From 0fbdb0cd87a55ac26df54694386953281850d0a9 Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Mon, 28 Sep 2026 10:12:04 +0200
Subject: ...

---
 accounts/gkleen@skadhi/default.nix     |  2 ++
 accounts/gkleen@skadhi/rzm/default.nix | 41 ++++++++++++++++++++++++++++++++--
 2 files changed, 41 insertions(+), 2 deletions(-)

(limited to 'accounts/gkleen@skadhi')

diff --git a/accounts/gkleen@skadhi/default.nix b/accounts/gkleen@skadhi/default.nix
index e4b35a78..1d6381a5 100644
--- a/accounts/gkleen@skadhi/default.nix
+++ b/accounts/gkleen@skadhi/default.nix
@@ -288,6 +288,8 @@ in {
       };
 
       programs.chromium.enable = true;
+
+      services.autosshProxy.vidhar.port = 8121;
     };
   };
 }
diff --git a/accounts/gkleen@skadhi/rzm/default.nix b/accounts/gkleen@skadhi/rzm/default.nix
index 11d8af8b..e2a47362 100644
--- a/accounts/gkleen@skadhi/rzm/default.nix
+++ b/accounts/gkleen@skadhi/rzm/default.nix
@@ -97,7 +97,7 @@ in {
       '';
     };
 
-    home-manager.users.gkleen = { sysConfig, config, ... }: {
+    home-manager.users.gkleen = { sysConfig, config, lib, ... }: {
       home.persistence."/persistent" = {
         files = [
           "rz.kdbx"
@@ -176,7 +176,36 @@ in {
         pro = "$HOME/projects/pro";
       };
 
-      programs.ssh.matchBlocks = {
+      programs.ssh.matchBlocks = let
+        autosshProxy = host: "${lib.getExe pkgs.socat} - SOCKS4A:127.0.0.1:%h:%p,socksport=${toString config.services.autosshProxy.${host}.port}";
+      in {
+        "repo-apt01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          user = "root";
+          hostname = "repo-apt01.mathinst.loc";
+          proxyCommand = autosshProxy "mgmt01";
+        };
+        "mgmt01" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          user = "root";
+          hostname = "mgmt01.mathinst.loc";
+          proxyCommand = autosshProxy "mathw0h";
+        };
+        "mathw0e" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          hostname = "mathw0e.mathinst.loc";
+          proxyCommand = autosshProxy "mathw0h";
+        };
+        "cip04" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          hostname = "cip04.cipmath.loc";
+          proxyCommand = autosshProxy "mathw0h";
+        };
+        "mathw0h" = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          hostname = "mathw0h.mathinst.loc";
+          proxyCommand = autosshProxy "ssh.math.lmu.de";
+        };
+        "math05"  = lib.hm.dag.entryBefore ["*.mathinst.loc"] {
+          hostname = "math05.mathinst.loc";
+          proxyCommand = autosshProxy "mathw0h";
+          extraOptions.KexAlgorithms = "+diffie-hellman-group1-sha1";
+        };
         "*.mathinst.loc" = {
           match = "host *.mathinst.loc,*.cipmath.loc,*.math.lmu.de";
           identityFile = "~/.ssh/gkleen@mathinst.loc";
@@ -191,6 +220,14 @@ in {
         };
       };
 
+      services.autosshProxy = {
+        "mgmt01" = { port = 8129; sshpassSecret = "root@mgmt01.mathinst.loc"; };
+        "mathw0e" = { port = 8125; sshpassSecret = "gkleen@mathw0e.mathinst.loc"; };
+        "mathw0h" = { port = 8123; sshpassSecret = "gkleen@mathw0h.mathinst.loc"; };
+        "cip04" = { port = 8127; sshpassSecret = "gkleen@cip04.cipmath.loc"; };
+        "ssh.math.lmu.de" = { port = 8119; sshpassSecret = "gkleen@ssh.math.lmu.de"; };
+      };
+
       home.file = {
         ".cups/client.conf".text = ''
           ServerName cups.mathinst.loc
-- 
cgit v1.2.3