
folder, not a Locations drive -> Finder Favorite (manual-checklist)
- no-tty sudo ticket is per parent pid: sudo inside $(...) fails, so the
idempotency check is a pipeline (sudo cmp -s -)
- SMB over NFS: Mac seth is uid 501; SMB force user=root matches /mnt/Z
Also: checklist Gitea key -> id_ed25519_homelab; the smb://.../tank
'user seth' step was wrong (no such Samba user) and is now the automount.
Wired into run.sh. Verified: mount, root-owned write, two all-[skip] reruns.
Not yet verified across a reboot (FileVault).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
config/ssh_homelab now carries the curated alias set from ~/bin/CLAUDE.md
(pve nodes, machines, key CTs, switch, tailscale hosts). Interactive auth
uses a NEW key, id_ed25519_homelab, because the existing id_ed25519 is
rrsync-jailed on pve173 and sshd honours the first matching authorized_keys
line per key — one key can't be both a jail and a shell there.
- setup.sh generates id_ed25519_homelab (idempotent)
- backup.sh pins the jailed key: -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519
- scripts/authorize-mac-key.sh (run on steel141) appends the pubkey on every
LAN host via claude's aliases; wired into run.sh
- bedroom alias: seth -> root (matches steel141; was undocumented)
Verified from the Mac: 12 aliases land as the right user@host; the backup key
is refused a shell by rrsync (checked with id — rrsync whitelists true);
backup.sh still runs. Offline at push time: bedroom thinkcentre seth-pi
pinail openclaw2 — re-run authorize-mac-key.sh when they're up.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ssh re-splits remote command args on spaces, so -- "$PUB" arrived as $1=ssh-ed25519
(the key body and comment became $2/$3). The loose validation passed and grep -qF
matched any ed25519 key -> false '[skip] key present'; the key was never added.
Pass PUB via env (safe inside remote single-quotes) and require 'ssh-ed25519 AAAA*'.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Piping a password into ssh -tt's pty raced and hung on the real run (worked in
a fast test, blocked for 14 min in practice). Replace with a temp
/etc/sudoers.d/mac-setup installed by _install_sudoers.sh (validated
before activation), removed on every exit path plus a 40-min on-Mac
self-destruct. setup.sh now fails fast if passwordless sudo is absent
instead of depending on a primed tty ticket.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mortdecai