Mortdecai
2028508cb9
config/ssh_homelab now carries the curated alias set from ~/bin/CLAUDE.md (pve nodes, machines, key CTs, switch, tailscale hosts). Interactive auth uses a NEW key, id_ed25519_homelab, because the existing id_ed25519 is rrsync-jailed on pve173 and sshd honours the first matching authorized_keys line per key — one key can't be both a jail and a shell there. - setup.sh generates id_ed25519_homelab (idempotent) - backup.sh pins the jailed key: -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519 - scripts/authorize-mac-key.sh (run on steel141) appends the pubkey on every LAN host via claude's aliases; wired into run.sh - bedroom alias: seth -> root (matches steel141; was undocumented) Verified from the Mac: 12 aliases land as the right user@host; the backup key is refused a shell by rrsync (checked with id — rrsync whitelists true); backup.sh still runs. Offline at push time: bedroom thinkcentre seth-pi pinail openclaw2 — re-run authorize-mac-key.sh when they're up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
13 lines
983 B
Bash
Executable File
13 lines
983 B
Bash
Executable File
#!/bin/bash
|
|
# From steel141: put the Mac's interactive pubkey on every LAN host in config/ssh_homelab, via
|
|
# claude's own aliases (same names, same target users). Idempotent; called by run.sh, safe alone.
|
|
# steel141 itself is the one exception: seth's authorized_keys needs sudo from the claude account.
|
|
set -euo pipefail
|
|
PUB=$(ssh -o BatchMode=yes mac cat .ssh/id_ed25519_homelab.pub)
|
|
[[ $PUB == ssh-ed25519\ AAAA* ]] || { echo "no ~/.ssh/id_ed25519_homelab on the Mac — run setup.sh first"; exit 1; }
|
|
ADD='umask 077; mkdir -p ~/.ssh; if grep -qF "$PUB" ~/.ssh/authorized_keys 2>/dev/null; then echo "[skip] $H"; else echo "$PUB" >> ~/.ssh/authorized_keys; echo "[set] $H"; fi'
|
|
for H in pve112 pve173 pve197 pve241 bedroom vdj-rig thinkcentre seth-pi pinail caddy openclaw2 rtorrent emby mcsmanager pihole arr; do
|
|
ssh -o BatchMode=yes -o ConnectTimeout=5 "$H" "PUB='$PUB' H=$H bash -s" <<<"$ADD" || echo "[FAIL] $H"
|
|
done
|
|
sudo -n -u seth env PUB="$PUB" H=steel141 bash -c "$ADD"
|