emily
3cba4cbd86
Adds a new NixOS module (greg.monitoring-access) that provisions a dedicated, SSH-key-only 'emily' user account across all managed hosts. The account is intentionally minimal-privilege: - No password set (SSH key auth only) - Not a member of wheel, no sudo/sudo-rs rules - Only extra group membership is systemd-journal, granting read access to system logs for monitoring/analysis tasks - Authorized key lives in home/ssh/emily_authorized_keys, mirroring the existing pattern used for the greg account's authorized_keys This lets the Hermes agent (emily) log in read-only to inspect logs and system state when asked, without any ability to modify configuration, escalate privileges, or run destructive commands. Module is imported unconditionally in modules/nixos/default.nix like the other nixos modules, and defaults to enabled; it can be disabled per-host via greg.monitoring-access.enable = false if ever needed.