12 files changed, 132 insertions, 28 deletions

diff --git a/flake.nix b/flake.nix
index 3d22c57..4a8b76f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -75,7 +75,7 @@
 
         specialArgs = inputs // (packageSetsForSystem machine.system) // {
           me = machine;
-          security = import ./security.nix;
+          keys = import ./secrets/keys.nix;
           util = import ./util.nix { inherit lib; };
         };
 
diff --git a/machines/lapin/default.nix b/machines/lapin/default.nix
index 69960c3..3178a1d 100644
--- a/machines/lapin/default.nix
+++ b/machines/lapin/default.nix
@@ -1,4 +1,4 @@
-{ me, pkgs, lib, ... }:
+{ me, config, ... }:
 
 {
   imports = [
@@ -14,14 +14,17 @@
     ../../services/akkoma
   ];
 
+  age.secrets.cloudflare-dns = {
+    file = ../../secrets/cloudflare-dns.age;
+  };
+
   security.acme.certs."pds.rnrd.eu" = {
     group = "nginx";
     domain = "*.pds.rnrd.eu";
     extraDomainNames = [ "pds.rnrd.eu" ];
     dnsProvider = "cloudflare";
     credentialFiles = {
-      # TODO: use age
-      CLOUDFLARE_DNS_API_TOKEN_FILE = "/home/mel/cloudflare-dns-token.pw";
+      CLOUDFLARE_DNS_API_TOKEN_FILE = config.age.secrets.cloudflare-dns.path;
     };
   };
 
diff --git a/modules/ddns.nix b/modules/ddns.nix
index c9d2abd..8ee9afd 100644
--- a/modules/ddns.nix
+++ b/modules/ddns.nix
@@ -1,9 +1,13 @@
-{ me, ... }:
+{ me, config, ... }:
 
 let
   domain = "rnrd.eu";
 in
 {
+  age.secrets.cloudflare-dns = {
+    file = ../secrets/cloudflare-dns.age;
+  };
+
   services.ddclient = {
     enable = true;
 
@@ -20,7 +24,6 @@ in
     username = "token";
     zone = domain;
     domains = [ "${me.name}.${domain}" ];
-    # TODO: use age
-    passwordFile = "/home/mel/cloudflare-dns-token.pw";
+    passwordFile = config.age.secrets.cloudflare-dns.path;
   };
 }
diff --git a/modules/git.nix b/modules/git.nix
index 1d592f0..f7a26c4 100644
--- a/modules/git.nix
+++ b/modules/git.nix
@@ -1,4 +1,4 @@
-{ me, security, pkgs, ... }:
+{ me, keys, pkgs, ... }:
 
 {
   users.users.git = {
@@ -8,7 +8,7 @@
     home = "/srv/git";
     group = "git";
 
-    openssh.authorizedKeys.keys = security.keys;
+    openssh.authorizedKeys.keys = keys.allUsers;
   };
   users.groups.git = {};
 }
diff --git a/modules/user.nix b/modules/user.nix
index 2f49569..4ea0be2 100644
--- a/modules/user.nix
+++ b/modules/user.nix
@@ -1,6 +1,10 @@
-{ config, pkgs, security, ... }:
+{ config, pkgs, keys, ... }:
 
 {
+  age.secrets.password = {
+    file = ../secrets/password.age;
+  };
+
   users.mutableUsers = false;
   users.users.mel = {
     isNormalUser = true;
@@ -8,8 +12,8 @@
     shell = pkgs.fish;
     extraGroups = [ "networkmanager" "wheel" "docker" ];
 
-    hashedPassword = security.password;
-    openssh.authorizedKeys.keys = security.keys;
+    hashedPasswordFile = config.age.secrets.password.path;
+    openssh.authorizedKeys.keys = keys.allUsers;
 
