chore: add new machine secrets (#74) · tghanken.tngl.sh/nixos-config@11f0b2e

+1 -4

nix/modules/nixos/bootstrap.nix

··· 21 21 22 22 # SSH server used for bootstrapping 23 23 services.openssh.enable = true; 24 - users.users.root.openssh.authorizedKeys.keys = [ 25 - # change this to your ssh key 26 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICh921bOnrGEySjw/eRrUAj1UbV2sf1YIcm5X74r6gTh" 27 - ]; 24 + users.users.root.openssh.authorizedKeys.keys = (import ../secrets/keys.nix).tghanken; 28 25 29 26 nix.settings = { 30 27 # Reasonable defaults

+24

nix/modules/secrets/keys.nix

··· 1 + rec { 2 + # Add user keys from ~/.ssh for desktop machines 3 + inwin-tower-tghanken = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICh921bOnrGEySjw/eRrUAj1UbV2sf1YIcm5X74r6gTh"; 4 + nixos-thinkpad-tghanken = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHrxGPx3dgap4sUwWyHbQsMJiv9tSNG05BEMNkNLDZF"; 5 + pegasus-tghanken = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEfBG0uOaa7KtZIGl20khDyj1VrUuAzoJUEN7nfkscBa"; 6 + tghanken = [inwin-tower-tghanken nixos-thinkpad-tghanken pegasus-tghanken]; 7 + 8 + users = tghanken; 9 + 10 + # Add machine keys from /etc/ssh 11 + inwin-tower = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/iE8w8saXDau1F/BQ5IktJPQO3MhRT1+1e5UsQt/n0"; 12 + nixos-thinkpad = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEiccufbIo8bYbn5n7PpR1IAFmup53P6nn8IyYfkJfd0"; 13 + pegasus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINfLX3asu3yZIEMlHtEb9byRapy65kGItWsipfyRHToO"; 14 + brontes = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALYW2t7dYik9EY2nAyA6Imj0r0RX25Cmah8rNbdMdKQ"; 15 + 16 + machines = [ 17 + inwin-tower 18 + nixos-thinkpad 19 + pegasus 20 + brontes 21 + ]; 22 + 23 + all = users ++ machines; 24 + }

+16 -19

nix/modules/secrets/secret_files/encrypted/github_pat.age

