sombrero: Add agenix module and use it for pinwheel ssh key

hosts/sombrero/modules/ssh/default.nix

@@ -1,6 +1,8 @@
-{ lib, config, ... }:
+{ pkgs, lib, config, ... }:
 let
   enabled = config.mod.ssh.enable;
+
+  authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
 in
 {
   options = {
@@ -10,10 +12,41 @@ in
   };
 
   config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      programs.ssh = {
+        enable = true;
+
+        matchBlocks = {
+          "github.com" = {
+            hostname = "github.com";
+            identityFile = "/home/alex/.ssh/alex.sombrero-github.com";
+          };
+        };
+      };
+    };
+
+    environment.etc."ssh/authorized_keys_command" = {
+      mode = "0755";
+      text = ''
+        #!${pkgs.bash}/bin/bash
+        for file in ${authorizedKeysPath}/*; do
+          ${pkgs.coreutils}/bin/cat "$file"
+        done
+      '';
+    };
+
     services = {
       openssh = {
         enable = true;
         ports = [ 1122 ];
+
+        hostKeys = [{
+          path = "/etc/ssh/sombrero";
+          type = "ed25519";
+        }];
+
+        authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
+        authorizedKeysCommandUser = "root";
       };
     };
 
@@ -22,5 +55,26 @@ in
         allowedTCPPorts = [ 1122 ];
       };
     };
+
+
+    age.secrets = {
+      "alex.pinwheel-sombrero.pub" = {
+        file = ../../../../secrets/pinwheel/alex.pinwheel-sombrero.pub.age;
+        path = "${authorizedKeysPath}/alex.pinwheel-sombrero.pub";
+      };
+
+      "alex.sombrero-github.com" = {
+        file = ../../../../secrets/sombrero/alex.sombrero-github.com.age;
+        path = "/home/alex/.ssh/alex.sombrero-github.com";
+        owner = "alex";
+        group = "users";
+      };
+      "alex.sombrero-github.com.pub" = {
+        file = ../../../../secrets/sombrero/alex.sombrero-github.com.pub.age;
+        path = "/home/alex/.ssh/alex.sombrero-github.com.pub";
+        owner = "alex";
+        group = "users";
+      };
+    };
   };
 }