From 8c2230f158b1080d6c9479278c50dbceddce16ff Mon Sep 17 00:00:00 2001
From: hektor <hektor.misplon@pm.me>
Date: Thu, 2 Jul 2026 20:22:01 +0200
Subject: [PATCH] fix(deploy): set up 'deploy-rs' wrapper for hardware-backed
 SSH keys

---
 home/modules/deploy/default.nix            | 14 ++++++++-
 home/modules/deploy/deploy-rs-wrapper.bash | 34 ++++++++++++++++++++++
 2 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 home/modules/deploy/deploy-rs-wrapper.bash

diff --git a/home/modules/deploy/default.nix b/home/modules/deploy/default.nix
index 47b3954d..62647471 100644
--- a/home/modules/deploy/default.nix
+++ b/home/modules/deploy/default.nix
@@ -17,6 +17,7 @@ let
   ) hostNames;
 
   colmena = inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena;
+  deployRs = inputs.deploy-rs.packages.${pkgs.stdenv.hostPlatform.system}.default;
 
   hostTags = hostname: (myUtils.hostMeta (hostDir + "/${hostname}")).tags;
   nodeTagsDecl = ''
@@ -36,6 +37,14 @@ let
         builtins.readFile ./colmena-wrapper.bash
       );
   };
+
+  deployRsWrapped = pkgs.writeShellApplication {
+    name = "deploy";
+    runtimeInputs = [ pkgs.openssh ];
+    text = lib.replaceStrings [ "@deploy@" ] [ "${deployRs}/bin/deploy" ] (
+      builtins.readFile ./deploy-rs-wrapper.bash
+    );
+  };
 in
 {
   options.deploy.enable = lib.mkEnableOption "deploy";
@@ -48,7 +57,10 @@ in
       }
     ];
 
-    home.packages = [ colmenaWrapped ];
+    home.packages = [
+      colmenaWrapped
+      deployRsWrapped
+    ];
     programs.ssh.settings = lib.genAttrs hostsWithKeys (
       hostname:
       let
diff --git a/home/modules/deploy/deploy-rs-wrapper.bash b/home/modules/deploy/deploy-rs-wrapper.bash
new file mode 100644
index 00000000..fc98be63
--- /dev/null
+++ b/home/modules/deploy/deploy-rs-wrapper.bash
@@ -0,0 +1,34 @@
+# `deploy` wrapper script that opens a short-lived SSH master process for
+# `deploy-rs` to use so it works with hardware-backed key touch+PIN. assumes
+# ControlPath ~/.ssh/socket-%r@%h:%p (see ./default.nix)
+
+# extract the target host from the `deploy-rs` flake target (e.g. `.#hecuba`)
+node=""
+for arg in "$@"; do
+  case "$arg" in
+    -*) ;;
+    *'#'*)
+      node="${arg#*#}"   # strip flake ref up to '#'
+      node="${node%%@*}" # strip '@user'
+      node="${node%%.*}" # strip '.profile'
+      ;;
+  esac
+done
+
+master=0
+if [[ -n "$node" ]] && ! ssh -O check "$node" 2>/dev/null; then
+  # place ssh client into "master" mode for connection sharing (see `man ssh`)
+  if ssh -fNM "$node"; then
+    master=1
+  fi
+fi
+
+rc=0
+@deploy@ "$@" || rc=$?
+
+# request the master process to exit (see `man ssh`)
+if ((master)); then
+  ssh -O exit "$node" 2>/dev/null || true
+fi
+
+exit "$rc"