diff options
| author |  Tom van der Lee <tom@vanderlee.io> | 2026-09-18 15:19:00 +0200 |
|---|---|---|
| committer | Tom van der Lee <tom@vanderlee.io> | 2026-09-18 15:19:00 +0200 |
| commit | b712f7c8a063e49329edf0db07d54a5174bfbd9b (patch) | |
| tree | ac82604775561e6ba8fd9ca2bf5ebf88ea29f00a /openspec/specs/developer-environment | |
| parent | 074921b62032c91150cecf706b6a387f6c6babd7 (diff) | |
| download | desktop-flake-b712f7c8a063e49329edf0db07d54a5174bfbd9b.tar.gz desktop-flake-b712f7c8a063e49329edf0db07d54a5174bfbd9b.tar.bz2 desktop-flake-b712f7c8a063e49329edf0db07d54a5174bfbd9b.zip | |
Archive fix-ssh-authorized-keys-spec, sync developer-environment spec
Closes the spec/implementation drift: the SSH requirement now states
that an authorized key must be provisioned, matching the live fix
already running on floep. Archived despite design.md never being
created -- deliberately skipped per its own conditional trigger rules,
confirmed before proceeding.
Diffstat (limited to 'openspec/specs/developer-environment')
| -rw-r--r-- | openspec/specs/developer-environment/spec.md | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/openspec/specs/developer-environment/spec.md b/openspec/specs/developer-environment/spec.md index e21936f..374f098 100644 --- a/openspec/specs/developer-environment/spec.md +++ b/openspec/specs/developer-environment/spec.md | |||
| @@ -26,8 +26,12 @@ Where the user's personal dotfiles repository already owns a piece of shell or p | |||
| 26 | - **THEN** the profile installs the tool's package but does not generate or manage a competing configuration file for it | 26 | - **THEN** the profile installs the tool's package but does not generate or manage a competing configuration file for it |
| 27 | 27 | ||
| 28 | ### Requirement: SSH access is enabled by default on NixOS hosts | 28 | ### Requirement: SSH access is enabled by default on NixOS hosts |
| 29 | Every NixOS host built from this flake's shared system module SHALL have an SSH server enabled, with password authentication and root login disabled, and SHALL permit inbound SSH traffic through its firewall. | 29 | Every NixOS host built from this flake's shared system module SHALL have an SSH server enabled, with password authentication and root login disabled, and SHALL permit inbound SSH traffic through its firewall. The system SHALL also provision at least one authorized public key for the user, so that key-based authentication is actually reachable rather than merely configured. |
| 30 | 30 | ||
| 31 | #### Scenario: SSH reachable with key-based auth only | 31 | #### Scenario: SSH reachable with key-based auth only |
| 32 | - **WHEN** a NixOS host is built from the shared system module | 32 | - **WHEN** a NixOS host is built from the shared system module |
| 33 | - **THEN** the SSH service is enabled, password authentication and root login are disabled, and the firewall permits inbound connections on the SSH port | 33 | - **THEN** the SSH service is enabled, password authentication and root login are disabled, and the firewall permits inbound connections on the SSH port |
| 34 | |||
| 35 | #### Scenario: An authorized key is provisioned | ||
| 36 | - **WHEN** a NixOS host is built from the shared system module | ||
| 37 | - **THEN** the user account has at least one authorized public key configured, so a matching private key can actually authenticate over SSH | ||