[bin] Add hrvpn script

bin/.bin/hrvpn

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+case "$1" in
+  start) openvpn3 session-start --config ~/var/inbox/hungryroot.ovpn ;;
+  stop)  openvpn3 session-manage --config ~/var/inbox/hungryroot.ovpn --disconnect ;;
+  status) openvpn3 sessions-list ;;
+esac
+

bin/.bin/rekey

@@ -8,6 +8,11 @@ SSH_DIR="$HOME/.ssh"
 mkdir -p "$SSH_DIR"
 PASS_PATH="personal/ssh/$USER@$HOST/$DATE"
 
+DOTFILES_DIR="$HOME/.dotfiles"
+DOT_SSH_DIR="$DOTFILES_DIR/.ssh"
+PASS_STORE_DIR="$DOTFILES_DIR/.password-store"
+COMMIT_MSG="[ssh] Rekey host $HOST"
+
 # --- Temporary directory for private key (macOS compatible) ---
 # Tries /dev/shm if present (Linux), otherwise falls back to standard temp.
 if [[ -d /dev/shm && -w /dev/shm ]]; then
@@ -39,3 +44,31 @@ chmod 600 "$SSH_DIR/$USER@$HOST.pub" 2>/dev/null || true
 echo "Public key written to $SSH_DIR/$USER@$HOST.pub"
 
 # Temp key removed automatically by trap
+mkdir -p "$DOT_SSH_DIR"
+cp "$PUB_KEY_PATH" "$DOT_SSH_DIR/"
+echo "Public key copied to dotfiles: $DOT_SSH_DIR"
+
+# ------------------------------------------------------------------
+# Git commit dotfiles changes (ssh + password-store)
+# ------------------------------------------------------------------
+
+DOTFILES_DIR="$HOME/.dotfiles"
+COMMIT_MSG="[ssh] Rekey host $HOST"
+
+if [[ -d "$DOTFILES_DIR/.git" ]]; then
+  pushd "$DOTFILES_DIR" >/dev/null
+
+  # Stage only relevant dirs
+  git add .ssh .password-store 2>/dev/null || true
+
+  if ! git diff --cached --quiet; then
+    git commit -m "$COMMIT_MSG"
+    echo "Dotfiles committed: $COMMIT_MSG"
+  else
+    echo "No dotfiles changes to commit"
+  fi
+
+  popd >/dev/null
+else
+  echo "Dotfiles repo not found at $DOTFILES_DIR — skipping commit"
+fi