chore(ssh): rotate 'andromache' to hardware-backed ssh key

home/modules/ai-tools/claude-code.nix

@@ -0,0 +1,71 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.ai-tools.claude-code;
+  rtk-version = "0.18.1";
+in
+{
+  options.ai-tools.claude-code = {
+    enable = lib.mkEnableOption "claude code with rtk and ccline";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      claude-code
+      (pkgs.stdenv.mkDerivation {
+        name = "ccline";
+        src = pkgs.fetchurl {
+          url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
+          hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
+        };
+
+        unpackPhase = ''
+          tar xzf $src
+        '';
+
+        installPhase = ''
+          mkdir -p $out/bin
+          cp ccline $out/bin/
+          chmod +x $out/bin/ccline
+        '';
+
+        meta = with pkgs.lib; {
+          description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
+          homepage = "https://github.com/Haleclipse/CCometixLine";
+          license = licenses.mit;
+          platforms = [ "x86_64-linux" ];
+        };
+      })
+      (pkgs.stdenv.mkDerivation {
+        name = "rtk-${rtk-version}";
+        version = rtk-version;
+        src = pkgs.fetchurl {
+          url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
+          hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
+        };
+
+        unpackPhase = ''
+          tar xzf $src
+        '';
+
+        installPhase = ''
+          mkdir -p $out/bin
+          cp rtk $out/bin/
+          chmod +x $out/bin/rtk
+        '';
+
+        meta = with pkgs.lib; {
+          description = "RTK - AI coding tool enhancer";
+          homepage = "https://www.rtk-ai.app";
+          license = licenses.mit;
+          platforms = [ "x86_64-linux" ];
+        };
+      })
+      mcp-nixos
+    ];
+  };
+}

home/modules/ai-tools/default.nix

@@ -1,116 +1,7 @@
 {
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools;
-  rtk-version = "0.18.1";
-in
-{
-  options.ai-tools = {
-    claude-code.enable = lib.mkEnableOption "claude code with rtk and ccline";
-    tirith.enable = lib.mkEnableOption "tirith shell security guard";
-    opencode.enable = lib.mkEnableOption "opencode";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.claude-code.enable {
-      home.packages = with pkgs; [
-        claude-code
-        (pkgs.stdenv.mkDerivation {
-          name = "ccline";
-          src = pkgs.fetchurl {
-            url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
-            hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
-          };
-
-          unpackPhase = ''
-            tar xzf $src
-          '';
-
-          installPhase = ''
-            mkdir -p $out/bin
-            cp ccline $out/bin/
-            chmod +x $out/bin/ccline
-          '';
-
-          meta = with pkgs.lib; {
-            description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
-            homepage = "https://github.com/Haleclipse/CCometixLine";
-            license = licenses.mit;
-            platforms = [ "x86_64-linux" ];
-          };
-        })
-        (pkgs.stdenv.mkDerivation {
-          name = "rtk-${rtk-version}";
-          version = rtk-version;
-          src = pkgs.fetchurl {
-            url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
-            hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
-          };
-
-          unpackPhase = ''
-            tar xzf $src
-          '';
-
-          installPhase = ''
-            mkdir -p $out/bin
-            cp rtk $out/bin/
-            chmod +x $out/bin/rtk
-          '';
-
-          meta = with pkgs.lib; {
-            description = "RTK - AI coding tool enhancer";
-            homepage = "https://www.rtk-ai.app";
-            license = licenses.mit;
-            platforms = [ "x86_64-linux" ];
-          };
-        })
-        mcp-nixos
-      ];
-    })
-    (lib.mkIf cfg.tirith.enable {
-      home.packages = with pkgs; [
-        tirith
-      ];
-    })
-    (lib.mkIf (cfg.tirith.enable && cfg.claude-code.enable) {
-      home.file.".claude/hooks/tirith-check.py" = {
-        source = ./tirith-check.py;
-        executable = true;
-      };
-
-      home.activation.tirith-claude-code = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-        ${pkgs.tirith}/bin/tirith setup claude-code --with-mcp --scope user --force 2>/dev/null || true
-      '';
-    })
-    (lib.mkIf cfg.opencode.enable {
-      home.packages = with pkgs; [
-        opencode
-      ];
-      home.file.".config/opencode/opencode.json".text = builtins.toJSON {
-        "$schema" = "https://opencode.ai/config.json";
-        permission = {
-          external_directory = {
-            "/run/secrets/" = "deny";
-            "~/.config/sops/age/keys.txt" = "deny";
-            "~/.ssh/id_rsa" = "deny";
-            "~/.ssh/id_ed25519" = "deny";
-            "~/.ssh/id_ecdsa" = "deny";
-            "~/.ssh/id_dsa" = "deny";
-            "/etc/ssh/ssh_host_rsa_key" = "deny";
-            "/etc/ssh/ssh_host_ed25519_key" = "deny";
-            "/etc/ssh/ssh_host_ecdsa_key" = "deny";
-            "/etc/ssh/ssh_host_dsa_key" = "deny";
-          };
-          command = {
-            sops = "deny";
-          };
-        };
-        plugin = [ "@mohak34/opencode-notifier@latest" ];
-      };
-    })
+  imports = [
+    ./claude-code.nix
+    ./opencode.nix
+    ./tirith.nix
   ];
 }

