Next: (heks-linux toon), Previous: (heks-linux rofi), Up: API
The SSH client side, rendered from this repository instead of hand-edited in ~/.ssh:
- ~/.ssh/config - one Host block per machine, plus
AddKeysToAgent yes. That one option is what turns a
passphrase-protected key into a single prompt: the first connection that
uses the key hands it to the agent, and every later connection reuses
it. - ~/.config/environment.d/10-ssh-agent.conf -
SSH_AUTH_SOCK for every process the systemd user session starts.
Without it a terminal inherits whatever socket the process that started
it had, and a terminal that outlives its parent keeps pointing at an
agent that is gone – which looks exactly like "the passphrase is asked
again". - ~/.config/systemd/user/ssh-agent.service - only where
the machine does not already ship gcr-ssh-agent.socket. openSUSE
does: that agent keeps the decrypted keys in the login keyring, so the
passphrase is asked once ever rather than once per session.
The hosts are data. Add one to ssh-hosts and run maak
install-ssh; override them per machine in
$XDG_CONFIG_HOME/heks-linux/ssh-settings.scm (the same override
file every other surface reads) when a key or a host name differs.
The installer never creates a key: it reports the ones an identity file
names but that do not exist, with the ssh-keygen line to make
them, because a silently missing key is what a first push failing looks
like.
Default value:
"/root/.config/environment.d"
Default value:
"10-ssh-agent.conf"
Default value:
agent
Default value:
"/root/.config/systemd/user"
Default value:
"ssh-agent.service"
Default value:
"/root/.ssh"
Default value:
"config"
Default value:
(("Host" "personal.github.com" "HostName" "github.com" "User" "git" "IdentityFile" "~/.ssh/personal_github" "IdentitiesOnly" "yes") ("Host" "codeberg.org" "HostName" "codeberg.org" "User" "git" "IdentityFile" "~/.ssh/gitlab_prive" "IdentitiesOnly" "yes") ("Host" "wolk-jjba" "HostName" "178.105.172.226" "User" "joe" "Port" "2323" "IdentityFile" "~/.ssh/wolk_id") ("Host" "wolkenschlosslagerung" "HostName" "u600604.your-storagebox.de" "User" "u600604" "Port" "23" "IdentityFile" "~/.ssh/wolk_id"))
Whether this machine ships the keyring-backed SSH agent.
openSUSE (through GNOME’s keyring) provides gcr-ssh-agent.socket,
which stores the decrypted key in the login keyring. That is the
difference between being asked for the passphrase once ever and once per
session, so it is used whenever it exists rather than replaced.
Install the SSH configuration and make sure the agent is enabled.
This is what maak install-ssh calls: the render, then
systemctl --user daemon-reload and enable --now on
whichever agent the machine has. Both calls are idempotent, so
re-running the task after editing a host changes only what changed.
Write the SSH config, the agent environment and the agent unit.
Nothing is started here: install-ssh! does the systemctl
part, so that a plain render (what maak home-reconfigure does)
stays a file write.
Machine overrides are read from
$XDG_CONFIG_HOME/heks-linux/ssh-settings.scm first.
Return the environment.d file that points a session at the agent.
Return a plain ssh-agent user service, for machines without gcr.
Return the socket every process in the session should look for.
Return the systemd unit that provides the agent on this machine.
Return the whole ~/.ssh/config as a string.
Next: (heks-linux toon), Previous: (heks-linux rofi), Up: API