Feat/declarative ssh agent

Makefile

@@ -80,6 +80,13 @@ DETECTED_HOST := $(shell \
 		else \
 			echo ""; \
 		fi; \
+	elif [ "$(OS)" = "Linux" ]; then \
+		hostname=$$(hostname 2>/dev/null || echo ""); \
+		if [ "$$hostname" = "kyber" ]; then \
+			echo "kyber"; \
+		else \
+			echo ""; \
+		fi; \
 	else \
 		echo ""; \
 	fi)
@@ -257,7 +264,11 @@ nix-build: nix-connect ## Build Nix configuration.
 .PHONY: nix-flake-check
 nix-flake-check: ## Check Nix flake configuration.
 	@echo "🔍 Checking Nix flake configuration..."
-	@$(NIX_ALLOW_UNFREE) $(NIX_EXEC) flake check --all-systems --impure $(NIX_FLAGS)
+	@if [ "$(OS)" = "Darwin" ]; then \
+		$(NIX_ALLOW_UNFREE) $(NIX_EXEC) flake check --all-systems --impure $(NIX_FLAGS); \
+	else \
+		$(NIX_ALLOW_UNFREE) $(NIX_EXEC) flake check --system $(NIX_SYSTEM) --impure $(NIX_FLAGS); \
+	fi
 	@echo "✅ Nix flake check completed successfully"
 
 .PHONY: nix-flake-update
@@ -323,6 +334,9 @@ nix-switch: ## Activate Nix configuration.
 			if [ -n "$(HOST)" ]; then \
 				echo "Switching named home config: $(HOST)"; \
 				USER=$(NIX_USERNAME) $(NIX_ALLOW_UNFREE) $(NIX_EXEC) run $(NIX_FLAGS) --impure .#homeConfigurations.$(HOST).activationPackage; \
+			elif [ -n "$(DETECTED_HOST)" ]; then \
+				echo "Auto-detected host: $(DETECTED_HOST)"; \
+				USER=$(NIX_USERNAME) $(NIX_ALLOW_UNFREE) $(NIX_EXEC) run $(NIX_FLAGS) --impure .#homeConfigurations.$(DETECTED_HOST).activationPackage; \
 			else \
 				USER=$(NIX_USERNAME) $(NIX_ALLOW_UNFREE) $(NIX_EXEC) run $(NIX_FLAGS) --impure .#$(NIX_CONFIG_TYPE)."$(NIX_USERNAME)@$(NIX_SYSTEM)".activationPackage; \
 			fi; \

config/cliproxyapi/config.yaml

@@ -4,7 +4,7 @@ port: 8317
 remote-management:
   # Whether to allow remote (non-localhost) management access.
   # When false, only localhost can access management endpoints (a key is still required).
-  allow-remote: false
+  allow-remote: true
   # Management key. If a plaintext value is provided here, it will be hashed on startup.
   # All management requests (even from localhost) require this key.
   # Leave empty to disable the Management API entirely (404 for all /v0/management routes).

config/k3s/default.nix

@@ -12,7 +12,7 @@
 
   # Activation script to sync config to /etc/rancher/k3s/
   home.activation.k3s-config = lib.mkIf pkgs.stdenv.isLinux (
-    lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    config.lib.dag.entryAfter [ "writeBoundary" ] ''
       if [ -f "$HOME/.config/k3s/config.yaml" ]; then
         $DRY_RUN_CMD /usr/bin/sudo mkdir -p /etc/rancher/k3s
         $DRY_RUN_CMD /usr/bin/sudo cp "$HOME/.config/k3s/config.yaml" /etc/rancher/k3s/config.yaml

home-manager/modules/npm-globals/default.nix

@@ -6,7 +6,7 @@
 }:
 {
   # Install npm global packages from package.json using home-manager activation
-  home.activation.installNpmGlobals = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+  home.activation.installNpmGlobals = config.lib.dag.entryAfter [ "writeBoundary" ] ''
     export PATH=${pkgs.bun}/bin:$PATH
     export BUN_INSTALL="$HOME/.bun"
 

home-manager/modules/tailscale/default.nix

@@ -199,7 +199,7 @@ in
       Install.WantedBy = [ "default.target" ];
     };
 
-    home.activation.createTailscaleDirs = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    home.activation.createTailscaleDirs = config.lib.dag.entryAfter [ "writeBoundary" ] ''
       TAILSCALE_STATE_DIR="${config.xdg.dataHome}/tailscale"
       TAILSCALE_RUN_DIR="$(dirname "${cfg.tailscaled.socketPath}")"
 
