diff options
| -rw-r--r-- | modules/foundation/agent.nix | 25 | ||||
| -rw-r--r-- | secrets/agent/environment.age (renamed from secrets/renard-agent.age) | bin | 1337 -> 1337 bytes | |||
| -rw-r--r-- | secrets/agent/private-key.age | bin | 0 -> 2249 bytes | |||
| -rw-r--r-- | secrets/secrets.nix | 4 |
4 files changed, 24 insertions, 5 deletions
diff --git a/modules/foundation/agent.nix b/modules/foundation/agent.nix index 6ac25aa..9a9d295 100644 --- a/modules/foundation/agent.nix +++ b/modules/foundation/agent.nix @@ -10,6 +10,8 @@ let inherit (lib) mkEnableOption mkIf mkMerge; cfg = config.foundation.agent; + agentPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAppvnIQdnwggxcsNtm7ij85qjABRHe2b4/NGwCfzTr5 agent"; + # the set of tools the agent has access to by default. # it should also always be able to call `nix-shell` to gain access to more tools. agentPackages = with pkgs; [ @@ -61,7 +63,8 @@ in }; config = mkMerge [ - # both the home and each neighbor have a user for the agent. + # both the home and each neighbor have a user for the agent, + # the identity of the user is the same on the entire fleet. (mkIf (cfg.home || cfg.neighbor) { users = { groups.renard = { }; @@ -73,14 +76,28 @@ in createHome = true; shell = pkgs.bashInteractive; packages = agentPackages; + + openssh.authorizedKeys.keys = [ agentPublicKey ]; }; }; + + systemd.tmpfiles.rules = [ + "d /home/renard/.ssh 0700 renard renard - -" + ]; + + age.secrets.renard-agent-private-key = { + file = ../../secrets/agent/private-key.age; + path = "/home/renard/.ssh/id_ed25519"; + owner = "renard"; + group = "renard"; + mode = "0600"; + }; }) # the agent lives at home. (mkIf cfg.home { - age.secrets.renard-agent = { - file = ../../secrets/renard-agent.age; + age.secrets.renard-agent-environment = { + file = ../../secrets/agent/environment.age; owner = "renard"; group = "renard"; mode = "0440"; @@ -104,7 +121,7 @@ in # * OPENROUTER_API_KEY # * DISCORD_BOT_TOKEN # * DISCORD_ALLOWED_USERS - config.age.secrets.renard-agent.path + config.age.secrets.renard-agent-environment.path ]; documents = { diff --git a/secrets/renard-agent.age b/secrets/agent/environment.age Binary files differindex 0409f71..0409f71 100644 --- a/secrets/renard-agent.age +++ b/secrets/agent/environment.age diff --git a/secrets/agent/private-key.age b/secrets/agent/private-key.age Binary files differnew file mode 100644 index 0000000..3fc501d --- /dev/null +++ b/secrets/agent/private-key.age diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 9b09574..24a4abb 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -27,10 +27,12 @@ in renard ] ++ allAdmins; - "renard-agent.age".publicKeys = [ + "agent/environment.age".publicKeys = [ renard ] ++ allAdmins; + "agent/private-key.age".publicKeys = allSystems ++ allAdmins; + "mullvad-gluetun.age".publicKeys = [ corsac ] ++ allAdmins; |