From cbb016d4099d6b58f2216f49c61ce2d6ac4867db Mon Sep 17 00:00:00 2001
From: Hermes <hermes@lazyworkhorse.net>
Date: Mon, 22 Jun 2026 00:02:22 -0400
Subject: [PATCH] Fix agenix-rekey: add real uConsole host key, re-encrypt
 secrets

- Update uConsole hostPubkey from dummy to real SSH host key
- Add uConsole host key to keys.nix
- Add age.rekey config to lazyworkhorse
- Add SSH host key to identityPaths on both hosts
- Re-encrypt builder_key.age and gortium_password.age for both hosts
---
 hosts/lazyworkhorse/configuration.nix |  14 ++++++++++++--
 hosts/uConsole/configuration.nix      |   6 +++++-
 lib/keys.nix                          |   4 ++++
 secrets/builder_key.age               | Bin 611 -> 709 bytes
 secrets/gortium_password.age          |  18 ++++++++----------
 5 files changed, 29 insertions(+), 13 deletions(-)

diff --git a/hosts/lazyworkhorse/configuration.nix b/hosts/lazyworkhorse/configuration.nix
index 1496ed9..f240cb3 100644
--- a/hosts/lazyworkhorse/configuration.nix
+++ b/hosts/lazyworkhorse/configuration.nix
@@ -251,7 +251,9 @@
   
   # Private host ssh key managed by agenix
   age = {
-    identityPaths = paths.identities;
+    identityPaths = paths.identities ++ [
+      "/etc/ssh/ssh_host_ed25519_key"
+    ];
     secrets = {
       containers_env = {
         file = ../../secrets/containers.env.age;
@@ -585,4 +587,12 @@
     ];
   };
 
-}
+
+  # agenix-rekey configuration (for builder_key re-encryption at build time)
+  age.rekey = {
+    masterIdentities = [
+      "/home/gortium/.ssh/gortium_ssh_key"
+    ];
+  };
+
+}
\ No newline at end of file
diff --git a/hosts/uConsole/configuration.nix b/hosts/uConsole/configuration.nix
index 907bcbf..8ad15a8 100644
--- a/hosts/uConsole/configuration.nix
+++ b/hosts/uConsole/configuration.nix
@@ -214,6 +214,10 @@
   };
 
   # ============================================================
+  age.identityPaths = [
+    "/etc/ssh/ssh_host_ed25519_key"
+  ];
+
   # agenix-rekey — automatic secret re-encryption at deploy time
   # ============================================================
   age.rekey = {
@@ -224,7 +228,7 @@
     # uConsole SSH host pubkey — for automatic rekey at build time
     # Once uConsole is deployed, replace with actual pubkey from:
     #   ssh-keyscan uConsole.local | ssh-to-age
-    hostPubkey = "age1qyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqs3290gq"; # dummy — replace after bootstrap
+    hostPubkey = "age1un8td4jzkhg5fm4jja7z3aznskc8hlcm8ky0j2f70tv74rulwgaqtpemn2"; # uConsole CM5 SSH host key
   };
 
   # Pipewire overlay: drop libcamera (fixes aarch64 cross-compile — rpi-pisp blocks)
diff --git a/lib/keys.nix b/lib/keys.nix
index 539260f..d218483 100644
--- a/lib/keys.nix
+++ b/lib/keys.nix
@@ -25,5 +25,9 @@
       gitea = "";
       bootstrap = "age1r796v2uldtspawyh863pks74sd2pwcan8j4e4pjzsvkmr3vjja9qpz5ste";
     };
+    uConsole = {
+      main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICasvsmaHuNVaWnjwuBfoMXyY/6PIqGL8yxstPBb46u4";
+      bootstrap = "age1un8td4jzkhg5fm4jja7z3aznskc8hlcm8ky0j2f70tv74rulwgaqtpemn2";
+    };
   };
 }
diff --git a/secrets/builder_key.age b/secrets/builder_key.age
index 4e467869fd0d500bae2ec2e943326cbfb4fda0d2..81c8f81922848df5ea053a35558623ab63694fc2 100644
GIT binary patch
delta 689
zcmV;i0#5zo1jPlAAb)aYS}S*WO?XFDMlo)APE=QVR7FR6IdW}wRZcKAOlog=IZ<kJ
zMM-fmNeXW>Yj{#YHEK9-I5SgHS~5XWY&LH&I8%B-VNft^c5pc|WH&KnWmHCMYYHts
zAXqXrH8D9La5QXJW^-^>OJ^`QGig>sb!$^bXk$29ST<Kec7IfFZ!%OtPj+TeLTq?R
z3S(+CXlZt8IYlsOO;veUS}{~>HEKplZgNCwLv|~8NkngKWp8zFXlHCq3N0-yAUIfT
zY-d_oZB2Deaw~XbN;G*@STSs6LReF1Gi*#zS$Q!qZ%br3D^6NT3YsB1Zbv`-w}IS!
zJUv<csy>xJ<bS#NT?pw0ROa*?C7Dars(h>2GJTKhXIlylMQU9zvQ}U*fuy6K`wMM9
z)>QTE?E;R*W{x6f*U@qkKU_8swc@q<Pr84RlClNUkW*`9Y7dz_Zw=TaxTI=6V%jp9
zm9uN|Y8{M2rtClYk$`SK`^Pfw>wiF)GO3cz8rjvAjDLwOQ4&p{2~NkI#qix^IZ%3-
zzm`^N{ViL9_Rnc@CO@Uv2<iwae3%}MLDIKIPOaB&ItF|s255_mS{n~I5%XSaA~zRh
z@norSVV}(q3wyT#B@<X|sbEDc->)1-Q*s>F_`^fEf4rmnpZ*U!Z5n@{G)?Co)%-9<
zrck*Z-G7}030C7C`I}rGfyU0;v4Zs$g`K^aqFd%8G;*~d)E#2Nj$^?H+wKpH6vj@i
zR)j(jZwv-aL(9D+jVo_^n*VzvFjii{Sx8>0VS9T)2)cxr?>Sl`cL4lH7e;&7)6Ifw
z^Z$eK;j$wC7BMB)hF&J7zP=I*^&Y5~I>6)yK`L_zwDL$GIbQOmOTKwcmi$|Wo=euy
Xqm$7Ia_k*S-NN5=+Rr}VkEbROHKHd+

