Do not re-establish ssh connection while copying each and every secret

[flokli]

It might make sense to have morph use the go ssh client implementation instead of shelling out to the ssh binary.

This should be a way to address morph failing to deploy without ssh in $PATH (also see NixOS/nixpkgs#78106)

On top of that, it might make deploying secrets faster, because we can better reuse an existing session instead of creating a new one each and every time.

cc @johanot

[johanot]

@flokli Thanks for this. We actually thought about that when writing the first versions of morph. One major argument against this is to align with how nix copy handles remote ssh stores: https://github.com/NixOS/nix/blob/master/src/libstore/ssh.cc#L103 . Since nix copy is also invoked directly by morph, we might risk having two diverging ssh-environments present at a single morph invocation. Besides that, there are plenty of positive arguments for this suggestion :).

[flokli]

This is somewhat scary - how do you envision this to break?

[johanot]

see also @andrew-d 's comment here: NixOS/nixpkgs#78107 (comment)

[flokli]

That's right - didn't think about smartcards and such.

Another idea - can we

A) set ControlMasterand friends (to reuse a master connection when invoking ssh commands)
B) open a ssh connection once and copy over all secrets inside the same connection?