Mortdecai
2028508cb9
config/ssh_homelab now carries the curated alias set from ~/bin/CLAUDE.md (pve nodes, machines, key CTs, switch, tailscale hosts). Interactive auth uses a NEW key, id_ed25519_homelab, because the existing id_ed25519 is rrsync-jailed on pve173 and sshd honours the first matching authorized_keys line per key — one key can't be both a jail and a shell there. - setup.sh generates id_ed25519_homelab (idempotent) - backup.sh pins the jailed key: -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519 - scripts/authorize-mac-key.sh (run on steel141) appends the pubkey on every LAN host via claude's aliases; wired into run.sh - bedroom alias: seth -> root (matches steel141; was undocumented) Verified from the Mac: 12 aliases land as the right user@host; the backup key is refused a shell by rrsync (checked with id — rrsync whitelists true); backup.sh still runs. Offline at push time: bedroom thinkcentre seth-pi pinail openclaw2 — re-run authorize-mac-key.sh when they're up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
81 lines
1.9 KiB
Plaintext
81 lines
1.9 KiB
Plaintext
# Included from ~/.ssh/config (setup.sh adds the Include line). Two keys, both made by setup.sh:
|
|
# ~/.ssh/id_ed25519_homelab interactive — authorized on the hosts below by scripts/authorize-mac-key.sh
|
|
# ~/.ssh/id_ed25519 backup only — rrsync-jailed on pve173; backup.sh pins it with -i
|
|
# They must stay separate: sshd honours the FIRST matching authorized_keys line per key, so one key
|
|
# can't be both jailed (nightly rsync) and unrestricted (a shell) on pve173.
|
|
|
|
# --- Proxmox nodes ---
|
|
Host pve173
|
|
HostName 192.168.0.173
|
|
User root
|
|
Host pve112
|
|
HostName 192.168.0.112
|
|
User root
|
|
Host pve197
|
|
HostName 192.168.0.197
|
|
User root
|
|
Host pve241
|
|
HostName 192.168.0.241
|
|
User root
|
|
|
|
# --- Machines ---
|
|
Host steel141
|
|
HostName 192.168.0.141
|
|
User seth
|
|
Host bedroom
|
|
HostName 192.168.0.235
|
|
User root
|
|
Host vdj-rig
|
|
HostName 192.168.0.143
|
|
User seth
|
|
Host thinkcentre
|
|
HostName 192.168.0.211
|
|
User seth
|
|
Host seth-pi
|
|
HostName 192.168.0.102
|
|
User seth
|
|
Host pinail
|
|
HostName 192.168.0.203
|
|
User pi
|
|
# TP-Link switch: password only (no pubkey support) — $HOMELAB_PASSWORD
|
|
Host switch
|
|
HostName 192.168.0.250
|
|
User admin
|
|
PubkeyAuthentication no
|
|
|
|
# --- Key CTs ---
|
|
Host caddy
|
|
HostName 192.168.0.185
|
|
User root
|
|
Host openclaw2
|
|
HostName 192.168.0.175
|
|
User root
|
|
Host rtorrent
|
|
HostName 192.168.0.213
|
|
User root
|
|
Host emby
|
|
HostName 192.168.0.215
|
|
User root
|
|
Host mcsmanager
|
|
HostName 192.168.0.244
|
|
User root
|
|
Host pihole
|
|
HostName 192.168.0.153
|
|
User root
|
|
Host arr
|
|
HostName 192.168.0.158
|
|
User root
|
|
|
|
# --- Tailscale-only (dead until Tailscale is logged in on the Mac — docs/manual-checklist.md) ---
|
|
Host yoga
|
|
HostName 100.113.203.99
|
|
User seth
|
|
Host bebop
|
|
HostName 100.78.2.106
|
|
User seth
|
|
|
|
Host *
|
|
IdentityFile ~/.ssh/id_ed25519_homelab
|
|
StrictHostKeyChecking accept-new
|
|
ServerAliveInterval 30
|