Prompt for a host-key path interactively as a third fallback

If neither /etc/host-keys nor /root/host-keys has the target's SSH
host key, auto-install.sh previously went straight to "continue
without one anyway?". Added a third option in between, gated on
[[ -t 0 ]] (only offered when there's an actual operator at stdin, never
in an unattended/non-interactive run): prompt for an arbitrary
directory (USB stick, other mount, etc.), and if the key pair is
there, copy it into /root/host-keys and install it to /mnt same as the
existing pre-seeded-key path. Falls through to the original
warning+confirm if the prompt is skipped, the path doesn't have the
key, or the run isn't interactive at all.

docs/auto-installer.md updated to mention the new fallback. Quick
bash -n + shellcheck pass only, per request.

docs/auto-installer.md

@@ -195,6 +195,10 @@ default.
 `auto-install.sh` still supports the older manual path as a fallback: if a
 host's key isn't baked in (`/etc/host-keys`), it checks `/root/host-keys`
 next, where you can `scp` a key in after boot, same as before this migration.
+If neither has it and the script is running interactively (an actual
+operator at the other end of stdin, not an unattended run), it prompts for
+an arbitrary directory to check (a mounted USB stick, another filesystem,
+etc.) and copies the key pair into `/root/host-keys` from there if found.
 
 ## Storage
 

scripts/installer/auto-install.sh

@@ -114,16 +114,38 @@ elif [[ -f "/root/host-keys/${choice}_ssh_host_ed25519_key" ]]; then
     install -D -m 0600 "/root/host-keys/${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
     install -D -m 0644 "/root/host-keys/${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
 else
+    # Third place a key can come from: an arbitrary path the operator
+    # points at interactively (e.g. a USB stick, a mount from another
+    # machine) -- only offered when there's an actual human at the other
+    # end of stdin to ask, never in a non-interactive run.
+    key_copied=0
+    if [[ -t 0 ]]; then
+        echo "No SSH host key found for ${choice} (checked /etc/host-keys and /root/host-keys)."
+        read -rp "Path to a directory containing ${choice}_ssh_host_ed25519_key(.pub) (blank to skip): " key_src_dir
+        if [[ -n "$key_src_dir" && -f "${key_src_dir}/${choice}_ssh_host_ed25519_key" && -f "${key_src_dir}/${choice}_ssh_host_ed25519_key.pub" ]]; then
+            cp "${key_src_dir}/${choice}_ssh_host_ed25519_key" "${key_src_dir}/${choice}_ssh_host_ed25519_key.pub" /root/host-keys/
+            key_copied=1
+        elif [[ -n "$key_src_dir" ]]; then
+            echo "WARNING: ${choice}_ssh_host_ed25519_key(.pub) not found in ${key_src_dir}."
+        fi
+    fi
+
+    if [[ "$key_copied" -eq 1 ]]; then
+        echo "Copied SSH host key for ${choice} from ${key_src_dir}, installing to target..."
+        install -D -m 0600 "/root/host-keys/${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
+        install -D -m 0644 "/root/host-keys/${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
+    else
         echo "WARNING: no SSH host key found for ${choice} (checked /etc/host-keys and /root/host-keys)"
         echo "sops-nix secrets (including the login password) will NOT decrypt on first boot."
         echo "Run scripts/secrets/prepare-host-key.sh for host ${choice} on your admin workstation first,"
-    echo "then either rebuild this image with NIXOS_HOST_KEYS_DIR set, or scp the result to"
+        echo "then either rebuild this image with NIXOS_HOST_KEYS_DIR set, scp the result to"
-    echo "/root/host-keys/ on this machine."
+        echo "/root/host-keys/ on this machine, or point at it when prompted above."
         read -rp "Continue without a pre-seeded key anyway? (y/N): " skip_key
         if [[ ! "$skip_key" =~ ^[Yy]$ ]]; then
             echo "Aborted."
             exit 1
         fi
+    fi
 fi
 
 mkdir -p /mnt/install-tmp