blob: 2e68bdba20d96f6a238c55e3568927e321166991 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
|
let
soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn";
jaki = "age1vuhaey7kd9l76y6f9weeqmde3s4kjw38869ju6u3027yece2r3rqssjxst";
tiamatHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
apzuHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";
server2HostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL1TUFoCTplkqTVbXQ6qDCyeo2h8+C0vjrIlKu6vmq5f";
server3HostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP3s4FjGx7LEVf/GE3WeCl8TmCtPt8gW1J0mp0fUJBNm";
# WARNING(@bpeetz): ONLY use this key on age files that are meant to be public! <2025-02-23>
testingKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxdvBk/PC9fC7B5vqe9TvygZKY6LgDQ2mXRdVrthBM/";
publicKeys = {
"tiamat" = [
soispha
tiamatHostKey
];
"apzu" = [
soispha
apzuHostKey
];
"server2" = [
soispha
jaki
server2HostKey
];
"server3" = [
soispha
jaki
server3HostKey
];
};
sources = import ./unflake.nix;
extra_lib = sources.library.nixLib;
pkgs-unstable = sources.nixpkgs-unstable.legacyPackages."x86_64-linux";
inherit (pkgs-unstable) lib;
secrets = let
base = extra_lib.mkByName {
useShards = false;
fileName = "secrets";
baseDirectory = ./hosts/by-name;
};
secrets = builtins.mapAttrs (name: value:
extra_lib.mkByName {
relativePaths = true;
useShards = false;
fileRegex = "^.*\\.age$";
baseDirectory = value;
})
base;
allSecretPaths = builtins.mapAttrs (serverName: secrets:
lib.lists.flatten (
lib.attrsets.mapAttrsToList
(service: fileNames: builtins.map (fileName: "./hosts/by-name/${serverName}/secrets/${service}/${fileName}") fileNames)
secrets
))
secrets;
in
# We should be able to merge with the `//` operator here because all attribute paths
# must be unique (they were files previously)
builtins.foldl' (acc: elem: acc // elem) {} (
builtins.attrValues (builtins.mapAttrs (serverName: secretPaths:
builtins.listToAttrs (
builtins.map
(secretPath: {
name = secretPath;
value.publicKeys = publicKeys."${serverName}";
})
secretPaths
))
allSecretPaths)
);
in
secrets
// {
"tests/common/email/dkim/alice.com/private.age".publicKeys = [soispha jaki testingKey];
"tests/common/email/dkim/bob.com/private.age".publicKeys = [soispha jaki testingKey];
"tests/common/email/dkim/mail1.server.com/private.age".publicKeys = [soispha jaki testingKey];
"tests/common/email/dkim/mail2.server.com/private.age".publicKeys = [soispha jaki testingKey];
"./tests/by-name/ro/rocie/secrets/login.age".publicKeys = [soispha jaki testingKey];
}
|