··· 1 1 age-encryption.org/v1 2 - -> ssh-ed25519 zFIqbQ Mq5/R2v/mEVQu+O1oQ/k1WnfbxmrnuYchmjslgoCsDE 3 - A+xAX2w6VMYUmBuaalSgg/cn1EOIswPsGCBIAfK5jxI 4 - -> ssh-ed25519 D+NVRg khz5nuUO+nUGdqrYxeOdr5dJ7jIPj9W7c16EUnQT+VQ 5 - bLdk6l27S0RRVtNyRasxkqN2i8bJfNSWRy724CgjOfQ 6 - -> ssh-ed25519 XDzCSw 8JLwbl+JYQM3gQAiAIPejwzNb05s2AMWiui8pi8Qe30 7 - q57BvVidXAGf8bURiVkyPL8d/1Y35ncCP1LtPD0SHpU 8 - -> ssh-ed25519 MfoPEA g+2LTgjfxrTgma7E5oWhEYPpYg8dOU8z9i9O89HxRkE 9 - 1lA/sSrG0oA3ynh/JyNJsYaaWpTGv/N3S+6m4qVe7Js 10 - -> ssh-ed25519 3QykPA dX69gvPQrIn6NZwCmhjnhnq20pbl5LsYgecXCsKJeTw 11 - CJtzAQdPP6VF9dC5XtGQXLD06lxNnzzqYbJpfVFRBp8 12 - -> ssh-ed25519 BadW0A Pz53NLnbyVRm0ygfShq943q8OyhR5F5vxohnlwis/ic 13 - aJe98Zgik+qR+rwMCCywjbtCn7Zvvu70S8/sebQ4j4Y 14 - -> ssh-ed25519 iUV+ow zAW4TbT1aZYbUc9NPZg9DQZ6EFqpWFW3CK4a2Xq+FlY 15 - foQtjJjG7VKu/4TXqlgWQ4/rLxXhXu1wUBB+5V1QV58 16 - -> ssh-ed25519 BZvRIg yaqcULm0Vpnkh6O7kfdGgCKQp68m7xZVYho+rL6l+GQ 17 - GOyedRtGFZFbuRLy6Dz/LBqNHXPqL+xMM3j74xSKEjg 18 - --- NAqFuRf+U8+HXWRbxylpWuT8JADYeYMOgkADCz1N6TI 19 - 0�x2��P`tc8B)��GS��K{/�S!� 20 - 3��.O��Ȉ�PY藘0��̏�G��$�4A�L� cC+��1˻��0�5�Lo��e�kY�ϸٶ\�b�yT��4Ώ�C߅]��4d 2 + -> ssh-ed25519 zFIqbQ 2dmkokrHjCFrkwMLZMTRy0iPvZpBhr5sJeDVV+2RA3Y 3 + QxTN8JqR4CRtcW0iJVavf25Eyd8jeKZ/zTvaqJple9o 4 + -> ssh-ed25519 D+NVRg QIjP1KtKYIxjx/Mt5i8hhngCAfRF9y8Y1B5ywg5/Hls 5 + kv1YxSgkMcs/2h7M6QEprDcTYrIvqtAOGPOYxgG+1eo 6 + -> ssh-ed25519 YDKZOA T9dnVbOJZh420HG1mCs2Yyki4zITw3Scnkn/0xg9RD0 7 + bwMjR3Cj57jTxWh68OtveUTVrv3qW5+OB0NpJiusVoY 8 + -> ssh-ed25519 XDzCSw aaA5kobp7uH8/MwHkxmGoks6s3ImpAiAAXMdedpNw0o 9 + wbGdH0JhFmZCpdkFmEDo6Zw4haml4z93hCwf5PeTU3o 10 + -> ssh-ed25519 MfoPEA MVfxkJxPyVesuCjAqIbza5fK+F1hS9Icgnq/1aTag1E 11 + ojpgQ18RdM5l4NeQjtGfbvNXz7++mj/cqeZgqwms/EE 12 + -> ssh-ed25519 8UaNUg VZFFL3xorsc1evkDVECIEQ3AfY9TlKXPGdpN8TFHhmc 13 + jqCU9HVh8Z4ITm9zJHepmv8zZfF+tBv3Iv2OjQVXlXo 14 + -> ssh-ed25519 purA5g SUMJvKC8YSRWTygVG0n6XGq0jUmtON31mJoVaf2xF2w 15 + IkT39Sg9QgfZIFmJSSs30OV2L04jRxLIG1hN46v97KE 16 + --- YRRv/IBExGX2kKm3vXsk7whOxtNnXQfqdDzJdCcMhyk 17 + �|i% P�)�~��Ŝ�(��_m��f6�X��*��a�&��^��_hi7�gj�lE��G��1�NOWV��0��!19�K�)��a0`I�k� ��i��B�0�O�=,V��E��

