fix(deploy): set up 'deploy-rs' wrapper for hardware-backed SSH keys

home/modules/deploy/default.nix

@@ -17,6 +17,7 @@ let
   ) hostNames;
 
   colmena = inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena;
+  deployRs = inputs.deploy-rs.packages.${pkgs.stdenv.hostPlatform.system}.default;
 
   hostTags = hostname: (myUtils.hostMeta (hostDir + "/${hostname}")).tags;
   nodeTagsDecl = ''
@@ -36,6 +37,14 @@ let
         builtins.readFile ./colmena-wrapper.bash
       );
   };
+
+  deployRsWrapped = pkgs.writeShellApplication {
+    name = "deploy";
+    runtimeInputs = [ pkgs.openssh ];
+    text = lib.replaceStrings [ "@deploy@" ] [ "${deployRs}/bin/deploy" ] (
+      builtins.readFile ./deploy-rs-wrapper.bash
+    );
+  };
 in
 {
   options.deploy.enable = lib.mkEnableOption "deploy";
@@ -48,7 +57,10 @@ in
       }
     ];
 
-    home.packages = [ colmenaWrapped ];
+    home.packages = [
+      colmenaWrapped
+      deployRsWrapped
+    ];
     programs.ssh.settings = lib.genAttrs hostsWithKeys (
       hostname:
       let

home/modules/deploy/deploy-rs-wrapper.bash

@@ -0,0 +1,34 @@
+# `deploy` wrapper script that opens a short-lived SSH master process for
+# `deploy-rs` to use so it works with hardware-backed key touch+PIN. assumes
+# ControlPath ~/.ssh/socket-%r@%h:%p (see ./default.nix)
+
+# extract the target host from the `deploy-rs` flake target (e.g. `.#hecuba`)
+node=""
+for arg in "$@"; do
+  case "$arg" in
+    -*) ;;
+    *'#'*)
+      node="${arg#*#}"   # strip flake ref up to '#'
+      node="${node%%@*}" # strip '@user'
+      node="${node%%.*}" # strip '.profile'
+      ;;
+  esac
+done
+
+master=0
+if [[ -n "$node" ]] && ! ssh -O check "$node" 2>/dev/null; then
+  # place ssh client into "master" mode for connection sharing (see `man ssh`)
+  if ssh -fNM "$node"; then
+    master=1
+  fi
+fi
+
+rc=0
+@deploy@ "$@" || rc=$?
+
+# request the master process to exit (see `man ssh`)
+if ((master)); then
+  ssh -O exit "$node" 2>/dev/null || true
+fi
+
+exit "$rc"