treewide: Align the rest of the files with the server repository

2 files changed, 106 insertions, 21 deletions

diff --git a/secrets.nix b/secrets.nix
index 443ed562..2e68bdba 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -1,27 +1,85 @@
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 let
   soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn";
+  jaki = "age1vuhaey7kd9l76y6f9weeqmde3s4kjw38869ju6u3027yece2r3rqssjxst";
 
-  tiamat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
-  apzu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";
-in {
-  "modules/by-name/at/atuin/secrets/encryption_key.age".publicKeys = [soispha tiamat apzu];
-  "modules/by-name/at/atuin/secrets/user_id.age".publicKeys = [soispha tiamat apzu];
+  tiamatHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
+  apzuHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";
 
-  "modules/by-name/ta/taskwarrior/secrets/sync_server_encryption_key.age".publicKeys = [soispha tiamat apzu];
+  server2HostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL1TUFoCTplkqTVbXQ6qDCyeo2h8+C0vjrIlKu6vmq5f";
+  server3HostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP3s4FjGx7LEVf/GE3WeCl8TmCtPt8gW1J0mp0fUJBNm";
 
-  "modules/by-name/ba/backup/secrets/storagebox/ssh_key.age".publicKeys = [soispha tiamat apzu];
-  "modules/by-name/ba/backup/secrets/storagebox/repository_password.age".publicKeys = [soispha tiamat apzu];
-  "modules/by-name/ba/backup/secrets/local/repository_password.age".publicKeys = [soispha tiamat apzu];
+  # WARNING(@bpeetz): ONLY use this key on age files that are meant to be public! <2025-02-23>
+  testingKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxdvBk/PC9fC7B5vqe9TvygZKY6LgDQ2mXRdVrthBM/";
 
-  "modules/by-name/se/serverphone/private_keys/ca.key".publicKeys = [soispha tiamat apzu];
-  "modules/by-name/se/serverphone/private_keys/server.key".publicKeys = [soispha tiamat apzu];
-}
+  publicKeys = {
+    "tiamat" = [
+      soispha
+      tiamatHostKey
+    ];
+    "apzu" = [
+      soispha
+      apzuHostKey
+    ];
+
+    "server2" = [
+      soispha
+      jaki
+      server2HostKey
+    ];
+    "server3" = [
+      soispha
+      jaki
+      server3HostKey
+    ];
+  };
+
+  sources = import ./unflake.nix;
+  extra_lib = sources.library.nixLib;
+  pkgs-unstable = sources.nixpkgs-unstable.legacyPackages."x86_64-linux";
+  inherit (pkgs-unstable) lib;
+
+  secrets = let
+    base = extra_lib.mkByName {
+      useShards = false;
+      fileName = "secrets";
+      baseDirectory = ./hosts/by-name;
+    };
+    secrets = builtins.mapAttrs (name: value:
+      extra_lib.mkByName {
+        relativePaths = true;
+        useShards = false;
+        fileRegex = "^.*\\.age$";
+        baseDirectory = value;
+      })
+    base;
+    allSecretPaths = builtins.mapAttrs (serverName: secrets:
+      lib.lists.flatten (
+        lib.attrsets.mapAttrsToList
+        (service: fileNames: builtins.map (fileName: "./hosts/by-name/${serverName}/secrets/${service}/${fileName}") fileNames)
+        secrets
+      ))
+    secrets;
+  in
+    # We should be able to merge with the `//` operator here because all attribute paths
+    # must be unique (they were files previously)
+    builtins.foldl' (acc: elem: acc // elem) {} (
+      builtins.attrValues (builtins.mapAttrs (serverName: secretPaths:
+        builtins.listToAttrs (
+          builtins.map
+          (secretPath: {
+            name = secretPath;
+            value.publicKeys = publicKeys."${serverName}";
+          })
+          secretPaths
+        ))
+      allSecretPaths)
+    );
+in
+  secrets
+  // {
+    "tests/common/email/dkim/alice.com/private.age".publicKeys = [soispha jaki testingKey];
+    "tests/common/email/dkim/bob.com/private.age".publicKeys = [soispha jaki testingKey];
+    "tests/common/email/dkim/mail1.server.com/private.age".publicKeys = [soispha jaki testingKey];
+    "tests/common/email/dkim/mail2.server.com/private.age".publicKeys = [soispha jaki testingKey];
+    "./tests/by-name/ro/rocie/secrets/login.age".publicKeys = [soispha jaki testingKey];
+  }
diff --git a/secrets.nix.old b/secrets.nix.old
new file mode 100644
index 00000000..443ed562
--- /dev/null
+++ b/secrets.nix.old
@@ -0,0 +1,27 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+let
+  soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn";
+
+  tiamat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
+  apzu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";
+in {
+  "modules/by-name/at/atuin/secrets/encryption_key.age".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/at/atuin/secrets/user_id.age".publicKeys = [soispha tiamat apzu];
+
+  "modules/by-name/ta/taskwarrior/secrets/sync_server_encryption_key.age".publicKeys = [soispha tiamat apzu];
+
+  "modules/by-name/ba/backup/secrets/storagebox/ssh_key.age".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/ba/backup/secrets/storagebox/repository_password.age".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/ba/backup/secrets/local/repository_password.age".publicKeys = [soispha tiamat apzu];
+
+  "modules/by-name/se/serverphone/private_keys/ca.key".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/se/serverphone/private_keys/server.key".publicKeys = [soispha tiamat apzu];
+}