delta 590
zcmV-U0<rzY1>*#eAb&M;Q!7|OVq<G@P*Folb8l5+a$_|{NmNj0YkERRX=_kHaAa6&
zGiYu{X9{LCFHksaRajaySw%=IMsZp+F;h%1VnQoTVqscSad}Erc{Wo*P)uuUZwf6f
zEg)KHT6s%RcTY!kcu`t%Ye;rtLwYuBQA~A4dUQE<D^65&Ie$WTM^<T9STG8${5$UI
zRv*)k^{a9nRj-jnxm}-;yru4_86jTlmk)20d~)3TF53W8?hgdOt8Xu|XE)mbKJk?F
zHch8MQdhrg77|h!t^Ji+qGOAgU|HN0q9xl9oati%_wI4{EJE<>V3;j#BZ69%NOY=Q
zCN;E?6ia9ipMRSi#B-Fm@wCF`F7xh3X7h;6mT<6Wyr%7{jODS8cQEQCejoTK!f&zx
zS&%$whq1agr~HPrNC%yvqR&Xzi;oSto46L&-7U-Sh$-UPIhoO1TVaLgT=!JJG49kk
zaN?rwS(T7Zi5aRJcCgjWg^XNN>{TsR79LOeLQyI5&3|@4E-MAIj6HO1ggsK#V7}7B
zsDQ>-<1NyQ;|(q2eTha`SqwTpRp-<hA{0!1D~%zY?A@k6w$_c{PW<Uv21bfe6W3c3
z)cHIN$pJ=Ov<>c0Q2PpKA=p6M{VOkAwr(pXLKrW9k_uKOA&vT(+wOYcLC+<x$M13S
zcQ8lc`A1%pyupa!FBIES3SgLRH1FrO)aO5sN*>I3OY$l~tz3|V6>*+z3Y(rkDl;5v
cWT~Uu3MU~XIQJcIZX?v0Ob5Ej*2WHSdgIv*KL7v#

diff --git a/secrets/gortium_password.age b/secrets/gortium_password.age
index 3594b19..adaba7e 100644
--- a/secrets/gortium_password.age
+++ b/secrets/gortium_password.age
@@ -1,10 +1,8 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSA4MlFz
-SHFjYjJMVHRlTWNGVGI2bHQxc0xRd2tlaExlM0NFMWhlbkR2bVg0CkxxenVTaXkr
-eWxybDdCeUM0ejRvZWI4cFZCWm5VczRvZkNnT0d5Y1oyYmsKLT4gK1NmRzVtLWdy
-ZWFzZSB3UDI6TyNaCnF4Ylk0QWduaXZxRFBFbDBOZ0dxeGxiWTVCYjRtZTJBRkFC
-YU5qaytYWWI4OWl1K1FSdXNlY2JXZjkzak9tTHkKVFlCRlRqY1FVSzFmNS9yZmxF
-aEUxelUwNEpKN3VXYi9KUWN4bXFscm5oUEFOajhRZDlERWVYcFgvQQotLS0gK1JI
-VERTQjB6d1k3NDQwbjNveXBqcFk1WE96cHlaTTVkTWRMZENPamFJZwpcT1CP/KvU
-CsunvfX9RBlSSKuw4eem9N9s3JqJNj4FRQizNx6QzlE1vSME
------END AGE ENCRYPTED FILE-----
+age-encryption.org/v1
+-> X25519 7xL84BK2tC3CqgHpETooVNzVTpV/CcLWqyrydQhenzM
+idcoRTzHMOExLmwZUyrWKLYNxVYwKu4wrnK10vqFYzE
+-> X25519 4XY4yLwWjdLAG1As22OK1BfLi+xbXxxYkex2bq3yWVs
+QVSZjLUA060toELjD5SXbh1HSUPv1Xwt7P8bjVrgjQA
+--- +19En3AkdJjEkeKmVSV0cm9z7zYVVtrOSQNexY9Yrbg
+�#c1��Yy /��X!���a,g��c����<�,��ɫ%	Lhړ�(/
+Tf�7�%���<l
��ы�,Nc����
j�m3��u��?9���?FI��Ub+,�&�!v�IOi�/���\�MA�ז�+ƒG
\ No newline at end of file