diff --git a/hosts/lazyworkhorse/configuration.nix b/hosts/lazyworkhorse/configuration.nix index 1496ed9..f240cb3 100644 --- a/hosts/lazyworkhorse/configuration.nix +++ b/hosts/lazyworkhorse/configuration.nix @@ -251,7 +251,9 @@ # Private host ssh key managed by agenix age = { - identityPaths = paths.identities; + identityPaths = paths.identities ++ [ + "/etc/ssh/ssh_host_ed25519_key" + ]; secrets = { containers_env = { file = ../../secrets/containers.env.age; @@ -585,4 +587,12 @@ ]; }; -} + + # agenix-rekey configuration (for builder_key re-encryption at build time) + age.rekey = { + masterIdentities = [ + "/home/gortium/.ssh/gortium_ssh_key" + ]; + }; + +} \ No newline at end of file diff --git a/hosts/uConsole/configuration.nix b/hosts/uConsole/configuration.nix index 907bcbf..8ad15a8 100644 --- a/hosts/uConsole/configuration.nix +++ b/hosts/uConsole/configuration.nix @@ -214,6 +214,10 @@ }; # ============================================================ + age.identityPaths = [ + "/etc/ssh/ssh_host_ed25519_key" + ]; + # agenix-rekey — automatic secret re-encryption at deploy time # ============================================================ age.rekey = { @@ -224,7 +228,7 @@ # uConsole SSH host pubkey — for automatic rekey at build time # Once uConsole is deployed, replace with actual pubkey from: # ssh-keyscan uConsole.local | ssh-to-age - hostPubkey = "age1qyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqs3290gq"; # dummy — replace after bootstrap + hostPubkey = "age1un8td4jzkhg5fm4jja7z3aznskc8hlcm8ky0j2f70tv74rulwgaqtpemn2"; # uConsole CM5 SSH host key }; # Pipewire overlay: drop libcamera (fixes aarch64 cross-compile — rpi-pisp blocks) diff --git a/lib/keys.nix b/lib/keys.nix index 539260f..d218483 100644 --- a/lib/keys.nix +++ b/lib/keys.nix @@ -25,5 +25,9 @@ gitea = ""; bootstrap = "age1r796v2uldtspawyh863pks74sd2pwcan8j4e4pjzsvkmr3vjja9qpz5ste"; }; + uConsole = { + main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICasvsmaHuNVaWnjwuBfoMXyY/6PIqGL8yxstPBb46u4"; + bootstrap = "age1un8td4jzkhg5fm4jja7z3aznskc8hlcm8ky0j2f70tv74rulwgaqtpemn2"; + }; }; } diff --git a/secrets/builder_key.age b/secrets/builder_key.age index 4e46786..81c8f81 100644 Binary files a/secrets/builder_key.age and b/secrets/builder_key.age differ diff --git a/secrets/gortium_password.age b/secrets/gortium_password.age index 3594b19..adaba7e 100644 --- a/secrets/gortium_password.age +++ b/secrets/gortium_password.age @@ -1,10 +1,8 @@ ------BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSA4MlFz -SHFjYjJMVHRlTWNGVGI2bHQxc0xRd2tlaExlM0NFMWhlbkR2bVg0CkxxenVTaXkr -eWxybDdCeUM0ejRvZWI4cFZCWm5VczRvZkNnT0d5Y1oyYmsKLT4gK1NmRzVtLWdy -ZWFzZSB3UDI6TyNaCnF4Ylk0QWduaXZxRFBFbDBOZ0dxeGxiWTVCYjRtZTJBRkFC -YU5qaytYWWI4OWl1K1FSdXNlY2JXZjkzak9tTHkKVFlCRlRqY1FVSzFmNS9yZmxF -aEUxelUwNEpKN3VXYi9KUWN4bXFscm5oUEFOajhRZDlERWVYcFgvQQotLS0gK1JI -VERTQjB6d1k3NDQwbjNveXBqcFk1WE96cHlaTTVkTWRMZENPamFJZwpcT1CP/KvU -CsunvfX9RBlSSKuw4eem9N9s3JqJNj4FRQizNx6QzlE1vSME ------END AGE ENCRYPTED FILE----- +age-encryption.org/v1 +-> X25519 7xL84BK2tC3CqgHpETooVNzVTpV/CcLWqyrydQhenzM +idcoRTzHMOExLmwZUyrWKLYNxVYwKu4wrnK10vqFYzE +-> X25519 4XY4yLwWjdLAG1As22OK1BfLi+xbXxxYkex2bq3yWVs +QVSZjLUA060toELjD5SXbh1HSUPv1Xwt7P8bjVrgjQA +--- +19En3AkdJjEkeKmVSV0cm9z7zYVVtrOSQNexY9Yrbg +#c1Yy /X! a,g c<,ɫ% Lhړ(/ +Tf7%<l ы,Ncjm3u?9?FIUb+,&!vIOi/\MAז+ƒG \ No newline at end of file