Template sshHosts entries carry localForwards and extraOptions #33

Merged

vnprc merged 1 commit from agent/ssh-hosts-forward-shapes into master

2026-09-20 04:23:48 +01:00

allod-agent commented

2026-09-20 02:23:17 +01:00

Member

Two example entries in the template's SSH address book gain the two field shapes deployments' address books already carry: example-offsite-console gets two localForwards (one with a bind address, one without) and example-provider-support gets an extraOptions entry. Nothing else changes: no name, address, port or key of any entry, and the nexus rotation scripts read only hostname, user, port and identityFile, none of which move. On the running example hypervisor this adds two LocalForward lines to one host block and a ServerAliveInterval to another; no other machine receives the address book after the companion framework change, allod/archetypes#81. It exists so the framework's composed check sees every shape its field translation claims (allod/archetypes#54 validation), after a previous attempt passed on this template and broke every deployment machine whose entries carry localForwards. If it is wrong, revert this PR.

What changes

identity.nix: sshHosts.example-offsite-console.localForwards with a full bind/host pair and a pair whose bind address is omitted (the shape whose default the translation must reproduce); sshHosts.example-provider-support.extraOptions = { ServerAliveInterval = "30"; }. Both are the legacy Home Manager matchBlocks shapes, which is what deployment data uses.

Risk

R1: synthetic public template data, additive fields, rollback a revert. Consumers measured: the framework's hypervisor render (both the current legacy path and the new translation resolve every host identically with ssh -G), the external-ssh-trust-targets check (passes), and the nexus rotation scripts (read four fields that do not change).

Validation

Run by the integrator at e21b088:

nix flake check in this repo passes (worker run).
nix eval .#lib.identity.sshHosts.example-offsite-console.localForwards --json and ...example-provider-support.extraOptions --json print the new values.
Deploy template with --override-input secrets <this branch> and archetypes at master: nexus renders LocalForward [127.0.0.1]:8443 [192.0.2.31]:443, LocalForward [localhost]:5900 [192.0.2.31]:5900 and ServerAliveInterval 30; ssh -G -F <rendered config> resolves all six hosts, and resolves them identically with the allod/archetypes#81 branch substituted.

Cold cross-family review: gpt-5.6-sol via codex exec, reasoning effort xhigh, read this diff together with the allod/archetypes#81 and allod/profiles#10 diffs for allod/strategy#56 (Claude-family workers authored all three). No finding concerned this change; the reviewer traced the added addresses as RFC 5737 documentation values and confirmed the forward endpoint defaults match the pinned Home Manager rendering.

Refs allod/archetypes#54
Refs allod/strategy#56

Two example entries in the template's SSH address book gain the two field shapes deployments' address books already carry: `example-offsite-console` gets two `localForwards` (one with a bind address, one without) and `example-provider-support` gets an `extraOptions` entry. Nothing else changes: no name, address, port or key of any entry, and the nexus rotation scripts read only `hostname`, `user`, `port` and `identityFile`, none of which move. On the running example hypervisor this adds two `LocalForward` lines to one host block and a `ServerAliveInterval` to another; no other machine receives the address book after the companion framework change, allod/archetypes#81. It exists so the framework's composed check sees every shape its field translation claims (allod/archetypes#54 validation), after a previous attempt passed on this template and broke every deployment machine whose entries carry `localForwards`. If it is wrong, revert this PR. ## What changes - `identity.nix`: `sshHosts.example-offsite-console.localForwards` with a full bind/host pair and a pair whose bind address is omitted (the shape whose default the translation must reproduce); `sshHosts.example-provider-support.extraOptions = { ServerAliveInterval = "30"; }`. Both are the legacy Home Manager `matchBlocks` shapes, which is what deployment data uses. ## Risk R1: synthetic public template data, additive fields, rollback a revert. Consumers measured: the framework's hypervisor render (both the current legacy path and the new translation resolve every host identically with `ssh -G`), the `external-ssh-trust-targets` check (passes), and the nexus rotation scripts (read four fields that do not change). ## Validation Run by the integrator at e21b088: - `nix flake check` in this repo passes (worker run). - `nix eval .#lib.identity.sshHosts.example-offsite-console.localForwards --json` and `...example-provider-support.extraOptions --json` print the new values. - Deploy template with `--override-input secrets <this branch>` and archetypes at master: `nexus` renders `LocalForward [127.0.0.1]:8443 [192.0.2.31]:443`, `LocalForward [localhost]:5900 [192.0.2.31]:5900` and `ServerAliveInterval 30`; `ssh -G -F <rendered config>` resolves all six hosts, and resolves them identically with the allod/archetypes#81 branch substituted. Cold cross-family review: `gpt-5.6-sol` via `codex exec`, reasoning effort `xhigh`, read this diff together with the allod/archetypes#81 and allod/profiles#10 diffs for allod/strategy#56 (Claude-family workers authored all three). No finding concerned this change; the reviewer traced the added addresses as RFC 5737 documentation values and confirmed the forward endpoint defaults match the pinned Home Manager rendering. Refs allod/archetypes#54 Refs allod/strategy#56

allod-agent added 1 commit

2026-09-20 02:23:17 +01:00

Add localForwards and extraOptions shapes to template sshHosts entries e21b0883db

example-offsite-console gains a localForwards list including one entry
that omits both bind and host addresses, and example-provider-support
gains a string-valued extraOptions attrset. These give the composed
translation check in allod/archetypes real fixtures for the field
shapes it claims to translate, per allod/strategy#56 and
allod/archetypes#54.

allod-agent referenced this pull request from allod/archetypes

2026-09-20 02:29:54 +01:00

Render each machine's SSH client config from its own identity record #81

allod-agent referenced this pull request from allod/profiles

2026-09-20 02:30:17 +01:00

Drop the forge SSH block; silence the neovim provider default warnings #10

allod-agent referenced this pull request from allod/strategy

2026-09-20 02:30:18 +01:00

Each machine derives its SSH client config from its own identity record #56