Fleet SSH + Tailscale Host Inventory

Purpose: Single canonical source of truth for all machines in the Tailscale mesh. Every device (Hermes, iMac, Chromebook) should have identical host aliases so ssh hermes, ssh imac, etc. work everywhere.

Owner: Hermes (control plane) Last updated: 2026-06-28 Related Linear issues: NEU-6, NEU-7, NEU-9

Device Inventory

Alias	Tailscale IP	Role	OS	Notes
hermes	(pending)	Control plane	Linux	Hub for fleet changes & key management
imac	(pending)	Workstation	macOS	Primary dev machine
chromebook	100.115.92.201	Portable client	ChromeOS	penguin container; keyless SSH verified
aux-serv	147.93.186.68	External server	Linux	Non-Tailscale; direct IP only

Recommended ~/.ssh/config (device-agnostic)

Copy this block to every machine in the fleet. Replace (pending) IPs as they are discovered via tailscale status.

# === Tailscale mesh ===
Host hermes
    HostName 100.x.x.x
    User ty
    IdentitiesOnly yes

Host imac
    HostName 100.x.x.x
    User ty
    IdentitiesOnly yes

Host chromebook
    HostName 100.115.92.201
    User ty
    IdentitiesOnly yes

# === External / non-Tailscale ===
Host aux-serv
    HostName 147.93.186.68
    User ty
    IdentitiesOnly yes

Keyless SSH Requirements

• All machines must have ty’s ED25519 public key in ~/.ssh/authorized_keys.
• Current known keys (from ssh.md):
  • ty@penguin
  • hudso@InspiroBot
  • hermes.cloud@neuralmeadow.xyz
• After adding a new machine, run:

  ssh-copy-id -i ~/.ssh/id_ed25519 ty@<new-host>

• Verify with ssh <alias> (no password prompt).

Operating Rules

1. Hermes is the source of truth — any new device or IP change is recorded here first, then pushed to other machines.
2. One alias per device — never duplicate or create machine-specific variants.
3. Update this doc before or immediately after any fleet change.
4. Verify connectivity for every pair before considering the mesh complete.
5. Chromebook caveat — uses penguin container; Tailscale IP is stable but subnet routing may be limited.

Acceptance Criteria for Mesh Completion (NEU-9)

• All three core devices appear in the table with real Tailscale IPs.
• Identical ~/.ssh/config exists on Hermes, iMac, and Chromebook.
• ssh hermes, ssh imac, ssh chromebook succeed from every machine without passwords.
• This document is linked from Linear issues NEU-6/7/9.

Next Actions

• Run tailscale status on each machine and fill the IP column.
• Create the unified ~/.ssh/config on iMac and Chromebook.
• Test full mesh reachability.
• Update Linear issues with verification results and link this document.