home/modules/ai-tools/opencode.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.ai-tools.opencode;
+in
+{
+  options.ai-tools.opencode = {
+    enable = lib.mkEnableOption "opencode";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      opencode
+    ];
+    home.file.".config/opencode/opencode.json".text = builtins.toJSON {
+      plugin = [ "@mohak34/opencode-notifier@latest" ];
+    };
+  };
+}

home/modules/ai-tools/tirith.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.ai-tools;
+in
+{
+  options.ai-tools.tirith = {
+    enable = lib.mkEnableOption "tirith shell security guard";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.tirith.enable {
+      home.packages = with pkgs; [
+        tirith
+      ];
+    })
+    (lib.mkIf (cfg.tirith.enable && cfg.claude-code.enable) {
+      home.file.".claude/hooks/tirith-check.py" = {
+        source = ./tirith-check.py;
+        executable = true;
+      };
+
+      home.activation.tirith-claude-code = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+        ${pkgs.tirith}/bin/tirith setup claude-code --with-mcp --scope user --force 2>/dev/null || true
+      '';
+    })
+  ];
+}

home/modules/ssh/default.nix

@@ -39,6 +39,10 @@ in
       // {
         "*" = {
           addKeysToAgent = "yes";
+          identityFile = [
+            "~/.ssh/id_ed25519_sk"
+            "~/.ssh/id_ed25519"
+          ];
         };
       };
   };

hosts/andromache/ssh_user.pub

@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOXPEhdKOVnb6mkeLLUcFGt+mnUR5pMie17JtjrxwgO h@andromache
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILoWbtyewa2LUWpWCYK46OCWs+2E+BeIsk+0We20qsf9AAAABHNzaDo= h@andromache

modules/ssh/extract-keys.nix

@@ -14,7 +14,10 @@ in
       chmod 644 "$HOST_DIR/ssh_host.pub"
     fi
 
+    USER_KEY="/home/${username}/.ssh/id_ed25519_sk.pub"
+    if [ ! -f "$USER_KEY" ]; then
       USER_KEY="/home/${username}/.ssh/id_ed25519.pub"
+    fi
     if [ -f "$USER_KEY" ] && [ -d "$HOST_DIR" ]; then
       cp "$USER_KEY" "$HOST_DIR/ssh_user.pub"
       chown ${username}:users "$HOST_DIR/ssh_user.pub"

modules/tailscale/default.nix

@@ -4,6 +4,8 @@
   ...
 }:
 {
+  # TODO: handle auth declaratively to skip `tailscale up`
+
   options.tailscale = {
     enable = lib.mkEnableOption "tailscale";
   };