From 179ae2d78e39970ae55955f1a7a56a6b9671eb3d Mon Sep 17 00:00:00 2001 From: Tom van der Lee Date: Fri, 18 Sep 2026 15:14:46 +0200 Subject: Propose fixing the SSH authorized-key spec drift Planning artifacts only. The developer-environment capability's SSH requirement never stated that an authorized key must be provisioned -- the real gap that locked out the floep host after its first rebuild. The code fix already shipped; this change brings the spec in line with it. design.md skipped (none of its trigger conditions apply to a documentation-only correction). --- .../specs/developer-environment/spec.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md (limited to 'openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md') diff --git a/openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md b/openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md new file mode 100644 index 0000000..af26016 --- /dev/null +++ b/openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md @@ -0,0 +1,12 @@ +## MODIFIED Requirements + +### Requirement: SSH access is enabled by default on NixOS hosts +Every NixOS host built from this flake's shared system module SHALL have an SSH server enabled, with password authentication and root login disabled, and SHALL permit inbound SSH traffic through its firewall. The system SHALL also provision at least one authorized public key for the user, so that key-based authentication is actually reachable rather than merely configured. + +#### Scenario: SSH reachable with key-based auth only +- **WHEN** a NixOS host is built from the shared system module +- **THEN** the SSH service is enabled, password authentication and root login are disabled, and the firewall permits inbound connections on the SSH port + +#### Scenario: An authorized key is provisioned +- **WHEN** a NixOS host is built from the shared system module +- **THEN** the user account has at least one authorized public key configured, so a matching private key can actually authenticate over SSH -- cgit v1.3