@@ -215,7 +215,7 @@ in
     # Install system-level tailscaled service (requires sudo)
     # Uses nix-generated service file for full declarative config
     home.activation.installTailscaleService = mkIf cfg.installSystemService (
-      lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+      config.lib.dag.entryAfter [ "writeBoundary" ] ''
                 SERVICE_FILE="/etc/systemd/system/tailscaled.service"
                 NIX_SERVICE="${tailscaledServiceFile}"
                 SUDOERS_FILE="/etc/sudoers.d/nix-tailscale"

home-manager/modules/yek/default.nix

@@ -88,7 +88,7 @@ in
     ];
 
     # Install yek on activation
-    home.activation.installYek = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    home.activation.installYek = config.lib.dag.entryAfter [ "writeBoundary" ] ''
       if [ ! -f "$HOME/.local/bin/yek" ]; then
         $DRY_RUN_CMD ${installScript}/bin/install-yek || echo "⚠️ Failed to install yek. You can install it later by running: install-yek"
       fi

home-manager/packages/default.nix

@@ -86,6 +86,7 @@ with pkgs;
   docker
   docker-compose
   gemini-cli
+  keychain
   opencode
   powertop
   tailscale

home-manager/programs/fish/default.nix

@@ -49,6 +49,7 @@
       g = "git";
       lzd = "lazydocker";
       lzg = "lazygit";
+      sag = "_ssh_add_github";
       ta = "tmux new -A -s default";
       v = "nvim";
 
@@ -135,6 +136,7 @@
         "_hm_load_env_file"
         "_kyber_function"
         "_kybers_function"
+        "_ssh_add_github"
         "fish_user_key_bindings"
       ]
   );

home-manager/programs/fish/functions/_ssh_add_github.fish

@@ -0,0 +1,40 @@
+function _ssh_add_github --description "Add GitHub SSH key to ssh-agent"
+    # Check if key exists
+    if not test -f ~/.ssh/id_ed25519_github
+        echo "❌ GitHub SSH key not found at ~/.ssh/id_ed25519_github"
+        return 1
+    end
+
+    # Check if keychain is available
+    if not command -v keychain >/dev/null
+        echo "❌ keychain not found. Please install keychain."
+        return 1
+    end
+
+    # Initialize keychain and add the GitHub key
+    echo "🔑 Adding GitHub SSH key to keychain..."
+    # Use bash to evaluate keychain output, then use ssh-add
+    bash -c 'eval $(keychain --eval --quiet --confirm ~/.ssh/id_ed25519_github 2>/dev/null); ssh-add -l' >/dev/null 2>&1
+
+    # Alternative: directly use ssh-add if keychain already initialized ssh-agent
+    if not ssh-add -l >/dev/null 2>&1
+        # Start ssh-agent if not running
+        eval (ssh-agent -c)
+    end
+
+    # Add the key directly
+    ssh-add ~/.ssh/id_ed25519_github
+
+    # Verify the key was added (check for either the filename or email)
+    if ssh-add -l | grep -qE "(id_ed25519_github|shunkakinoki@gmail.com)"
+        echo "✅ GitHub SSH key added successfully"
+        echo "🧪 Testing GitHub connection..."
+        ssh -T git@github.com
+        return 0
+    else
+        echo "⚠️  Could not verify key was added, but ssh-add may have succeeded"
+        echo "🧪 Testing GitHub connection anyway..."
+        ssh -T git@github.com
+        return $status
+    end
+end

home-manager/programs/git/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ lib, ... }:
 {
   programs = {
     git = {
@@ -77,6 +77,10 @@
           conflictStyle = "zdiff3";
         };
       };
+      signing = {
+        signByDefault = true;
+        key = "shunkakinoki@gmail.com";
+      };
       ignores = lib.splitString "\n" (builtins.readFile ./.gitignore.global);
     };
     delta = {

home-manager/programs/neovim/default.nix

@@ -22,7 +22,7 @@ in
     force = true;
   };
 
-  home.activation.copyNvimPackLock = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+  home.activation.copyNvimPackLock = config.lib.dag.entryAfter [ "writeBoundary" ] ''
     $DRY_RUN_CMD mkdir -p "$HOME/.config/nvim"
     $DRY_RUN_CMD cp -f ${nvimPackLockJson} "$HOME/.config/nvim/nvim-pack-lock.json"
     $DRY_RUN_CMD chmod 644 "$HOME/.config/nvim/nvim-pack-lock.json"

home-manager/services/default.nix

@@ -6,6 +6,7 @@ let
   neversslKeepalive = import ./neverssl-keepalive { inherit pkgs; };
   ollama = import ./ollama { inherit pkgs; };
   brewUpgrader = import ./brew-upgrader { inherit pkgs; };
+  sshAgent = import ./ssh-agent.nix;
 in
 [
   brewUpgrader
@@ -14,4 +15,5 @@ in
   dotfilesUpdater
   neversslKeepalive
   ollama
+  sshAgent
 ]