+16 -18

nix/modules/secrets/secret_files/encrypted/nix_store_signing_key.age

··· 1 1 age-encryption.org/v1 2 - -> ssh-ed25519 zFIqbQ CT5mR3RGGZwFUXfnZU05k9MAfl1fpO9K3RPLHepw4xU 3 - R81MlNr/9US7sSzb0X9Xhncnb7sEC1b7B5oASs0QYbw 4 - -> ssh-ed25519 D+NVRg EX+t4w7fLQCn3aDFEnI6UquMW24sFWXnHXWFBe2CPQ8 5 - H1SKuOmIc6D8f61jNEuhdXKK3W2LGVTR3hdz9R+hzaQ 6 - -> ssh-ed25519 XDzCSw W4IxKSvVSXVcjnp+ZvV3COrUYS/44770a4hRnDXxVUo 7 - At6m1k3PPMtPQJw7bRr/K+JLGny8bFtUfM8iz4hVuYc 8 - -> ssh-ed25519 MfoPEA 95QjpM8uJCw8CmkPW7gBPEF8mANI26iozHLGeAcYTGA 9 - Yn34JlqG35hD1wBedMm7FrozGbnF5RFsRtrJesUbOXU 10 - -> ssh-ed25519 3QykPA jU2UW8d3W97ah7eEIMk55tnpDcp58g4mqX1C+F9PYiw 11 - a49KTIX8peXVFHSqg4KOwcEUpqd46CDd0X/RBCihn6Y 12 - -> ssh-ed25519 BadW0A 0lWuxJ3ASXKDkJH1QXn7KVCx87XyNM33iI8dk8bjHW0 13 - wJXrlYqayGoiiSbdHeLLEjmeDiQFlgsLasJxoX+FrNI 14 - -> ssh-ed25519 iUV+ow WqpT1rKRKFFY0PVD4RxnIbFHN8eDhwH1paYMYHVXax8 15 - yV8KQ+We2/ZMlxHU1ZbqP3ptXA6U8kP6Hi56jplh4i4 16 - -> ssh-ed25519 BZvRIg ibOw9YQDjD7H8uoUMHzehqogsyymAyOXO0pNYVT0l3E 17 - dATVRRCXs7kzL34dtMBiivgTQjR/NIXMJGR4afDFuQ4 18 - --- dcm+laFRTRkyu00tORQWwdNw/tKvCNyxJyzwmvwE54w 19 - �t�v W��1#ͅB�$�Ao$��L^l|n.�@ ��7��( ��jc��?�� T�#��Ff�c�B��yR=��@Bi��?+yk��S'��j��4��#t�0��bf��f�� 2 + -> ssh-ed25519 zFIqbQ 3G/7Y/MdtTxS1Hg3Iswri3JPetJmFR6SyMBu5J9jDFM 3 + Q6/bleJrQzaPNEnDWdli95WXFqBzk5JniHGWdlbNeK4 4 + -> ssh-ed25519 D+NVRg Tj7zLyTqkm4VOmiUlhegrtzUpoU7uzqudzRLNmLRN3o 5 + Lt7LRM9LRBl9D2mFH7Y2ZCdYfYLASRyHxqB5InuNTeI 6 + -> ssh-ed25519 YDKZOA qdc17q423csYE/keg8LrcaQ8pj9MSxTvJGzik8p7RXE 7 + QS889xt1gaur0vqqm1oYDvtn4vWm1TLezjB2Wx+kL2k 8 + -> ssh-ed25519 XDzCSw 5VZesGcEnYyhi+t9RtwQNJhzq6X5oWSEpvpCHjhJoi0 9 + t+oaQEusv16qT+fiSCfZGRe8tva47k0hC9M3VEvJNk8 10 + -> ssh-ed25519 MfoPEA 8Ch8GHn73pRbUch5ynUrHVZ4AD/Po0ky3g4OrTMzFCI 11 + PTb9MnxhZhoQR3pqzILqntSDrodSf2awbgk8yiR8UUM 12 + -> ssh-ed25519 8UaNUg 87AFT1vXVXafPK8As4mIB/X6Unz5CN5tD7X+PMYYAEs 13 + bu4BKbFVgGo6MD3TYu2oibMQlZmR8j6gSs1YLvKtk1A 14 + -> ssh-ed25519 purA5g O0xb21mf2REFOxFpLdxwIL1Lxq9O/JyWFYvj8RKOw3Y 15 + OiL+w/bmvkf/KCZDwoh8+1yCTKlIG/de5cPkcROigUw 16 + --- 0W1GXD2f6bkegL+C6l0R6eLzVqSlabIn/gUgZS7fn8U 17 + �goSΎń��W��DP��0��?�{��d3��{EI��F:: o�hYc�r>0��d-�S�zsU�-v��Y�5_0d��hY�g��K�o��YG�k(�ݥ��mku��Y;�[]W�H

