Add YubiKey / FIDO2 hardware-backed admin SSH

[wksantiago]

New keepNode.security.yubikey module: ed25519-sk/ecdsa-sk keys for keepadmin, opt-in requireHardwareKey (sshd refuses non-sk- keys), per-key verify-required, build-time + boot-time anti-lockout guards, and a keepnode-enroll-yubikey post-install helper. Adds keepNode.vaultwarden.domain so WebAuthn binds to the right origin. Off by default; software keys unaffected.

Closes #99

Summary by CodeRabbit

• New Features
  • Added optional YubiKey/FIDO2 hardware-backed SSH authentication for administrator access (PIN + touch), with stricter SSH key algorithm handling.
  • Added tooling and guidance for enrolling hardware security keys, including runtime enrollment after installation.
  • Added configuration to publish Vaultwarden’s domain for smoother FIDO2/WebAuthn passkey flows.
• Documentation
  • Expanded deployment and security guidance, including anti-lockout and recovery behavior.
• Security
  • Maintains password/keyboard-interactive SSH access disabled; physical console break-glass remains available if hardware keys are lost.
• Tests
  • Added an end-to-end integration test covering hardware vs non-hardware posture and enrollment/anti-lockout behavior.

[coderabbitai]

Warning

Review limit reached

@wksantiago, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: bea1d847-da59-44ae-937a-86a01216f137

📥 Commits

Reviewing files that changed from the base of the PR and between 1088e21 and c096c9a.

📒 Files selected for processing (2)

• README.md
• nixos/lib/authorized-keys.nix

Walkthrough

Adds optional YubiKey/FIDO2-backed SSH authentication for keepadmin, hardware-key enforcement and anti-lockout checks, post-install enrollment, Vaultwarden WebAuthn domain configuration, documentation, and CI/VM validation.

Changes

YubiKey SSH and Vaultwarden support

Layer / File(s)	Summary
YubiKey module contracts and SSH policy nixos/lib/authorized-keys.nix, nixos/yubikey.nix	Defines FIDO2 key options, classifies and validates hardware keys, wires them into admin access, and configures OpenSSH algorithms and verify-required.
Enrollment and anti-lockout runtime nixos/lib/key-check.nix, nixos/admin-access.nix, nixos/yubikey.nix, nixos/keep-node.nix, flake.nix	Adds reusable key checks, the enrollment helper, runtime hardware-key validation, module composition, and installer enablement.
Vaultwarden WebAuthn domain nixos/vaultwarden.nix	Adds keepNode.vaultwarden.domain and conditionally sets Vaultwarden’s DOMAIN with ingress precedence.
Validation and operator documentation flake.nix, tests/yubikey-ssh.nix, README.md, docs/SECURITY.md, docs/deployment.md	Adds evaluation and OpenSSH capability checks, VM coverage, and instructions for YubiKey SSH and Vaultwarden WebAuthn.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant keepnode-enroll-yubikey
  participant RuntimeAuthorizedKeys
  participant AntiLockoutCheck
  Operator->>keepnode-enroll-yubikey: Submit FIDO2 public key
  keepnode-enroll-yubikey->>RuntimeAuthorizedKeys: Validate, deduplicate, and append key
  keepnode-enroll-yubikey->>AntiLockoutCheck: Restart hardware-key check
  AntiLockoutCheck->>RuntimeAuthorizedKeys: Verify usable sk- key exists

Loading

Possibly related PRs

• privkeyio/keep-node#58: Extends the admin-access SSH flow with YubiKey authorization.
• privkeyio/keep-node#60: Covers related runtime authorized-key and anti-lockout behavior.
• privkeyio/keep-node#88: Covers related SSH authorized-key and anti-lockout checks.

Suggested labels: full-ci

Poem

A bunny taps PIN, then touches the key,
SSH hops securely, wild and free.
Lost tokens close the admin door,
FROST still guards the vault’s core.
Hop, hop—safe access blooms! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: adding YubiKey/FIDO2 hardware-backed admin SSH.
Linked Issues check	✅ Passed	The PR implements FIDO2 SSH, anti-lockout checks, Vaultwarden domain support, enrollment tooling, and docs/tests matching #99.
Out of Scope Changes check	✅ Passed	The changes stay focused on YubiKey/FIDO2 SSH, Vaultwarden origin support, docs, and tests; no unrelated work stands out.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yubikey-fido2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nixos/yubikey.nix`:
- Around line 267-282: The keyTypes allow-list is bypassed in both hardware-key
validation paths. In nixos/yubikey.nix lines 267-282, update the anti-lockout
check to match only concrete key algorithms from acceptedAlgorithms rather than
the generic sk-(ssh|ecdsa) pattern; in nixos/yubikey.nix lines 80-87, update the
enrollment helper’s pasted-key validation to use acceptedAlgorithms instead of
hardcoded prefixes, while preserving the default behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 21db1cce-31de-44f0-94e5-4707a8629a06

📥 Commits

Reviewing files that changed from the base of the PR and between ad8369d and 771a663.

📒 Files selected for processing (8)

• README.md
• docs/SECURITY.md
• docs/deployment.md
• flake.nix
• nixos/keep-node.nix
• nixos/vaultwarden.nix
• nixos/yubikey.nix
• tests/yubikey-ssh.nix

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 107-110: Remove the blank line separating the adjacent blockquote
lines in the README passage so the YubiKey and recovery text remains one
continuous blockquote and satisfies markdownlint MD028.
- Around line 84-85: Fix the new prose punctuation by removing spaces before
commas in the phrases “laptop,” and “vault,” including the corresponding text at
the additional referenced location.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b79bc45d-a2f9-4f45-a3e1-7fc479adb044

📥 Commits

Reviewing files that changed from the base of the PR and between 771a663 and 1088e21.

📒 Files selected for processing (11)

• README.md
• docs/SECURITY.md
• docs/deployment.md
• flake.nix
• nixos/admin-access.nix
• nixos/keep-node.nix
• nixos/lib/authorized-keys.nix
• nixos/lib/key-check.nix
• nixos/vaultwarden.nix
• nixos/yubikey.nix
• tests/yubikey-ssh.nix

🚧 Files skipped from review as they are similar to previous changes (6)

• nixos/keep-node.nix
• nixos/vaultwarden.nix
• docs/SECURITY.md
• docs/deployment.md
• flake.nix
• nixos/yubikey.nix