diff options
4 files changed, 42 insertions, 0 deletions
diff --git a/openspec/changes/fix-ssh-authorized-keys-spec/.openspec.yaml b/openspec/changes/fix-ssh-authorized-keys-spec/.openspec.yaml new file mode 100644 index 0000000..f2cbbe6 --- /dev/null +++ b/openspec/changes/fix-ssh-authorized-keys-spec/.openspec.yaml | |||
| @@ -0,0 +1,2 @@ | |||
| 1 | schema: spec-driven | ||
| 2 | created: 2026-09-18 | ||
diff --git a/openspec/changes/fix-ssh-authorized-keys-spec/proposal.md b/openspec/changes/fix-ssh-authorized-keys-spec/proposal.md new file mode 100644 index 0000000..4a598fb --- /dev/null +++ b/openspec/changes/fix-ssh-authorized-keys-spec/proposal.md | |||
| @@ -0,0 +1,21 @@ | |||
| 1 | ## Why | ||
| 2 | |||
| 3 | The `developer-environment` capability's SSH requirement says the SSH service is "enabled... with key-based auth only," but never states that an authorized key must actually be provisioned. That gap was real: the first live NixOS host (`floep`) locked out all SSH access on first rebuild, because `PasswordAuthentication = false` was in effect with no `authorizedKeys` ever declared. The fix was applied directly to `modules/nixos/common.nix` as a live incident response, outside the OpenSpec workflow — so the spec and the implementation have been out of sync since. This change brings the spec back in line with what's actually implemented and running. | ||
| 4 | |||
| 5 | ## What Changes | ||
| 6 | |||
| 7 | - `developer-environment`'s "SSH access is enabled by default on NixOS hosts" requirement is updated to state that an authorized public key MUST be provisioned for the user, and that this is what makes key-based auth actually reachable (not just theoretically configured). | ||
| 8 | - No code changes: `modules/nixos/common.nix` already declares `users.users.tom.openssh.authorizedKeys.keys`, fetched once from `https://github.com/tomvanderlee.keys` and pinned as a static literal. This change only updates the spec to describe that existing, already-verified-working behavior. | ||
| 9 | |||
| 10 | ## Capabilities | ||
| 11 | |||
| 12 | ### New Capabilities | ||
| 13 | (none) | ||
| 14 | |||
| 15 | ### Modified Capabilities | ||
| 16 | - `developer-environment`: the SSH requirement now explicitly requires an authorized key to be provisioned, not just the service to be enabled with password auth off. | ||
| 17 | |||
| 18 | ## Impact | ||
| 19 | |||
| 20 | - Affected files: `openspec/specs/developer-environment/spec.md` (via this change's delta and sync), no application code. | ||
| 21 | - Closes a real spec/implementation drift discovered after the `add-developer-environment` change was archived — the underlying fix already shipped and was verified live on the `floep` host; this change is documentation-only. | ||
diff --git a/openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md b/openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md new file mode 100644 index 0000000..af26016 --- /dev/null +++ b/openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md | |||
| @@ -0,0 +1,12 @@ | |||
| 1 | ## MODIFIED Requirements | ||
| 2 | |||
| 3 | ### Requirement: SSH access is enabled by default on NixOS hosts | ||
| 4 | Every NixOS host built from this flake's shared system module SHALL have an SSH server enabled, with password authentication and root login disabled, and SHALL permit inbound SSH traffic through its firewall. The system SHALL also provision at least one authorized public key for the user, so that key-based authentication is actually reachable rather than merely configured. | ||
| 5 | |||
| 6 | #### Scenario: SSH reachable with key-based auth only | ||
| 7 | - **WHEN** a NixOS host is built from the shared system module | ||
| 8 | - **THEN** the SSH service is enabled, password authentication and root login are disabled, and the firewall permits inbound connections on the SSH port | ||
| 9 | |||
| 10 | #### Scenario: An authorized key is provisioned | ||
| 11 | - **WHEN** a NixOS host is built from the shared system module | ||
| 12 | - **THEN** the user account has at least one authorized public key configured, so a matching private key can actually authenticate over SSH | ||
diff --git a/openspec/changes/fix-ssh-authorized-keys-spec/tasks.md b/openspec/changes/fix-ssh-authorized-keys-spec/tasks.md new file mode 100644 index 0000000..24b7528 --- /dev/null +++ b/openspec/changes/fix-ssh-authorized-keys-spec/tasks.md | |||
| @@ -0,0 +1,7 @@ | |||
| 1 | ## 1. Verify implementation already matches the updated spec | ||
| 2 | |||
| 3 | - [ ] 1.1 Confirm `modules/nixos/common.nix` declares `users.users.tom.openssh.authorizedKeys.keys` with at least one key — verify by reading the file (no code change expected; this task is a sanity check, not an implementation step) | ||
| 4 | |||
| 5 | ## 2. Sync | ||
| 6 | |||
| 7 | - [ ] 2.1 Archive this change and sync the `MODIFIED` requirement into `openspec/specs/developer-environment/spec.md` — verify the main spec's "SSH access is enabled by default on NixOS hosts" requirement includes the authorized-key sentence and the new "An authorized key is provisioned" scenario after archiving | ||