Logivations Pixel Robotics

Superkey

SSH access for the fleet

Sign in with Google Documentation
Superkey
Logivations Pixel Robotics
Admin Sign out

Your SSH key

One key, uploaded once. Superkey installs it on every device you can reach and removes it everywhere the moment your access changes.

Replace this key
Finding or making a key

Your public key is usually at ~/.ssh/id_ed25519.pub. Print it with:

cat ~/.ssh/id_ed25519.pub                                  # Linux, macOS
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub           # Windows PowerShell

No key yet? Generate one on the machine you'll connect from, accept the default location, and optionally set a passphrase.

ssh-keygen -t ed25519 -C "you@lvairo.com"
Upload only the public half — the file ending in .pub. The private key never leaves your machine.
Loading…

No devices yet. Access comes from your Google Workspace groups — ask an admin to attach a label your group can reach.

What your key opens
Devices
—
Sites
—
Your groups

My agents

A personal agent (your nemo, for instance) runs as you. It gets its own key and logs in as a dedicated unprivileged account, <you>_<agent> (shortened to Linux's 32-char limit if needed — the exact name is in the Logs in as column), on the devices you can already reach — all of them, or only those carrying labels you pick under Access, where you can also give it root access. It can never have more access than you do, and you can revoke it at any time. Shared agents live in the Team agents tab.

AgentLogs in asKeySource restrictionReaches

Add or rotate an agent key

Submitting an existing name rotates that agent's key.

Generate the keypair on the machine that runs the agent:

ssh-keygen -t ed25519 -f ~/.ssh/id_nemo -C "nemo agent"
cat ~/.ssh/id_nemo.pub
Keep the private key on the agent host. Never reuse your own key for an agent, and set a source restriction so a leaked key is useless from anywhere else.

Team agents

Shared nemo agents. They register themselves with no access; you grant it by attaching labels, and the agent then reaches every device carrying one, as agent_<name>. You can attach the labels you hold yourself; admins can attach any. Changes take effect on the next deploy.

AgentLogs in asKeyLabels
can reach
Hostnames repo— Last deploy— Deploy runner—
Loading… Can reach Cannot

Nothing matches that filter.

Access summary
—
—
Devices reachable
—
Sites
—
Of the fleet
—
Granted by
Pick a device to see everyone who can reach it, and how.

Labels

A label ties devices to groups. Devices carry labels; groups are granted labels; people reach a device when one of their groups holds one of its labels.

LabelDevicesGroups with access

Groups

Membership is synced from Google Workspace and can't be edited here.

GroupGoogle groupMembersLabels held

Users

NameEmailKeyGroups

Device labels

Add label

Label access

Agent access

Your agent never reaches more than you do. Limit it further to the devices carrying one of the labels below — you can pick the labels of devices you reach yourself.

Effectively root on the devices it reaches, like a team agent: joins the docker group and may run commands as the deploy user (sudo -u logi, e.g. for ~logi/deploy). Leave off unless the agent needs it.

Agent labels

The agent reaches every device carrying one of these labels. You can attach the labels you have access to yourself.