From b712f7c8a063e49329edf0db07d54a5174bfbd9b Mon Sep 17 00:00:00 2001 From: Tom van der Lee Date: Fri, 18 Sep 2026 15:19:00 +0200 Subject: Archive fix-ssh-authorized-keys-spec, sync developer-environment spec Closes the spec/implementation drift: the SSH requirement now states that an authorized key must be provisioned, matching the live fix already running on floep. Archived despite design.md never being created -- deliberately skipped per its own conditional trigger rules, confirmed before proceeding. --- .../.openspec.yaml | 2 ++ .../proposal.md | 21 +++++++++++++++++++++ .../specs/developer-environment/spec.md | 12 ++++++++++++ .../tasks.md | 3 +++ .../fix-ssh-authorized-keys-spec/.openspec.yaml | 2 -- .../fix-ssh-authorized-keys-spec/proposal.md | 21 --------------------- .../specs/developer-environment/spec.md | 12 ------------ .../changes/fix-ssh-authorized-keys-spec/tasks.md | 3 --- openspec/specs/developer-environment/spec.md | 6 +++++- 9 files changed, 43 insertions(+), 39 deletions(-) create mode 100644 openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/.openspec.yaml create mode 100644 openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/proposal.md create mode 100644 openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md create mode 100644 openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/tasks.md delete mode 100644 openspec/changes/fix-ssh-authorized-keys-spec/.openspec.yaml delete mode 100644 openspec/changes/fix-ssh-authorized-keys-spec/proposal.md delete mode 100644 openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md delete mode 100644 openspec/changes/fix-ssh-authorized-keys-spec/tasks.md (limited to 'openspec') diff --git a/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/.openspec.yaml b/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/.openspec.yaml new file mode 100644 index 0000000..f2cbbe6 --- /dev/null +++ b/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/.openspec.yaml @@ -0,0 +1,2 @@ +schema: spec-driven +created: 2026-09-18 diff --git a/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/proposal.md b/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/proposal.md new file mode 100644 index 0000000..4a598fb --- /dev/null +++ b/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/proposal.md @@ -0,0 +1,21 @@ +## Why + +The `developer-environment` capability's SSH requirement says the SSH service is "enabled... with key-based auth only," but never states that an authorized key must actually be provisioned. That gap was real: the first live NixOS host (`floep`) locked out all SSH access on first rebuild, because `PasswordAuthentication = false` was in effect with no `authorizedKeys` ever declared. The fix was applied directly to `modules/nixos/common.nix` as a live incident response, outside the OpenSpec workflow — so the spec and the implementation have been out of sync since. This change brings the spec back in line with what's actually implemented and running. + +## What Changes + +- `developer-environment`'s "SSH access is enabled by default on NixOS hosts" requirement is updated to state that an authorized public key MUST be provisioned for the user, and that this is what makes key-based auth actually reachable (not just theoretically configured). +- No code changes: `modules/nixos/common.nix` already declares `users.users.tom.openssh.authorizedKeys.keys`, fetched once from `https://github.com/tomvanderlee.keys` and pinned as a static literal. This change only updates the spec to describe that existing, already-verified-working behavior. + +## Capabilities + +### New Capabilities +(none) + +### Modified Capabilities +- `developer-environment`: the SSH requirement now explicitly requires an authorized key to be provisioned, not just the service to be enabled with password auth off. + +## Impact + +- Affected files: `openspec/specs/developer-environment/spec.md` (via this change's delta and sync), no application code. +- Closes a real spec/implementation drift discovered after the `add-developer-environment` change was archived — the underlying fix already shipped and was verified live on the `floep` host; this change is documentation-only. diff --git a/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md b/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md new file mode 100644 index 0000000..af26016 --- /dev/null +++ b/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md @@ -0,0 +1,12 @@ +## MODIFIED Requirements + +### Requirement: SSH access is enabled by default on NixOS hosts +Every NixOS host built from this flake's shared system module SHALL have an SSH server enabled, with password authentication and root login disabled, and SHALL permit inbound SSH traffic through its firewall. The system SHALL also provision at least one authorized public key for the user, so that key-based authentication is actually reachable rather than merely configured. + +#### Scenario: SSH reachable with key-based auth only +- **WHEN** a NixOS host is built from the shared system module +- **THEN** the SSH service is enabled, password authentication and root login are disabled, and the firewall permits inbound connections on the SSH port + +#### Scenario: An authorized key is provisioned +- **WHEN** a NixOS host is built from the shared system module +- **THEN** the user account has at least one authorized public key configured, so a matching private key can actually authenticate over SSH diff --git a/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/tasks.md b/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/tasks.md new file mode 100644 index 0000000..bb00b00 --- /dev/null +++ b/openspec/changes/archive/2026-09-18-fix-ssh-authorized-keys-spec/tasks.md @@ -0,0 +1,3 @@ +## 1. Verify implementation already matches the updated spec + +- [x] 1.1 Confirm `modules/nixos/common.nix` declares `users.users.tom.openssh.authorizedKeys.keys` with at least one key — verify by reading the file (no code change expected; this task is a sanity check, not an implementation step) (confirmed: lines 24–26, one key present — the RSA key that