From 87d1886346ab0bc57fae6f1e6e10646f088cc3f6 Mon Sep 17 00:00:00 2001
From: Luca Boccassi <bluca@debian.org>
Date: Thu, 8 Sep 2022 16:27:52 +0100
Subject: [PATCH 1/2] man: add example with one-liner for ssh provisioning via
 tmpfiles.d + Creds

---
 man/tmpfiles.d.xml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/man/tmpfiles.d.xml b/man/tmpfiles.d.xml
index 04617bc532..15785d1bf2 100644
--- a/man/tmpfiles.d.xml
+++ b/man/tmpfiles.d.xml
@@ -826,6 +826,19 @@ e! /var/cache/krb5rcache - - - 0
       will be removed on boot. The directory will not be created.
       </para>
     </example>
+
+    <example>
+      <title>Provision SSH public key access for root user via Credentials in QEMU</title>
+
+      <programlisting>-smbios type=11,value=io.systemd.credential.binary:tmpfiles.extra=$(echo "f~ /root/.ssh/authorized_keys 700 root root - $(ssh-add -L | base64 -w 0)" | base64 -w 0)
+</programlisting>
+
+      <para>By passing this line to QEMU, the public key of the current user will be encoded in
+      base64, added to a tmpfiles.d line that tells systemd-tmpfiles to decode it into
+      <filename>/root/.ssh/authorized_keys</filename>, encode that line itself in base64 and
+      pass it as a Credential that will be picked up by systemd from SMBIOS on boot.
+      </para>
+    </example>
   </refsect1>
 
   <refsect1>

From b60d3016ebe9c0391064fbd903354418ba8e1453 Mon Sep 17 00:00:00 2001
From: Luca Boccassi <bluca@debian.org>
Date: Thu, 8 Sep 2022 16:33:24 +0100
Subject: [PATCH 2/2] docs: mention tmpfiles.d in CREDENTIALS.md and add
 example

---
 docs/CREDENTIALS.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/docs/CREDENTIALS.md b/docs/CREDENTIALS.md
index 52741082f2..70e2ea36d5 100644
--- a/docs/CREDENTIALS.md
+++ b/docs/CREDENTIALS.md
@@ -342,6 +342,10 @@ Various services shipped with `systemd` consume credentials for tweaking behavio
   `firstboot.keymap`, `firstboot.timezone`, that configure locale, keymap or
   timezone settings in case the data is not yet set in `/etc/`.
 
+* [`tmpfiles.d(5)`](https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html)
+  will look for the credentials `tmpfiles.extra` with arbitrary tmpfiles.d lines.
+  Can be encoded in base64 to allow easily passing it on the command line.
+
 In future more services are likely to gain support for consuming credentials.
 
 Example:
@@ -377,6 +381,23 @@ qemu-system-x86_64 \
         -smbios type=11,value=io.systemd.credential:firstboot.locale=C.UTF-8
 ```
 
+This boots the specified disk image via qemu, provisioning public key SSH access
+for the root user from the caller's key:
+
+```
+qemu-system-x86_64 \
+        -machine type=q35,accel=kvm,smm=on \
+        -smp 2 \
+        -m 1G \
+        -cpu host \
+        -nographic \
+        -nodefaults \
+        -serial mon:stdio \
+        -drive if=none,id=hd,file=test.raw,format=raw \
+        -device virtio-scsi-pci,id=scsi \
+        -device scsi-hd,drive=hd,bootindex=1 \
+        -smbios type=11,value=io.systemd.credential.binary:tmpfiles.extra=$(echo "f~ /root/.ssh/authorized_keys 700 root root - $(ssh-add -L | base64 -w 0)" | base64 -w 0)
+```
 ## Relevant Paths
 
 From *service* perspective the runtime path to find loaded credentials in is