From 4fd953b18889363d63dad0db4996f1b958fd17cb Mon Sep 17 00:00:00 2001 From: Leonhard Kost Date: Mon, 9 Feb 2026 11:04:37 +0100 Subject: [PATCH] feat(agenix): use host keys for decryption --- nixos/server/secrets/default.nix | 11 --------- nixos/server/secrets/nc_api_key.age | 29 +++++++++++++---------- nixos/server/secrets/nc_api_password.age | Bin 692 -> 975 bytes nixos/server/secrets/nc_customer.age | Bin 648 -> 931 bytes 4 files changed, 17 insertions(+), 23 deletions(-) diff --git a/nixos/server/secrets/default.nix b/nixos/server/secrets/default.nix index fc3879e..413cb33 100644 --- a/nixos/server/secrets/default.nix +++ b/nixos/server/secrets/default.nix @@ -1,15 +1,4 @@ { - config, - pkgs, - ... -}: -let - keys = builtins.map ( - key: builtins.toString (pkgs.writeText "agenix-key" key) - ) config.kekleo.publicKeys; -in -{ - age.identityPaths = keys; age.secrets.nc_customer = { file = ./nc_customer.age; owner = "dyndns"; diff --git a/nixos/server/secrets/nc_api_key.age b/nixos/server/secrets/nc_api_key.age index c56e35f..a93a88a 100644 --- a/nixos/server/secrets/nc_api_key.age +++ b/nixos/server/secrets/nc_api_key.age @@ -1,13 +1,18 @@ age-encryption.org/v1 --> ssh-rsa 0VNryQ -YH11o9QzKg5u12VpNWVth66TStPbNM1A5LEc2iERk6pt3mh3gMFZ4dY0xCi8unaY -C1xeNd0dmxJwbeCVmEy7zj8IQ9ROAhobv0uFGDJHuqr96HoMxk3iw2/M5up3KCFc -w6cdJWVJzG0UP20Jiu3f3Yw5dCt7bGGr4MWL9XNmzOzXZEfBcnPiXgdhwurRfOR/ -ZR/r06uNzJNb9nyZeAewU4B1WtkfGdzw6T44IheTmXjTSP2woFl64vddnayl64lw -xnoG85jz23ayiB8IDIkE+o5cb/2kfPCQNG3JVd+XGT3SJvJRYHwFl6hfX63G504A -6UzCHMrKG8WeNg0WwR4ViyoEg3Q0ZsExCxBx7itB0/7i/Q4v3bcif1jFFIC2HepC -5M9UcYlHr06qkfITHATnq3pCd+0piolT7k3YwFzeojp/zUUtfnMOFauVNpeEfqy4 -B5deqnbKYt8z0BZsZ377RUbsP7q+Xho6dZmVOEqG3LzzW3aJSbhigduh51vCbimD - ---- yMIQCO5AwTLnXoHXjYHBvXfOIf5vRe/cmNv4mzqlU6s -E½bü¥°<ÕQXH O0q†w¿üç®Ô³‡w$ lyg]¿ÇõñâÒŠ›Άþ´gÇÑH Z"ÉÇn³Q&-U_2ÎõN.–ärg»·™ö3€ \ No newline at end of file +-> ssh-ed25519 RiiDcg hRxnpXLZ3iWII4uhNkKYnNcG1xmTagGOoq1H3Qre2Bk +wdXkpq3QTSZkp4TKS9Yhe4Nl8kxTnXqbAEhniI6W2Mg +-> ssh-rsa t41wew +N0NqSos7sbCZNlcCWx50DLkF5uaRgITie49w56Ppml2AzVCSOqj1VtmHj6Hudc4J +8L65vAFp1y9L1WZELTk9p/XlnRPxvixxW5loiz7DCVVSYR9QoyJXdejlv+Sek3O6 +8zkroUZrb3Uw2EP+YnyDM3V3mg112VZJuMu1RyVVJ6HUFn1jUKrrnftbcD6HZ+g1 +ajM4m3EC3XDXecGj+i9/7BQooU5wVEO+Nyro3SWe3VyFJyImeUc/Wi5BVSB3Jr4V +fm3ffD4dfF9lottl4+oH0u7itNZekMk57FWpM+a6+QXjxXpQiL8LPz8cOfjdenAq +wVHWpnW1l8ZdgZcN6PGlJ/UkBqiWJHWJtdgqc/y5rVNlfhP6BXBh53IAAYqFBkAj +BIbD4tq0xMxtE+3kYdjzzb92+yYUC+A13RddDdjdTC+biekbklDkkJOscatyWMtM +uzPsVUuP5YjXmfiYWIyosh++AO46vCjdjuYFtB28YYUBsWeQsJdOGsFRWDoQRgIt +wnf5RbZH23AySDYg3xgRsL3JVmnHJwPg6u6FmmQEJ+FvxJLBchI4Llh7uI9N2Pep +VRgMlhQnvzdVqoPcVnXc21WV59fXmueN/BuUuAU8TnhX/TGp8Qi2z9VjFc2DIcFd +A6NsX7IR2lKflRBipMmCCvVHNHyKtqwQu/UoCdfw2sA +--- gQ6FWeE76Cmb4A6OBfCi5vAOpopjzFOq8OH4kBveU/M +ø“ {(ͼº|ŽØç|Ÿ)-:÷¡[%VqÂíp6~]ÔC +ó'ªE Ül2B;öÂ3¹ ƒë¾“.