New ssh pubkey & redesign 'hey push'

Remote rebuilding requires root access, but I don't want root ssh
access (even by ssh key) to be a permanent fixture of my servers.  So
I've changed 'hey push' to copy my remote user's `authorized_keys` to
/root/.ssh/ temporarily, until the rebuild is complete. It is removed
afterwards.

This should be done non-destructively in the future, but it suits my
needs for now.

bin/hey

@@ -149,8 +149,19 @@ function main {
     swap)        _swap $@                       ;;
     gc)          _gc "$@"                       ;;
     push)
-      rsync -avzh ./ "$1:$REMOTE/"
-      ssh -t -l "$USERNAME" "$1" "$REMOTE/bin/hey re" "${@[2,-1]}"
+      target=$1
+      cmd=${2:-test}
+      # build then ssh in to switch/boot/test so we don't require root ssh
+      # access on the remote.
+      echo "Enabling root ssh access on $target"
+      ssh -t "$target" "sudo mkdir -p /root/.ssh && sudo cp -f ~/.ssh/authorized_keys /root/.ssh/"
+      echo "Building $target ($cmd)"
+      HOSTNAME="${HOSTNAME:-$target}" _rebuild \
+        --build-host localhost \
+        --target-host "root@$target" \
+        $cmd
+      echo "Undoing root ssh access on $target"
+      ssh -t "root@$target" "rm -f /root/.ssh/authorized_keys"
       ;;
 
     gen|generations)

modules/services/ssh.nix

@@ -15,8 +15,9 @@ in {
       passwordAuthentication = false;
     };
 
-    user.openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8Tl2pj6CPBV3V72cohPhn+k0a/Na3cOrbmUtFC7rR7icWocSs1S1cSrP3sPLwUqRh3+zfIuLXTrTv3gj8Xvg8WELOspzsiYeAtbcHrnWnx/a7xzYvFyT9/8hkiGM/F6w7IuKEk+AZW34vARSgRPJ1FdH8NbPKJ8ay9zW9XB9YJGnbzIRmsVVpQ8l6Fh8ZqRjZfC1ea7hns8+HgjPrIHFb+S3qZZiwU4Gc8aWJy9ziwwkllEsSchv3aigYA3eOeW0FUQFiKsLGxbX2b2b3d6jFO4Pu+dMSen0h5IzBo0nh7UADSfJPdwbZaMuJzviKe2y6zg6jaM9XRIhLBT6bftDr henrik@lissner.net"
-    ];
+    user.openssh.authorizedKeys.keys =
+      if config.user.name == "hlissner"
+      then [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB71rSnjuC06Qq3NLXQJwSz7jazoB+umydddrxL6vg1a henrik@lissner.net" ]
+      else [];
   };
 }