Hermes
24761b58b2
agenix-rekey auto-re-encrypts secrets per host at build time: - Encrypted once in git with master identity - Re-encrypted for each host using their SSH host key - No manual multi-recipient encryption needed
19 lines
527 B
Nix
19 lines
527 B
Nix
let
|
|
keys = import ../lib/keys.nix;
|
|
authorizedKeys = [
|
|
keys.users.gortium.main
|
|
keys.hosts.lazyworkhorse.main
|
|
keys.hosts.lazyworkhorse.bootstrap
|
|
];
|
|
in
|
|
{
|
|
"containers.env.age".publicKeys = authorizedKeys;
|
|
"gortium_password.age".publicKeys = authorizedKeys;
|
|
"home_wifi.age".publicKeys = authorizedKeys;
|
|
"lazyworkhorse_host_ssh_key.age".publicKeys = authorizedKeys;
|
|
"n8n_ssh_key.age".publicKeys = authorizedKeys;
|
|
"builder_key.age".publicKeys = authorizedKeys ++ [
|
|
keys.hosts.uConsole.bootstrap
|
|
];
|
|
}
|