Mediaserver: accept Eee tunnel, eee-update

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hosts/FredOS-Mediaserver.nix

@@ -27,6 +27,23 @@
     # can still allocate while userspace is squeezed.
     boot.kernel.sysctl."vm.min_free_kbytes" = 1048576;
 
+    # FredOS-Eee dials in and holds localhost:2222 -> its sshd open (see
+    # hosts/FredOS-Eee.nix). Its key may open exactly that forward, nothing else.
+    users.users.fred.openssh.authorizedKeys.keys = [
+      ''restrict,port-forwarding,permitlisten="localhost:2222",command="${pkgs.coreutils}/bin/false" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOwVhdOMnFbOu9zS4jjrGyIPE00lJNc0IIKX/u04WwN5 eee-tunnel''
+    ];
+    # Reap dead sessions in ~3min so a dropped tunnel's port frees up for the
+    # reconnect (default is TCP keepalive: 2h).
+    services.openssh.settings.ClientAliveInterval = 60;
+    services.openssh.settings.ClientAliveCountMax = 3;
+    programs.ssh.extraConfig = ''
+      Host eee
+        HostName localhost
+        Port 2222
+        HostKeyAlias FredOS-Eee
+        StrictHostKeyChecking accept-new
+    '';
+
     # Basic system packages
     environment.systemPackages = with pkgs; [
       mergerfs
@@ -41,6 +58,15 @@
       javaPackages.compiler.temurin-bin.jre-25
       unzip
       screen
+      # The Eee can't evaluate the flake in 1GB: build here, push over its
+      # tunnel, switch. The out-link keeps the closure from the weekly GC.
+      (pkgs.writeShellScriptBin "eee-update" ''
+        set -euo pipefail
+        sys=$(nix build --refresh --print-out-paths --out-link ~/eee-system \
+          git+https://forg.gregersen.it/rope/nixos#nixosConfigurations.FredOS-Eee.config.system.build.toplevel)
+        nix copy --no-check-sigs --to ssh-ng://root@eee "$sys"
+        ssh root@eee "nix-env -p /nix/var/nix/profiles/system --set $sys && $sys/bin/switch-to-configuration switch"
+      '')
       yt-dlp
       # Audible library -> /mnt/storage/torrents/audiobooks for Jellyfin.
       # audible-cli pulls the .aaxc + voucher, AAXtoMP3 decrypts to m4b.