Eee: permanent reverse tunnel to server

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hosts/FredOS-Eee.nix

@@ -7,6 +7,9 @@
 # Build on the server, never on the Eee — evaluating this flake alone would
 # eat its 1GB.
 { config, lib, pkgs, ... }:
+let
+  serverKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMbIdOSPjnJYQ7z7n0mHKo8T8PnAkCyIBCmT4KpsHyy/ fred@FredOS-Mediaserver";
+in
 {
   imports = [
     ../settings/locale.nix
@@ -52,10 +55,37 @@
   };
 
   services.openssh.enable = true;
-  # The server's key, so it can push closures and poke at the box.
+  # The server's key, so it can push closures and poke at the box. Root too:
-  users.users.fred.openssh.authorizedKeys.keys = [
+  # `eee-update` copies unsigned closures, which only a trusted user may do.
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMbIdOSPjnJYQ7z7n0mHKo8T8PnAkCyIBCmT4KpsHyy/ fred@FredOS-Mediaserver"
+  users.users.fred.openssh.authorizedKeys.keys = [ serverKey ];
-  ];
+  users.users.root.openssh.authorizedKeys.keys = [ serverKey ];
+
+  # The Eee lives on other people's networks, so the server can't reach it.
+  # Instead it holds a reverse tunnel open: server's localhost:2222 -> Eee:22
+  # (`ssh eee` there). The key is made here on first start and only allowed
+  # to open that one forward (hosts/FredOS-Mediaserver.nix). Plain ssh +
+  # Restart=always covers reconnects; ExitOnForwardFailure retries while the
+  # server still holds a dead session's port.
+  systemd.services.server-tunnel = {
+    wantedBy = [ "multi-user.target" ];
+    wants = [ "network-online.target" ];
+    after = [ "network-online.target" ];
+    serviceConfig = {
+      StateDirectory = "server-tunnel";
+      Restart = "always";
+      RestartSec = 30;
+    };
+    preStart = ''
+      [ -f $STATE_DIRECTORY/id_ed25519 ] || \
+        ${pkgs.openssh}/bin/ssh-keygen -q -t ed25519 -N "" -C "eee-tunnel" -f $STATE_DIRECTORY/id_ed25519
+    '';
+    script = ''
+      exec ${pkgs.openssh}/bin/ssh -N -i $STATE_DIRECTORY/id_ed25519 \
+        -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes \
+        -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$STATE_DIRECTORY/known_hosts \
+        -R 2222:localhost:22 fred@nordhammer.it
+    '';
+  };
 
   # Firefox is marked unsupported on i686 (Mozilla dropped 32-bit Linux), so
   # WebKit is the only engine left that handles the modern web.