# Access — YellowMellow / M1 mini

## From SamBook (primary path)
```bash
ssh YellowMellow        # alias in ~/.ssh/config → yellowmellow@110.20.6.1, ProxyJump samcloud
```
Path: **SamBook → WireGuard → SamCloud (jump) → WG tunnel 10.8.0.x/24 → mini at 110.20.6.1**
- Remote shell is **zsh** — quote `echo` labels or zsh does `=` expansion.
- FileBrowser over tunnel: `http://110.20.6.1:8834/` (usable for transfers without visiting the store).

## From SamCloud
```bash
ssh yellowmellow@110.20.6.1   # tunnel is local on SamCloud, no jump needed
```

## Old iMac (still serving)
- Public: `https://immich.yellowmellowco.ca` — Immich web, 200 via Caddy/Cloudflare (verified 2026-10-19). Use for checking the library or pulling data if no LAN path.
- Direct SSH over her LAN: **not found from the mini** (ARP showed 192.168.2.120/.166, no open :22). Find its actual IP on site, or use the public URL / a direct cable.

## Security note — host key changed 2026-10-19 (expected, but record it)
- The machine at 110.20.6.1 presented a **new ED25519 key** on 2026-10-19.
- Verified by connecting read-only first: hostname `Macmini`, arm64 M1, macOS 27.0 — consistent with the new mini taking over the old iMac's tunnel IP.
- New fingerprint (pinned in SamBook + kept consistent): `SHA256:KzwDYByff1OE2pJhCAOriguphbXWApkG09Dc3ecAGbc`
- Old iMac key (kept in `.agent/yellowmellow-old-hostkey-20261019.txt`, also in `~/.ssh/known_hosts.bak-20261019`): `SHA256:8wV+RwhppOmKgkMD30G7AS5LK6sW1QaxDb8YTs4pwSs`
- If a *third* different key ever appears, stop and verify with Christy in person before trusting it.

## Tunnel flakiness (known)
- The WG tunnel to her network has been intermittent in the past. If `ssh YellowMellow` hangs, check `ifconfig | grep utun` locally and on SamCloud; retry rather than assuming the mini is down.