     packages = (with pkgs; []);
   };
diff --git a/secrets/cloudflare-dns.age b/secrets/cloudflare-dns.age
new file mode 100644
index 0000000..bd546a6
--- /dev/null
+++ b/secrets/cloudflare-dns.age
Binary files differdiff --git a/secrets/keys.nix b/secrets/keys.nix
new file mode 100644
index 0000000..6f6aa8e
--- /dev/null
+++ b/secrets/keys.nix
@@ -0,0 +1,59 @@
+let
+  machines = {
+    renard = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINs2TTjnQvDNr/S3lPLWYOnZi00YIMrRUDH8cpBz1k1m";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/qDL7+86+0H6NkPs/w4GYiWQwT/4YAx9O2J7sLkKmf";
+    };
+
+    lapin = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIzDyaafULcgTuFca51NNgYAzZ28RFDQwVWavRpnY5c+";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGMD/EN9v8YgHOu4YG74Q+xvwjCdxbMIZjnQcUXi0QhZ";
+    };
+
+    corsac = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDlqytVSNMFAfbB+rdiNktv3WYViVBMeK7zUO2Pjfii+";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxghVX0Oq+eHklg/e7s/qhC8CK8PLUgvpLk2G53xEjK";
+    };
+  };
+
+  desktops = {
+    bismuth = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEK96G1n31aJsZOrux3BKM0ztzi/SFAVHn0MsGkPDdqY";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEP1Q8/07PD5AXghM7cd9Uf54YY8rkuBHfllr1Kzxh10";
+    };
+
+    graphite = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEDujTul5wWyGnidLnNuJDRze0Up29l2cDpyKdmvW2Ls";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHd+EvfxJC1rZbeI6hUq5tPpy8b3Xio02orgMBLwPU2l";
+    };
+
+    # this one is just a phone :3
+    anise = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMkdZb6fmfj8fHQUCigTz1x503nRqyokhxYC4RrgA3dZ";
+      system = "";
+    };
+  };
+
+  keysOfType = type: from: with builtins; catAttrs type (attrValues from);
+
+  machinesWithKey = type: from: builtins.mapAttrs (m: k: k.${type}) from;
+in
+rec {
+  inherit machines;
+
+  # keys of admin accounts on network machines
+  allAdmins = keysOfType "user" machines;
+  # keys of user accounts on desktop machines
+  allDesktopUsers = keysOfType "user" desktops;
+  # keys of all users, both on desktop and server
+  allUsers = allAdmins ++ allDesktopUsers;
+  # system host keys of all network machines
+  allSystems = keysOfType "system" machines;
+  # all keys, whether system or user
+  all = allUsers ++ allSystems;
+
+  # user keys per machine
+  user = machinesWithKey "user" (machines // desktops);
+  # system keys per machine
+  system = machinesWithKey "system" (machines // desktops);
+}
diff --git a/secrets/password.age b/secrets/password.age
new file mode 100644
index 0000000..44f33a2
--- /dev/null
+++ b/secrets/password.age
@@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-ed25519 QWV68w T9rDQNnBbiX8mXTTGOArxEBgce3FhHnwGYH2kBywMxc
+kVhycw6ZriC7XtiBbW9uPH58aD2sZkEKcVtqnn5Mqwg
+-> ssh-ed25519 oQ052g XPWeWjk8h4BkVS3A6JdcjilnswwxIjAM674CbLV08hk
+MOWWyep176qbrw+bRR19uNOHYx0uXT4fccAZ95Nb2mg
+-> ssh-ed25519 p1ieXg ffpjZePsGGBvGR6z1GjdZEnM+tyUtLN3Xi5d9r+snG0
+AdeTzYwITMjyRPF9VQxLMXCqs585pV/p32nvK+mxgQo
+-> ssh-ed25519 ztr2Fw JLp7IJqyMchZ/VPO7caHAfbIQ/ImZ9LU2wNc3qQF6T8
+yQzb19n/fgMj270IBWYRSsx/q6EvZQdAZrSJZVFosGs
+-> ssh-ed25519 COVM9Q C4nrd6ntpgqopm1dl6RMHmA3xp02OPlMoOS7/qipM1A
+nLDehTRyknfsdNlNZuPx+rKmmmhFALHBtUjh9iDR3z4
+-> ssh-ed25519 aV3pTQ 2tI02eszGD0uaSypQ989j2rh9JeEavCcjPxwnyCku1M
+q26P5e2h9E7zVWTjDRQnZ1gBjoLprkJowLaqCb13kIA
+--- o/bftSdUluJK4uFCh0CgV0LGBrheSuh2aSSlIAR19SQ
+kGq��.2S\�����p�@X�Ef��,�@1�sFQ+���%,��rCщց�R'L��oPG�=R����mdJ�[�a��~����u��uo
���*��������9
\ No newline at end of file
diff --git a/secrets/pds-secrets.age b/secrets/pds-secrets.age
new file mode 100644
index 0000000..764bec6
--- /dev/null
+++ b/secrets/pds-secrets.age
@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 oQ052g gUuIbqRYV2IkWZT33qhiaqDOuhZIu5EMikWOI88s6kg
+jKeHgm3zRMTE7A1FfPO/BFjufbpAVFVNL1bW6Q0kyc4
+-> ssh-ed25519 ztr2Fw TBmwrM6geKnJxq1Kn8oQj9K6enaXLxtcO2IIfSZzpB0
+YiRl/RyPoPNlvxTJCG9p0DU9/1jAmmsW3sredGb9KaM
+-> ssh-ed25519 COVM9Q xjnVsFeN9FvMdgfgXUbwFSB9fHIgg+nSZrK5OtrVGVI
+k54JOwV91KvdoiyRhiV8TRcFdx517LFKi7hCOkV0b64
+-> ssh-ed25519 aV3pTQ cgtpeDpRR2tWoym2aFElBSk4x5xeySWR8jdJDME4aTU
+z6LG5YboZ+2I6SHrwxbtIFa1dn88W/1kL86md9wwIQY
+--- Bk116iREjvqiGZ4PRrkdx6mJl81rHxzhIrog8AcHmM8
+ћ�te����M�!�%WqJ8�M���q텎h�H8�EZR����!��j��@\�@M�o����Q�*�)y�~��q���.sM>�J�N�}�gҜf�+(4��
�̍������U:�q��x�Q�+ZP�AP�pw\�k�`>������5ʞ�-?�3P橸�I��|.��C�W0���<P�.ۻK��
+o��j^��vw�47�~����ڴk�AE��B�(E�W���a�

\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
new file mode 100644
index 0000000..22c7a91
--- /dev/null
+++ b/secrets/secrets.nix
@@ -0,0 +1,18 @@
+let
+  keys = import ./keys.nix;
+
+  inherit (keys) allAdmins allSystems;
+  inherit (keys.system) renard lapin corsac;
+in
+{
+  "cloudflare-dns.age".publicKeys = [
+    lapin
+    corsac
+  ] ++ allAdmins;
+
+  "pds-secrets.age".publicKeys = [
+    lapin
+  ] ++ allAdmins;
+
+  "password.age".publicKeys = allSystems ++ allAdmins;
+}
diff --git a/security.nix b/security.nix
deleted file mode 100644
index 5876ebc..0000000
--- a/security.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEK96G1n31aJsZOrux3BKM0ztzi/SFAVHn0MsGkPDdqY mel@bismuth"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEDujTul5wWyGnidLnNuJDRze0Up29l2cDpyKdmvW2Ls mel@grimoire"
-
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINs2TTjnQvDNr/S3lPLWYOnZi00YIMrRUDH8cpBz1k1m mel@renard"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIzDyaafULcgTuFca51NNgYAzZ28RFDQwVWavRpnY5c+ mel@lapin"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDlqytVSNMFAfbB+rdiNktv3WYViVBMeK7zUO2Pjfii+ mel@corsac"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMkdZb6fmfj8fHQUCigTz1x503nRqyokhxYC4RrgA3dZ mel@anise"
-  ];
-
-  password = "$y$j9T$4wGl.YJizIpcfFv0LyvLU0$7LLEkjIFWBOV.XXynReCOczBYNX0EZfMPIDB/bmmhhC";
-}
diff --git a/services/pds.nix b/services/pds.nix
index 55dc157..45be843 100644
--- a/services/pds.nix
+++ b/services/pds.nix
@@ -1,4 +1,4 @@
-{ pkgs, auxiliaryPkgs, ... }:
+{ config, pkgs, auxiliaryPkgs, ... }:
 
 let
   inherit (pkgs) dockerTools glibc;
@@ -25,6 +25,10 @@ let
 
 in
 {
+  age.secrets.pds-secrets = {
+    file = ../secrets/pds-secrets.age;
+  };
+
   foundation.services.pds = {
     image = { imageFile = pdsImage; image = "pds:${pds.version}"; };
     ports = [ [ pdsLocalPort 3000 ] ];
@@ -51,8 +55,7 @@ in
       LOG_ENABLED = "true";
     };
 
-    # TODO: use age
-    environmentFiles = [ /srv/pds/secret.env ];
+    environmentFiles = [ config.age.secrets.pds-secrets.path ];
 
     workdir = "/pds";
     entrypoint = "${pds}/bin/pds";