From 3cba4cbd86272dfcdd78ef3d84a6d623fafa2443 Mon Sep 17 00:00:00 2001
From: "Emily (Agent)" <emily@thehellings.com>
Date: Sun, 9 Aug 2026 07:38:01 -0500
Subject: [PATCH] feat: add read-only emily monitoring account

Adds a new NixOS module (greg.monitoring-access) that provisions a
dedicated, SSH-key-only 'emily' user account across all managed hosts.

The account is intentionally minimal-privilege:
- No password set (SSH key auth only)
- Not a member of wheel, no sudo/sudo-rs rules
- Only extra group membership is systemd-journal, granting read access
  to system logs for monitoring/analysis tasks
- Authorized key lives in home/ssh/emily_authorized_keys, mirroring the
  existing pattern used for the greg account's authorized_keys

This lets the Hermes agent (emily) log in read-only to inspect logs and
system state when asked, without any ability to modify configuration,
escalate privileges, or run destructive commands.

Module is imported unconditionally in modules/nixos/default.nix like
the other nixos modules, and defaults to enabled; it can be disabled
per-host via greg.monitoring-access.enable = false if ever needed.
---
 home/ssh/emily_authorized_keys      |  1 +
 modules/nixos/default.nix           |  1 +
 modules/nixos/monitoring-access.nix | 53 +++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+)
 create mode 100644 home/ssh/emily_authorized_keys
 create mode 100644 modules/nixos/monitoring-access.nix

diff --git a/home/ssh/emily_authorized_keys b/home/ssh/emily_authorized_keys
new file mode 100644
index 0000000..c0bb320
--- /dev/null
+++ b/home/ssh/emily_authorized_keys
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUz4YsVKBERXDT9nl4lwWHoA7NkI7M1Wr3QEYtgz9hy emily-monitoring@thehellings.com
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index a0676c5..febe84f 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -16,6 +16,7 @@
     #./kiwix-serve.nix
     ./kubernetes.nix
     ./linode.nix
+    ./monitoring-access.nix
     ./podman.nix
     ./print.nix
     ./proxy.nix
diff --git a/modules/nixos/monitoring-access.nix b/modules/nixos/monitoring-access.nix
new file mode 100644
index 0000000..332081a
--- /dev/null
+++ b/modules/nixos/monitoring-access.nix
@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.greg.monitoring-access;
+in
+with lib;
+{
+  options.greg.monitoring-access = {
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Create a dedicated, read-only account (`emily`) for automated
+        monitoring and analysis by the Hermes agent. The account is
+        SSH-key-only (no password set), is not added to `wheel`, and is
+        granted no sudo rights. It only gets read access to the systemd
+        journal via group membership, which is sufficient for log
+        inspection and health/analysis tasks without any privileged
+        access to the rest of the system.
+      '';
+    };
+
+    sshKeys = mkOption {
+      type = types.listOf types.str;
+      default = lib.strings.splitString "\n" (
+        builtins.readFile ../../home/ssh/emily_authorized_keys
+      );
+      description = "SSH public keys authorized to log in as the monitoring account.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.groups.emily = { };
+
+    users.users.emily = {
+      isNormalUser = true;
+      createHome = true;
+      description = "Read-only monitoring/analysis account (Hermes agent)";
+      group = "emily";
+      # No password is set on purpose: this account is SSH-key-only.
+      extraGroups = [
+        "systemd-journal" # read access to the journal for log analysis
+      ];
+      shell = pkgs.bashInteractive;
+      openssh.authorizedKeys.keys = cfg.sshKeys;
+    };
+  };
+}