From aff435a0fb3a56b1d7b738c7dede363440884b3a Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Thu, 17 Sep 2026 15:05:36 +0100
Subject: Add the Canonical laptop profile and setup workflows

---
 private_dot_ssh/config      | 19 -------------------
 private_dot_ssh/config.tmpl | 27 +++++++++++++++++++++++++++
 2 files changed, 27 insertions(+), 19 deletions(-)
 delete mode 100644 private_dot_ssh/config
 create mode 100644 private_dot_ssh/config.tmpl

(limited to 'private_dot_ssh')

diff --git a/private_dot_ssh/config b/private_dot_ssh/config
deleted file mode 100644
index 8df3687..0000000
--- a/private_dot_ssh/config
+++ /dev/null
@@ -1,19 +0,0 @@
-# Ensure KnownHosts are unreadable if leaked
-HashKnownHosts yes
-
-Compression no
-ControlMaster auto
-ControlPersist 10
-AddressFamily inet
-ServerAliveInterval 120
-IdentitiesOnly yes
-
-Host git.sommerfeld.dev
-  Hostname mandibles.wg
-
-Include work.config
-
-Match host * exec "gpg-connect-agent UPDATESTARTUPTTY /bye"
-
-Match host *.wg,*.pulpo
-  IdentityFile ~/.ssh/nym.pub
diff --git a/private_dot_ssh/config.tmpl b/private_dot_ssh/config.tmpl
new file mode 100644
index 0000000..b6dce43
--- /dev/null
+++ b/private_dot_ssh/config.tmpl
@@ -0,0 +1,27 @@
+{{ if eq (default "host" (index . "machineRole")) "canonical" }}
+Include config.local
+Host *
+  HashKnownHosts yes
+  ForwardAgent no
+  ServerAliveInterval 120
+{{ else }}
+# Ensure KnownHosts are unreadable if leaked
+HashKnownHosts yes
+
+Compression no
+ControlMaster auto
+ControlPersist 10
+AddressFamily inet
+ServerAliveInterval 120
+IdentitiesOnly yes
+
+Host git.sommerfeld.dev
+  Hostname mandibles.wg
+
+Include work.config
+
+Match host * exec "gpg-connect-agent UPDATESTARTUPTTY /bye"
+
+Match host *.wg,*.pulpo
+  IdentityFile ~/.ssh/nym.pub
+{{ end }}
-- 
cgit v1.3.1