refactor(ssh): centralize identity file logic and optimize host selection

Refactor the SSH configuration generation to reduce duplication and
improve efficiency.

- Extract `IdentityFile` line generation into a shared variable in
  `ssh-inventory.nix` to ensure consistency between per-host and
  gitea blocks.
- Optimize `selectedHosts` resolution in `home-manager/default.nix`
  by reusing `activeHosts` when the "all" wildcard is used.
- Tighten IPv4 regex matching in `ssh-inventory.nix` using anchors.
- Update `users-merge.nix` to propagate `extraIdentities` to the
  rbw outbound configuration.
- Set default `authorizedHosts` to "all" for inbound SSH users.

modules/lib/ssh-inventory.nix

@@ -57,7 +57,7 @@
       # parses as an IPv4 dotted-quad. Filters out scratchpad/non-routable
       # entries (e.g. `hostName = "test"`).
       activeHosts = lib.filterAttrs
-        (_: h: lib.match "[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+" h.hostName != null)
+        (_: h: lib.match "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$" h.hostName != null)
         hosts;
 
       # .pub filename convention. OpenSSH 7.3+ accepts a `.pub` file as
@@ -78,6 +78,10 @@
           identityAgent ? "SSH_AUTH_SOCK",
         }:
         let
+          # Shared `IdentityFile` filter line (when `user` is set). Used by
+          # both the per-host and gitea blocks so the two can't drift apart.
+          idLine = lib.optionalString (user != null) "  IdentityFile ~/${mkIdentityFileName user}\n";
+
           # Match blocks for cross-account SSH. Filter out cfg.user since
           # the matching pub is already loaded via the Host block's
           # IdentityFile line — re-emitting it would just duplicate.
@@ -97,7 +101,6 @@
             let
               e = selectedHosts.${hostName};
               hostPatterns = lib.concatStringsSep " " (e.aliases ++ [ e.hostName ]);
-              idLine = if user == null then "" else "  IdentityFile ~/${mkIdentityFileName user}\n";
             in ''
               Host ${hostPatterns}
                 HostName ${e.hostName}
@@ -114,7 +117,7 @@
               HostName 192.168.2.238
               Port 222
               User git
-            ${if user == null then "" else "  IdentityFile ~/${mkIdentityFileName user}\n"}  IdentityAgent ${identityAgent}
+            ${idLine}  IdentityAgent ${identityAgent}
               IdentitiesOnly yes
           '';
 

modules/lib/users-merge.nix

@@ -60,6 +60,7 @@
           chiasson.ssh.outbound.rbw.user = name;
           chiasson.ssh.outbound.rbw.hosts =
             if (outboundCfg.hosts or "all") == "all" then [ "all" ] else outboundCfg.hosts;
+          chiasson.ssh.outbound.rbw.extraIdentities = outboundCfg.extraIdentities or [ ];
         };
 
       mkHmUserModule =

modules/ssh/home-manager/default.nix

@@ -12,6 +12,13 @@
         else
           cfg.hosts;
       missingHosts = builtins.filter (name: !(builtins.hasAttr name inventory.hosts)) selectedHostNames;
+      # Resolve to the actual host attrs for the template. The "all" case
+      # reuses `activeHosts` directly instead of rebuilding the same attrset.
+      selectedHosts =
+        if cfg.hosts == [ "all" ] then
+          inventory.activeHosts
+        else
+          builtins.listToAttrs (map (n: { name = n; value = inventory.hosts.${n}; }) selectedHostNames);
       # All identities this HM user may authenticate AS: cfg.user ∪
       # extraIdentities. `cfg.user` can be null (e.g. user not in inventory
       # yet) — in that case the Host-block IdentityFile line is suppressed
@@ -112,7 +119,7 @@
           }
           (lib.mkIf cfg.manageSshConfig {
             home.file.".ssh/config".text = inventory.mkSshConfigTemplate {
-              selectedHosts = builtins.listToAttrs (map (n: { name = n; value = inventory.hosts.${n}; }) selectedHostNames);
+              inherit selectedHosts;
               user = cfg.user;
               inherit (cfg) extraIdentities;
             };

modules/system/users.nix

@@ -156,6 +156,7 @@
               createHome = false;
               homeManager = { enable = false; module = null; };
               ssh.inbound.enable = true;
+              ssh.inbound.authorizedHosts = "all";
             };
           };