remained after the earlier key removal) diff --git a/openspec/changes/fix-ssh-authorized-keys-spec/.openspec.yaml b/openspec/changes/fix-ssh-authorized-keys-spec/.openspec.yaml deleted file mode 100644 index f2cbbe6..0000000 --- a/openspec/changes/fix-ssh-authorized-keys-spec/.openspec.yaml +++ /dev/null @@ -1,2 +0,0 @@ -schema: spec-driven -created: 2026-09-18 diff --git a/openspec/changes/fix-ssh-authorized-keys-spec/proposal.md b/openspec/changes/fix-ssh-authorized-keys-spec/proposal.md deleted file mode 100644 index 4a598fb..0000000 --- a/openspec/changes/fix-ssh-authorized-keys-spec/proposal.md +++ /dev/null @@ -1,21 +0,0 @@ -## Why - -The `developer-environment` capability's SSH requirement says the SSH service is "enabled... with key-based auth only," but never states that an authorized key must actually be provisioned. That gap was real: the first live NixOS host (`floep`) locked out all SSH access on first rebuild, because `PasswordAuthentication = false` was in effect with no `authorizedKeys` ever declared. The fix was applied directly to `modules/nixos/common.nix` as a live incident response, outside the OpenSpec workflow — so the spec and the implementation have been out of sync since. This change brings the spec back in line with what's actually implemented and running. - -## What Changes - -- `developer-environment`'s "SSH access is enabled by default on NixOS hosts" requirement is updated to state that an authorized public key MUST be provisioned for the user, and that this is what makes key-based auth actually reachable (not just theoretically configured). -- No code changes: `modules/nixos/common.nix` already declares `users.users.tom.openssh.authorizedKeys.keys`, fetched once from `https://github.com/tomvanderlee.keys` and pinned as a static literal. This change only updates the spec to describe that existing, already-verified-working behavior. - -## Capabilities - -### New Capabilities -(none) - -### Modified Capabilities -- `developer-environment`: the SSH requirement now explicitly requires an authorized key to be provisioned, not just the service to be enabled with password auth off. - -## Impact - -- Affected files: `openspec/specs/developer-environment/spec.md` (via this change's delta and sync), no application code. -- Closes a real spec/implementation drift discovered after the `add-developer-environment` change was archived — the underlying fix already shipped and was verified live on the `floep` host; this change is documentation-only. diff --git a/openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md b/openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md deleted file mode 100644 index af26016..0000000 --- a/openspec/changes/fix-ssh-authorized-keys-spec/specs/developer-environment/spec.md +++ /dev/null @@ -1,12 +0,0 @@ -## MODIFIED Requirements - -### Requirement: SSH access is enabled by default on NixOS hosts -Every NixOS host built from this flake's shared system module SHALL have an SSH server enabled, with password authentication and root login disabled, and SHALL permit inbound SSH traffic through its firewall. The system SHALL also provision at least one authorized public key for the user, so that key-based authentication is actually reachable rather than merely configured. - -#### Scenario: SSH reachable with key-based auth only -- **WHEN** a NixOS host is built from the shared system module -- **THEN** the SSH service is enabled, password authentication and root login are disabled, and the firewall permits inbound connections on the SSH port - -#### Scenario: An authorized key is provisioned -- **WHEN** a NixOS host is built from the shared system module -- **THEN** the user account has at least one authorized public key configured, so a matching private key can actually authenticate over SSH diff --git a/openspec/changes/fix-ssh-authorized-keys-spec/tasks.md b/openspec/changes/fix-ssh-authorized-keys-spec/tasks.md deleted file mode 100644 index bb00b00..0000000 --- a/openspec/changes/fix-ssh-authorized-keys-spec/tasks.md +++ /dev/null @@ -1,3 +0,0 @@ -## 1. Verify implementation already matches the updated spec - -- [x] 1.1 Confirm `modules/nixos/common.nix` declares `users.users.tom.openssh.authorizedKeys.keys` with at least one key — verify by reading the file (no code change expected; this task is a sanity check, not an implementation step) (confirmed: lines 24–26, one key present — the RSA key that remained after the earlier key removal) diff --git a/openspec/specs/developer-environment/spec.md b/openspec/specs/developer-environment/spec.md index e21936f..374f098 100644 --- a/openspec/specs/developer-environment/spec.md +++ b/openspec/specs/developer-environment/spec.md @@ -26,8 +26,12 @@ Where the user's personal dotfiles repository already owns a piece of shell or p - **THEN** the profile installs the tool's package but does not generate or manage a competing configuration file for it ### Requirement: SSH access is enabled by default on NixOS hosts -Every NixOS host built from this flake's shared system module SHALL have an SSH server enabled, with password authentication and root login disabled, and SHALL permit inbound SSH traffic through its firewall. +Every NixOS host built from this flake's shared system module SHALL have an SSH server enabled, with password authentication and root login disabled, and SHALL permit inbound SSH traffic through its firewall. The system SHALL also provision at least one authorized public key for the user, so that key-based authentication is actually reachable rather than merely configured. #### Scenario: SSH reachable with key-based auth only - **WHEN** a NixOS host is built from the shared system module - **THEN** the SSH service is enabled, password authentication and root login are disabled, and the firewall permits inbound connections on the SSH port + +#### Scenario: An authorized key is provisioned +- **WHEN** a NixOS host is built from the shared system module +- **THEN** the user account has at least one authorized public key configured, so a matching private key can actually authenticate over SSH -- cgit v1.3