sane-private-unlock-remote: fix ssh sandboxing (hopefully)

2025-06-17 04:28:14 +00:00
parent af8f7c06ad
commit d4e668e6fd
1 changed files with 2 additions and 2 deletions
--- a/hosts/common/programs/sane-private-unlock-remote.nix
+++ b/hosts/common/programs/sane-private-unlock-remote.nix
@@ -8,12 +8,12 @@ in
    sandbox.net = "all";
    sandbox.extraHomePaths = [
      ".config/sops"
-      ".ssh/id_ed25519"
-      ".ssh/id_ed25519.pub"
      "knowledge/secrets"
    ];
+    sandbox.whitelistSsh = true;
    suggestedPrograms = [
      "sane-scripts.secrets-dump"
+      "ssh"
    ];

    configOption = with lib; mkOption {