ssh: manage ~/.ssh/config (goliath over Tailscale, multiplexing); goliath window uses mosh

docs/desktop/hyprland.md

@@ -247,7 +247,7 @@ Named workspaces provide the per-app workspaces. `SUPER + ALT + S` (send to scra
 | `SUPER + CTRL + ALT + T` | tldraw offline: `omarchy-launch-or-focus tldraw-offline "gtk-launch tldraw-offline"` | show time |
 | `SUPER + CTRL + ALT + W` | tldraw: `omarchy-launch-or-focus tldraw "gtk-launch TLDraw"` | toggle weather |
 | `SUPER + CTRL + ALT + SPACE` | Sticky Notes Canvas via `gtk-launch io.github.faridjaff.StickyNotesCanvas` | — |
-| `SUPER + SHIFT + G` | Goliath: `kitty --class=kitty-goliath --title=goliath --session=none kitten ssh goliath` (main `kitty.conf`) | Signal |
+| `SUPER + SHIFT + G` | Goliath: `kitty --class=kitty-goliath --title=goliath --session=none mosh goliath` (main `kitty.conf`; see [SSH and mosh](../tools/ssh.md)) | Signal |
 | `SUPER + ALT + SHIFT + F` | `uwsm-app -- "$HOME/.local/bin/strata" "$(omarchy-cmd-terminal-cwd)"` — strata in the terminal's cwd | unbound first (default unnamed) |
 
 strata is the default file manager: `inode/directory` in `mimeapps.list` and the `org.freedesktop.FileManager1` D-Bus service both point at it ([15-tools](../chezmoi/scripts.md#15-tools)). The cwd bind uses the absolute path because `~/.local/bin` may be missing from uwsm-app's `PATH`. Omarchy's own file-manager bind on `SUPER + SHIFT + F` is replaced by full screen (below). A rule tagging `com.thisisgm.flea.picker` as `+floating-window` still sits between `flea --picker` marker comments, which the `flea` tool writes and removes itself.

docs/terminal/kitty.md

@@ -187,7 +187,7 @@ Launched by `super+a`. Class `kitty-herdr`, `tab_bar_style hidden` (herdr draws
 
 ### Goliath (`SUPER + SHIFT + G`)
 
-Not a separate config: [Hyprland](../desktop/hyprland.md) starts a new kitty on the main `kitty.conf` (same tab bar, keys and theme) running `kitty --class=kitty-goliath --title=goliath --session=none kitten ssh goliath`. That is a plain login shell on goliath, no tmux, so closing the window ends the session. kitten ssh copies kitty's terminfo over, so `TERM` stays `xterm-kitty`. New tabs and splits open local shells. `--session=none` keeps this kitty from claiming today's [daily session](#daily-sessions); `--title` keeps the OS window titled `goliath` (`os_window_title.py` skips kitties started with `--title`).
+Not a separate config: [Hyprland](../desktop/hyprland.md) starts a new kitty on the main `kitty.conf` (same tab bar, keys and theme) running `kitty --class=kitty-goliath --title=goliath --session=none mosh goliath`. That is a plain login shell on goliath over mosh, no tmux; it survives suspend and network changes, and closing the window ends it. Host settings and mosh caveats (`TERM` is `xterm-256color` inside) are in [SSH and mosh](../tools/ssh.md). New tabs and splits open local shells. `--session=none` keeps this kitty from claiming today's [daily session](#daily-sessions); `--title` keeps the OS window titled `goliath` (`os_window_title.py` skips kitties started with `--title`).
 
 ### ssh.conf
 

docs/tools/README.md

@@ -22,6 +22,7 @@ Packages come from `.chezmoidata/packages.yaml` and are installed by `run_onchan
 | [drydock](drydock.md) | drydock repo fleet view | `dot_config/drydock/config.toml` | n/a |
 | [television](television.md) | tv fuzzy picker, custom cables | external repo via `.chezmoiexternals/television.toml` | `cyberdream-transparent` |
 | [LeetCode](leetcode.md) | leetcode CLI, `lc-elir` | `dot_leetcode/` | n/a |
+| [SSH and mosh](ssh.md) | ssh, mosh | `private_dot_ssh/config` | n/a |
 
