Move secrets and keys into agenix

Signed-off-by: Mel <einebeere@gmail.com>

5 files changed, 104 insertions, 0 deletions

diff --git a/secrets/cloudflare-dns.age b/secrets/cloudflare-dns.age
new file mode 100644
index 0000000..bd546a6
--- /dev/null
+++ b/secrets/cloudflare-dns.age
Binary files differdiff --git a/secrets/keys.nix b/secrets/keys.nix
new file mode 100644
index 0000000..6f6aa8e
--- /dev/null
+++ b/secrets/keys.nix
@@ -0,0 +1,59 @@
+let
+  machines = {
+    renard = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINs2TTjnQvDNr/S3lPLWYOnZi00YIMrRUDH8cpBz1k1m";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/qDL7+86+0H6NkPs/w4GYiWQwT/4YAx9O2J7sLkKmf";
+    };
+
+    lapin = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIzDyaafULcgTuFca51NNgYAzZ28RFDQwVWavRpnY5c+";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGMD/EN9v8YgHOu4YG74Q+xvwjCdxbMIZjnQcUXi0QhZ";
+    };
+
+    corsac = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDlqytVSNMFAfbB+rdiNktv3WYViVBMeK7zUO2Pjfii+";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxghVX0Oq+eHklg/e7s/qhC8CK8PLUgvpLk2G53xEjK";
+    };
+  };
+
+  desktops = {
+    bismuth = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEK96G1n31aJsZOrux3BKM0ztzi/SFAVHn0MsGkPDdqY";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEP1Q8/07PD5AXghM7cd9Uf54YY8rkuBHfllr1Kzxh10";
+    };
+
+    graphite = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEDujTul5wWyGnidLnNuJDRze0Up29l2cDpyKdmvW2Ls";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHd+EvfxJC1rZbeI6hUq5tPpy8b3Xio02orgMBLwPU2l";
+    };
+
+    # this one is just a phone :3
+    anise = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMkdZb6fmfj8fHQUCigTz1x503nRqyokhxYC4RrgA3dZ";
+      system = "";
+    };
+  };
+
+  keysOfType = type: from: with builtins; catAttrs type (attrValues from);
+
+  machinesWithKey = type: from: builtins.mapAttrs (m: k: k.${type}) from;
+in
+rec {
+  inherit machines;
+
+  # keys of admin accounts on network machines
+  allAdmins = keysOfType "user" machines;
+  # keys of user accounts on desktop machines
+  allDesktopUsers = keysOfType "user" desktops;
+  # keys of all users, both on desktop and server
+  allUsers = allAdmins ++ allDesktopUsers;
+  # system host keys of all network machines
+  allSystems = keysOfType "system" machines;
+  # all keys, whether system or user
+  all = allUsers ++ allSystems;
+
+  # user keys per machine
+  user = machinesWithKey "user" (machines // desktops);
+  # system keys per machine
+  system = machinesWithKey "system" (machines // desktops);
+}
diff --git a/secrets/password.age b/secrets/password.age
new file mode 100644
index 0000000..44f33a2
--- /dev/null
+++ b/secrets/password.age
@@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-ed25519 QWV68w T9rDQNnBbiX8mXTTGOArxEBgce3FhHnwGYH2kBywMxc
+kVhycw6ZriC7XtiBbW9uPH58aD2sZkEKcVtqnn5Mqwg
+-> ssh-ed25519 oQ052g XPWeWjk8h4BkVS3A6JdcjilnswwxIjAM674CbLV08hk
+MOWWyep176qbrw+bRR19uNOHYx0uXT4fccAZ95Nb2mg
+-> ssh-ed25519 p1ieXg ffpjZePsGGBvGR6z1GjdZEnM+tyUtLN3Xi5d9r+snG0
+AdeTzYwITMjyRPF9VQxLMXCqs585pV/p32nvK+mxgQo
+-> ssh-ed25519 ztr2Fw JLp7IJqyMchZ/VPO7caHAfbIQ/ImZ9LU2wNc3qQF6T8
+yQzb19n/fgMj270IBWYRSsx/q6EvZQdAZrSJZVFosGs
+-> ssh-ed25519 COVM9Q C4nrd6ntpgqopm1dl6RMHmA3xp02OPlMoOS7/qipM1A
+nLDehTRyknfsdNlNZuPx+rKmmmhFALHBtUjh9iDR3z4
+-> ssh-ed25519 aV3pTQ 2tI02eszGD0uaSypQ989j2rh9JeEavCcjPxwnyCku1M
+q26P5e2h9E7zVWTjDRQnZ1gBjoLprkJowLaqCb13kIA
+--- o/bftSdUluJK4uFCh0CgV0LGBrheSuh2aSSlIAR19SQ
+kGq��.2S\�����p�@X�Ef��,�@1�sFQ+���%,��rCщց�R'L��oPG�=R����mdJ�[�a��~����u��uo
���*��������9
\ No newline at end of file
diff --git a/secrets/pds-secrets.age b/secrets/pds-secrets.age
new file mode 100644
index 0000000..764bec6
--- /dev/null
+++ b/secrets/pds-secrets.age
@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 oQ052g gUuIbqRYV2IkWZT33qhiaqDOuhZIu5EMikWOI88s6kg
+jKeHgm3zRMTE7A1FfPO/BFjufbpAVFVNL1bW6Q0kyc4
+-> ssh-ed25519 ztr2Fw TBmwrM6geKnJxq1Kn8oQj9K6enaXLxtcO2IIfSZzpB0
+YiRl/RyPoPNlvxTJCG9p0DU9/1jAmmsW3sredGb9KaM
+-> ssh-ed25519 COVM9Q xjnVsFeN9FvMdgfgXUbwFSB9fHIgg+nSZrK5OtrVGVI
+k54JOwV91KvdoiyRhiV8TRcFdx517LFKi7hCOkV0b64
+-> ssh-ed25519 aV3pTQ cgtpeDpRR2tWoym2aFElBSk4x5xeySWR8jdJDME4aTU
+z6LG5YboZ+2I6SHrwxbtIFa1dn88W/1kL86md9wwIQY
+--- Bk116iREjvqiGZ4PRrkdx6mJl81rHxzhIrog8AcHmM8
+ћ�te����M�!�%WqJ8�M���q텎h�H8�EZR����!��j��@\�@M�o����Q�*�)y�~��q���.sM>�J�N�}�gҜf�+(4��
�̍������U:�q��x�Q�+ZP�AP�pw\�k�`>������5ʞ�-?�3P橸�I��|.��C�W0���<P�.ۻK��
+o��j^��vw�47�~����ڴk�AE��B�(E�W���a�

\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
new file mode 100644
index 0000000..22c7a91
--- /dev/null
+++ b/secrets/secrets.nix
@@ -0,0 +1,18 @@
+let
+  keys = import ./keys.nix;
+
+  inherit (keys) allAdmins allSystems;
+  inherit (keys.system) renard lapin corsac;
+in
+{
+  "cloudflare-dns.age".publicKeys = [
+    lapin
+    corsac
+  ] ++ allAdmins;
+
+  "pds-secrets.age".publicKeys = [
+    lapin
+  ] ++ allAdmins;
+
+  "password.age".publicKeys = allSystems ++ allAdmins;
+}