home-manager/services/ssh-agent.nix

@@ -0,0 +1,40 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (pkgs.stdenv) isLinux isDarwin;
+in
+{
+  # Configure keychain for Linux systems
+  # macOS uses built-in keychain via UseKeychain SSH option
+  programs.fish.loginShellInit = lib.mkIf isLinux (
+    lib.mkAfter ''
+      # Initialize keychain for SSH key management
+      # This automatically starts ssh-agent and loads SSH keys
+      if command -v keychain > /dev/null
+        # Load keys that exist
+        set -l keys
+
+        # Always try to load the default key (no passphrase)
+        if test -f ~/.ssh/id_ed25519
+          set -a keys ~/.ssh/id_ed25519
+        end
+
+        # Load GitHub key if it exists (may have passphrase)
+        if test -f ~/.ssh/id_ed25519_github
+          set -a keys ~/.ssh/id_ed25519_github
+        end
+
+        # Initialize keychain with found keys
+        if test (count $keys) -gt 0
+          # Use --quiet to suppress most output, --eval to set environment variables
+          # --confirm will skip keys that need a passphrase in non-interactive contexts
+          eval (keychain --eval --quiet --confirm $keys ^/dev/null; or true)
+        end
+      end
+    ''
+  );
+}

named-hosts/galactica/secrets.nix

@@ -11,13 +11,14 @@ let
 in
 {
   # Shared SSH key for GitHub authentication (accessible on all machines)
-  "keys/id_ed25519.age" = {
-    file = ./keys/id_ed25519.age;
+  # This is ~/.ssh/id_github on galactica, the GitHub CLI-authorized key
+  "keys/id_github.age" = {
+    file = ./keys/id_github.age;
     publicKeys = allMachines;
   };
-  # GPG key (galactica only)
+  # GPG key (shared with all machines for commit signing)
   "keys/gpg.age" = {
     file = ./keys/gpg.age;
-    publicKeys = [ galactica ];
+    publicKeys = allMachines;
   };
 }

named-hosts/kyber/README.md

@@ -49,11 +49,19 @@ Once Tailscale is set up:
 kyber  # Fish abbreviation that runs: ssh ubuntu@kyber
 ```
 
-## Syncing SSH Keys from Galactica
+## SSH Key Management
 
-To sync the GitHub SSH key from galactica to kyber:
+### Automated Setup
 
-### On Galactica
+This configuration uses:
+
+- **agenix**: Encrypts and syncs the GitHub SSH key from galactica
+- **keychain**: Manages ssh-agent and automatically loads SSH keys
+- **Declarative deployment**: SSH keys are deployed during `make switch`
+
+### Syncing SSH Keys from Galactica
+
+#### On Galactica (one-time setup)
 
 ```bash
 cd ~/dotfiles
@@ -64,15 +72,58 @@ git commit -m "chore(agenix): rekey secrets for kyber access"
 git push
 ```
 
-### On Kyber
+#### On Kyber
 
 ```bash
 cd ~/dotfiles
 git pull
 make switch
+```
+
+The GitHub SSH key will be automatically:
+
+1. Decrypted from `named-hosts/galactica/keys/id_ed25519.age`
+2. Deployed to `~/.ssh/id_ed25519_github`
+3. Loaded into ssh-agent via keychain (if no passphrase)
+
+### Adding Passphrase-Protected Keys
+
+If the GitHub SSH key has a passphrase, add it manually:
+
+```bash
+sag  # Abbreviation for _ssh_add_github function
+
+# Or manually
+keychain --eval --quiet --confirm ~/.ssh/id_ed25519_github
+```
 
-# Test GitHub access
+### Verify GitHub Access
+
+```bash
 ssh -T git@github.com
+# Expected: Hi username! You've successfully authenticated...
+```
+
+### Troubleshooting
+
+**Key not deployed after `make switch`:**
+
+```bash
+# Check if key exists
+ls -la ~/.ssh/id_ed25519_github
+
+# Manually deploy if needed
+age -d -i ~/.ssh/id_ed25519 -o ~/.ssh/id_ed25519_github \
+  named-hosts/galactica/keys/id_ed25519.age
+chmod 0600 ~/.ssh/id_ed25519_github
 ```
 
-The SSH key will be automatically decrypted and deployed to `~/.ssh/id_ed25519_github`.
+**GitHub authentication fails:**
+
+```bash
+# Check if key is in ssh-agent
+ssh-add -l | grep github
+
+# Add the key
+sag
+```