yubikey-git: opt a host in to git over ssh at git.soarez.net with the YubiKey git key; ssh entry includes enabled.d/

1 files changed, 15 insertions, 3 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 611a1cd..2658b34 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -30,9 +30,19 @@ certificate in the transparency logs -- such as the request inbox
 nothing and costs every machine a hand-written config file; what protects that
 endpoint is that it stores nothing without a signature from an authorised key.
 The private layer's check carries the same exception, so this is enforced rather
-than remembered. It does not extend to hosts, addresses or internal-only names. Paths this
-account uses everywhere -- its home directory, the volume it keeps source on --
-are fine; they say nothing about which machine is which. Anything that would
+than remembered. It does not extend to hosts, addresses or internal-only names.
+
+Two things follow from that exception, and are allowed for the same reason. Such
+an endpoint's ssh host key may be pinned here, since anyone can read it off the
+endpoint with `ssh-keyscan`. And the handle of a security-key ssh key may live
+here: it is not a credential on its own, because the private half never leaves
+the hardware, which signs nothing without a touch. `config/ssh/yubikey-git/`
+holds both, so that a machine with only this repo can use git over
+git.soarez.net (`bin/yubikey-git`). A plain ssh key is a credential and never
+qualifies.
+
+Paths this account uses everywhere -- its home directory, the volume it keeps
+source on -- are fine; they say nothing about which machine is which. Anything that would
 fail that test belongs in a private layer instead, and reaches a machine
 through the hooks below.
 
@@ -169,6 +179,7 @@ tracked config says so, and in no repo:
 | `~/.localenv` | environment for every shell: PATH, exported variables. POSIX sh, no forks | `config/env`, before it drops `_env_prepend`/`_env_append`, so those work here |
 | `~/.localprofile` | interactive setup: aliases, prompt, anything that forks | `config/profile`, last |
 | `~/.config/ssh/config-local` | ssh, this host only. See `config/ssh/config-local-example` | `config/ssh/entry`, before the shared defaults |
+| `~/.config/ssh/enabled.d/*.conf` | ssh configs from this repo that this host opted in to, as links -- `bin/yubikey-git enable` adds one | `config/ssh/entry`, after the private layer's and before `config-local` |
 | `~/.config/git/config-local` | git, this host only -- the work identity, `includeIf` blocks. See `config/git/config-local-example` | `config/git/config`, after the `[user]` block above it, and git takes the last value |
 | `~/.config/hammerspoon/local.lua` | Hammerspoon: rebinding a hotkey set here shadows it, and `capslock_off()` gives this machine its Caps Lock back. `require("dotlib")` for the same helpers init.lua uses. See `config/hammerspoon/local-example.lua` | `config/hammerspoon/init.lua`, last, in a `pcall` |
 | `~/.tmux.conf.local` | tmux, this host only: loaded last, so it can override anything, colours included | `config/tmux.conf`, last, with `source-file -q` |
@@ -414,6 +425,7 @@ The `bin/` directory contains various utility scripts for:
 - Notification sending (`notify`)
 - Development tools (`vi` wrapper, `smack`, `pyexec`)
 - System utilities (`wifi`, `default-browser`, `truecolour-test`, `open` — macOS-style `open` for Linux desktops; hands over to `/usr/bin/open` on macOS)
+- git over ssh with a YubiKey, opted in per host (`yubikey-git enable|disable|status`; see `config/ssh/yubikey-git/config`)
 - App settings that no `defaults` key reaches (`wispr-keys` — Flow's dictation shortcuts; see the Keyboard section for why it lives here and not in `link/`)
 
 ## Development Notes