+16 -18

nix/modules/secrets/secret_files/encrypted/tailscale_key.age

··· 1 1 age-encryption.org/v1 2 - -> ssh-ed25519 zFIqbQ RdDMyrqbqiHN9RMoOVf4hQQ70vodynolJCWAN90a0TY 3 - mxfO9SfgV20nKH5zv9ra43mMdzVTMYZMLXL6Xy+pwW4 4 - -> ssh-ed25519 D+NVRg WGnLb9r58n6AZR87R5FysU8c3CaCsH/QtRfFBpBX2AU 5 - QP7Y1NgsfFDqnPrRJI3X6MtJN/ftC+ShhPn/wN4Mg7s 6 - -> ssh-ed25519 XDzCSw /Ya1/jtJJWJiBNpS5zS4Bx8hsGHj+7pL6ek/T9k23UY 7 - 0NOTbep+PUNSavjfkTrX6r3lp7K4IQUVMFnfYG7qLpc 8 - -> ssh-ed25519 MfoPEA 8dbswNv9GaEwj9WMugbLuBTBRiLyE2TMbNKEMOPZiFI 9 - VFVn3R7f9UyLwmUpBfOWaJCZALnZ5U7LB7tW2TvDX6Q 10 - -> ssh-ed25519 3QykPA gsrcDsCe6z8LD9eBKcDoMhmRNUIN6B+BTSNw+9ukszY 11 - LCl/zyBVZyaTtPbuMouU1XtFLZ07+aBErXK5c7Cpu7Q 12 - -> ssh-ed25519 BadW0A /clOVhBFueuN4Frc/vhVLCzJhK9sT/FL2+AakuhAXAU 13 - lH/jIUmycLnybRqK2dLqWNsGTXUV0FYAyTFVrIxpDL8 14 - -> ssh-ed25519 iUV+ow OFIUUrmlgCCM7nJUV7ANWQVC7OjLvY4+ydkI83RlnTk 15 - nQYUrLI/GpngvBBcBxBolVIJ5eBL07v+HNJ30IyHM18 16 - -> ssh-ed25519 BZvRIg fE2uihxMl6TXrN7TG/sYn4AvtM71q4YdFBM7OoUXix4 17 - LPRRUsD8/NhSBNY67cZ53usmcVHPv9Zz9ei5l2+D2wg 18 - --- i+AcBZjt40JEDU1ygfHLSi+bermwCpLBebr1KZyGjN4 19 - ��z ;a��)�˺��\��*��AE��4Skv~"?��26P��6� C<�Зة�C��݅_硺&¨@�T��6ǔ�U' 2 + -> ssh-ed25519 zFIqbQ vv35C+LXFL14GGh6mAYp1DdR93kJJItMOKnoVCnyMis 3 + alZFfnCGxcj36yLcg9Jg/o3+ulJOnrjdwVeqGolgQag 4 + -> ssh-ed25519 D+NVRg i3EHx1hUlMgCdBpMLHWRLIHTsOW1QRbhpDerzqzkflY 5 + lcjC/odYUc0mxfKfp8vt0c0DaKEfoQ2w9m833eLGbYQ 6 + -> ssh-ed25519 YDKZOA T67Kw2itPBw8vxv22QW9aQryMTdZmbwHMz2uY6Fr7DY 7 + UJ0vO70NMH8QwQhKD37Z/YBhImJg6e3lO8ezOt/QM/I 8 + -> ssh-ed25519 XDzCSw ZH3U9+qQHQTYul7q/lJmLAxrjDkruP1kvdsxMngDcVE 9 + xI1z/OOY5OX5zU/ShKSdsCRBteRRaTTu778ouoMO71k 10 + -> ssh-ed25519 MfoPEA 1LRGEsRlTxT4a4OAPwA3RaQgWU0wuTAtJb3XgVVfOSc 11 + NBdojKR/EIUQposDgTWXEA5KF5vqIL065t6i++7yjaI 12 + -> ssh-ed25519 8UaNUg IEzv/PySaKxPAGD90p7zPqQoKV1F03HfLVAJhZ2a0TM 13 + cCjvC1MGDCYxmsfmA8O+QVyxITJ1OqD859MQnShqAJY 14 + -> ssh-ed25519 purA5g ZPb6h0YG/jV/HiDPxScoUIx31iUJZfiIg1u1qY2WenA 15 + UijeHPOC20/352TAw0GW4vSArbBCrQPq//sW5F3/V9s 16 + --- KsAk+QUONmwtabZB3W6b2nh2MmIlY+eC+vk7HnUHHrY 17 + K%PvA�w|o��kUg��;��fr��Lҕ٬��q�-Pt�0f��|��A��R3|�(+é�:%e�YPf��t�D͠D��

+4 -28

nix/modules/secrets/secret_files/secrets.nix

··· 1 1 let 2 - # Add user keys from ~/.ssh for desktop machines 3 - inwin-tower-tghanken = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICh921bOnrGEySjw/eRrUAj1UbV2sf1YIcm5X74r6gTh"; 4 - nixos-thinkpad-tghanken = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHrxGPx3dgap4sUwWyHbQsMJiv9tSNG05BEMNkNLDZF"; 5 - tghanken = [inwin-tower-tghanken nixos-thinkpad-tghanken]; 6 - 7 - users = tghanken; 8 - 9 - # Add machine keys from /etc/ssh 10 - inwin-tower = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/iE8w8saXDau1F/BQ5IktJPQO3MhRT1+1e5UsQt/n0"; 11 - nixos-thinkpad = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEiccufbIo8bYbn5n7PpR1IAFmup53P6nn8IyYfkJfd0"; 12 - nixos-rpi4-1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPjmoWsrAlSj2dkeURNNjkgPRPrsG5rOqUHwcbttTwh"; 13 - nixos-rpi4-2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVqOLrhRi10BltaYhW9xPZaSUcNLMVJhRmqVKsK5rKU"; 14 - nixos-rpi4-3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIaE/D86AJWKvIswvuNmqy7LK4pZSWo4VGwbhYjR7OLg"; 15 - syno-vm = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILny1+6sCjDBG/yyNFQgMeZT4tT+10H7uSXftEUk2407"; 16 - 17 - machines = [ 18 - inwin-tower 19 - nixos-thinkpad 20 - nixos-rpi4-1 21 - nixos-rpi4-2 22 - nixos-rpi4-3 23 - syno-vm 24 - ]; 25 - 26 - all = users ++ machines; 2 + keys = import ../keys.nix; 27 3 in { 28 - "keys/nix_store_signing_key.age".publicKeys = all; 29 - "keys/github_pat.age".publicKeys = all; 30 - "keys/tailscale_key.age".publicKeys = all; 4 + "encrypted/nix_store_signing_key.age".publicKeys = keys.all; 5 + "encrypted/github_pat.age".publicKeys = keys.all; 6 + "encrypted/tailscale_key.age".publicKeys = keys.all; 31 7 }

Configure Feed

Configure Feed