 - [Git](git.md): Identity from chezmoi data, diff pagers, gh credential helper.
 - [Yazi](yazi.md): Keymap, plugins, bookmarks, and the Neovim bridge.

docs/tools/ssh.md

@@ -0,0 +1,31 @@
+# SSH and mosh
+
+`~/.ssh/config` with the goliath host, and mosh for the interactive session behind `SUPER + SHIFT + G`.
+
+| | |
+| --- | --- |
+| Source | `private_dot_ssh/config` |
+| Target | `~/.ssh/config` (symlink; `private_` keeps `~/.ssh` at `0700`) |
+| Packages | `mosh`, `tailscale` (pacman, every role, so goliath has `mosh-server` too) |
+
+Keys, `known_hosts` and the agent socket are not managed; only `config` is. The agent comes from fish's [`30-ssh-agent.fish`](../shell/fish.md#30-ssh-agentfish). Keepalives come from Omarchy's `/etc/ssh/ssh_config.d/20-omarchy-keepalive.conf` (`ServerAliveInterval 15`, `ServerAliveCountMax 3`, `ConnectTimeout 10`).
+
+## Host goliath
+
+| Option | Value | Why |
+| --- | --- | --- |
+| `HostName` | `goliath.tail62ced9.ts.net` | Tailscale MagicDNS: the same address at home and away. The LAN's DNS answers `goliath` with an IPv6 address only |
+| `HostKeyAlias` | `goliath` | Host keys stay filed under the short name already in `known_hosts` |
+| `User` | `prad` | |
+| `IdentityFile` / `IdentitiesOnly` | `~/.ssh/id_ed25519` / `yes` | Offers one key instead of trying every default |
+| `ControlMaster` / `ControlPath` / `ControlPersist` | `auto` / `~/.ssh/cm-%C` / `10m` | One shared connection: later ssh, scp and git runs skip the handshake, and it stays up 10 minutes after the last one exits |
+
+## mosh
+
+`SUPER + SHIFT + G` ([Hyprland](../desktop/hyprland.md)) opens `kitty --class=kitty-goliath --title=goliath --session=none mosh goliath` on the main `kitty.conf` (see [kitty](../terminal/kitty.md#goliath-super--shift--g)). mosh logs in over ssh with this host block (`%h` is the Tailscale name), starts `mosh-server` on goliath, then talks UDP 60000–61000 over Tailscale. The session survives suspend, Wi-Fi changes and dropped links, and echoes keystrokes locally while the link is slow.
+
+- mosh's bootstrap ssh runs with `-S none`, so it never uses the shared connection; key auth through the agent must work non-interactively.
+- goliath runs no firewall, and Tailscale carries the UDP traffic.
+- mosh passes the client's `LANG` (`en_US.UTF-8`); goliath has `en_US.utf8` generated, which `mosh-server` needs.
+- Inside mosh `TERM` is `xterm-256color`: kitty-only features (undercurl, graphics, the keyboard protocol) are unavailable.
+- Closing the kitty window kills `mosh-client` without telling the server, so that `mosh-server` stays on goliath until it is killed (`pkill mosh-server` on goliath).

private_dot_ssh/config

@@ -0,0 +1,18 @@
+# ~/.ssh/config (chezmoi: private_dot_ssh/config). Keepalives come from
+# Omarchy's /etc/ssh/ssh_config.d/20-omarchy-keepalive.conf (15 s x 3).
+
+# goliath: home server. Reached over Tailscale (MagicDNS), so one name works
+# on the LAN and away; the LAN's own DNS only hands out an IPv6 address.
+# HostKeyAlias keeps the host keys already filed under "goliath".
+Host goliath
+  HostName goliath.tail62ced9.ts.net
+  HostKeyAlias goliath
+  User prad
+  IdentityFile ~/.ssh/id_ed25519
+  IdentitiesOnly yes
+  # One shared connection: the first ssh/scp/git authenticates, later ones
+  # start instantly and it lingers 10 min after the last closes. mosh's
+  # bootstrap ssh runs with -S none and does its own handshake.
+  ControlMaster auto
+  ControlPath ~/.ssh/cm-%C
+  ControlPersist 10m