òúhë?³‘PØ4|y»½&Å˜Š¢"³%Ó \ No newline at end of file diff --git a/nixos/server/secrets/nc_api_password.age b/nixos/server/secrets/nc_api_password.age index f6a14a75fa6c744d8bce76d1478fa35841a92807..e4d18b74cafb4d498c7d5bb44b55bdf561f68f7d 100644 GIT binary patch delta 960 zcmdnOdY*lPY<+5qk*TSnr9x0W zUwV#vhOvhum#&>cadC!jQE{R|iHTu(YB^ViL5Yh?O1-zfwwtAXR=T-%Wrc^QMNy(p zj#p4>XkJ!PzE_BGcxtwHP(?&iR#HWZe_Bd`ds?oWQM!3)j<%N@S5`ow|wV{nP5pfswX$rEg(zVo*?+f0{`~hF?aRWp<&zfn#2HrD>_7r=^8OrblkF zLA{v=m!(s_VNz&bkVjZ*VR?Z?rgwQnvc5%;wwJSKa=CMqi$$t-NmXu%Yj~Q4lUY_& zYDQIIdX;O4k#AvYMOCnV1y@x_o_<+gs7XdZzQ2BMaA8S!aaM?NxQV`NS!%XLK!B;S zX;?^Ea8g-8g-dygxwda&XrR7NT4-5XVSSiWVxd1*xld`bS6OhCVMTgixL26Di=}I} ziGQ+Bd5Vv(qp?e9q-R8VO1V>LZbW#nc7C8+XjEoMcu9a$u4`(6d1zuGmxoulpGT-; zPG+T1l6OT$M1i)8S!Q`aa8X5hS%61oO0v0`rHfy2nWLpeTCQbUUY5RVQIL;zZhfj@ zVTGkpm?Kw4V77UvyQ_a$zL!&OPJVH^YpJJxgmX}Mm~(lgTUlzTzNLqgWnr;@z6qDE zuC78_X+=g-vP*h)SfN3-wuNi4Wn`+izCmfWV^u+=Wm>6os9#ocK&7{Tawyl@=vhnh z)?b*+7CEtX|F_sH%VMn6IwkvGDIT3*Olo-uoc#?)}yFE4xn0WJd>nu6%hH0QA#LH~;_u delta 675 zcmX@lzJ+yyY<*F2qJlw~Ur}WsSGIYnL8ynNfl+vIs(H3|fWL2mp}A$4qgT4IXa(I4V zR(^hBut83meuk-2Wnx8MdR9=CNo9G4Wq68rVYzu=VST8fxv5#GldDB=j!`C8sJUZF zlAC@}Vp?91M|N3NQh9~5WoTikzlnEfsCHp#s!N4QUY2oXR$!QAL`7M;tD8q=fm2p? zai(QvN|t97S7oM~X?}2Ku6BNCms@CovA;oirhAo-Ye-^1d89>oSWrZYuVt2- zON73*kx^iQe-2lWSxH7zU{R&FrE{^LQD8`lrC~v_MM;jMk4a8ec1THhuD^S-c2Jo? zWxaouYj(a_a=3O*o@rTXez<>@f1sBo7niQCu7XdPSE;jwr+JQ(x3gt(QgUW_VOC~T zSx#9{N@ZnLn!B@GVR)i!S(Os)>{g;5;4ERE_`HWYWih& zq3hnBQ15rIGZMP%*Sqyv?tG^|UGz`yw1|)UWMt~QBcs~ur!<|(Zckz0ICe=OTz@Y2 Kmj9Qn_;Ug4NfC?nrLIJGD^%`-5+ zBqX;iJ2AN|EHE`F#VIhKD?B&7Fx59aE4(1UqOio!CCV~5*fJ_4z&ymo(j_UPIKsQg z&_us9z~9S}OV>`JxHv<%s5nuf#Kf>XwVW%^H8m^Iz24N_+&nkW#MRNPsL;S8(X!a9 zBrU}+TiY=-Bi+f%r?4c<#nsR^r!w6!&8XZgD>1^?#o5Uv!^zi>E6*h}#m&#r+b`G6 z&^_19+aSX!!X(5?+q^8>D5=!9z{@-@)Y7uTsj|SO*r~9z$n!yG|e$TJlP~G!^Jes#JDJ;w4$Oa!{0H@KPxQD%qPbv&!a3w+e<&Q z+^8(dG)3R2%-77t-=K=i%Oxncyxg-YI4Z~8IU~%qvLwAIE3zOtz{$fh&o$W~HM=Y^ zC_g{cH_^hh$jI5u(O0{u!qD9?FFd^@EU-kItG>dqz~95AD8oC|!nnxQH(T4SD#t&> zJG&q|+{iE2BU|4*%frah&@?q9Dk!70)T|^k$;>6H&@0@cB)z;WB!tVY)I236qbwpM z!Z_E&rO;JB&Dq%^)UPT3}t17P~Im#u) zqCO&%D>>KH*~=i!w=}rW(<>v$JtEVjEG#$5!>=mOxwtT>*f20Lqd3>qBU?W+vCQ48 zJl!$MEy66!r6k<2*wZpBnJd{fz$q&)z0^OTG}kN1JH5Qj)!ntssmwdQ!r3b?B+NY7 zz%Rok*~}}%F}qT`B;4FEvCyOxIQnv(xQSZ+@w@L&onzd-Otw4frTIM~G9B-lK)G9cHmBr7V=+~2r3JHju_I3=nqs6N0y zCEe3AHL! z*QC@i$vinf&B-Gy%qhssLf_QIqNKpgveZ8+EK}bsl*=!@&^xTaG$hYArO3`B_&x~+q0o1I&_ds-FwHBeI3OUREH9|6 zB-_WY(xS*OEI+F>F~ia%xhlokqSPeJt@|D#|3lu&Oe-yv!@WIKVkAz}Ya*Ei}wTyWYpbR6one*|03n)6pflDAC*}gDbc$onJ`Onu(