Mortdecai
2028508cb9
config/ssh_homelab now carries the curated alias set from ~/bin/CLAUDE.md (pve nodes, machines, key CTs, switch, tailscale hosts). Interactive auth uses a NEW key, id_ed25519_homelab, because the existing id_ed25519 is rrsync-jailed on pve173 and sshd honours the first matching authorized_keys line per key — one key can't be both a jail and a shell there. - setup.sh generates id_ed25519_homelab (idempotent) - backup.sh pins the jailed key: -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519 - scripts/authorize-mac-key.sh (run on steel141) appends the pubkey on every LAN host via claude's aliases; wired into run.sh - bedroom alias: seth -> root (matches steel141; was undocumented) Verified from the Mac: 12 aliases land as the right user@host; the backup key is refused a shell by rrsync (checked with id — rrsync whitelists true); backup.sh still runs. Offline at push time: bedroom thinkcentre seth-pi pinail openclaw2 — re-run authorize-mac-key.sh when they're up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
13 lines
970 B
Bash
Executable File
13 lines
970 B
Bash
Executable File
#!/opt/homebrew/bin/bash
|
|
# Nightly by launchd (config/xyz.sethpc.mac-backup.plist). Mirrors the DAW-relevant
|
|
# dirs to tank. History comes from sanoid snapshots of tank/backups/mac on pve173,
|
|
# which is what makes `--delete` safe.
|
|
set -euo pipefail
|
|
src=()
|
|
for d in "$HOME/Music/Ableton" "$HOME/Documents"; do [[ -d $d ]] && src+=("$d"); done
|
|
[[ ${#src[@]} -gt 0 ]] || { echo "nothing to back up yet"; exit 0; }
|
|
# Remote path is relative to the rrsync root (/tank/backups/mac) set in root's authorized_keys on pve173.
|
|
# -i pins the jailed key; the Host * default (id_ed25519_homelab) has a root shell on pve173 and must NOT be offered first.
|
|
# Check the jail holds: ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 root@192.168.0.173 id -> "rrsync error: ... does not run rsync" (NOT `true`: rrsync whitelists it as a ping).
|
|
exec /opt/homebrew/bin/rsync -a --delete -e "ssh -o BatchMode=yes -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519" "${src[@]}" root@192.168.0.173:/
|