sombrero: Add agenix module and use it for pinwheel ssh key

flake.nix

@@ -52,6 +52,7 @@
         specialArgs = { inherit inputs; };
         modules = [
           ./hosts/sombrero/configuration.nix
+          inputs.agenix.nixosModules.default
           inputs.home-manager.nixosModules.home-manager
           ./hosts/sombrero/home.nix
         ];

hosts/sombrero/configuration.nix

@@ -61,12 +61,14 @@
       isNormalUser = true;
       hashedPassword = "$6$3mkwaUWd8NA6XuEb$x80tETKGz6FEG.kej3v5Vh6hRNoC6bikhXogTP.zZwYtISA46JaN3RMK3ckbqt8Aj52d3krSLOfBaAR1qzuJ2/";
       extraGroups = [ "wheel" ];
-      openssh.authorizedKeys.keys = [
+
+      openssh.authorizedKeys = {
+        keys = [
           "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD8g63nIaOg67kwwEd5cGXvzaTL1PefLwonKkDy1P2cJjngcH/cBmgzXUZWxWqgBIENZ3mj0EJtoD556tprRRFj9COdAEI9bxn2NkoqPCu8f7SttQTeVA63ZbAR7AHPMMngBxRiQy6SIo6mQteXha1z99+g0YHETct/qhmm2AbtakF+NSb0bIqrFYnOl7iSW4cotGjibAyX74b4dBe9A2sIYwmBs4IMjLlHmcrmqLqPIAGWY1EgNV/HIN06whbkSjpoxaFAZpxoVskk/syjzD/RRSLnFhXbljZeRkUp1nFsELNGgugQo3fx1oxigfgzo09QSRDuB6eb2Ol1XnnNU0vcJPio9PmIR9aOiinVx/i/N0QvQtedoxNgLR4bayJrOxL7wYvWGW50TCLEIZ+OnPp6HW5mGHaOWjeKymjBCXpQumTcv3TBZpsHvQ5vbTU2otbbof/1ScEzfS9XBxWPH89dua1aPBcHk58jGbNz7jRLBPNSmDgvuIMAeavrDbHu5p22XnHOPz9f2aCkX2M6ll17mN1dMc8v6/i9/gV7bmSj+DAwQEjxtYd1eQFGw9VvmDfTdzpBhLmnNAIdbHJo3WMsY0AZCvov0mEu7qJA8hrmm4ITb9pO0ZhfYfF1bZVbYfKAdF3hWPn5vxQFXKUogSXjU8lIn6Bu+Vw40IteDy2aKQ== alex.bennu@sombrero"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFMl66CW8XtBGP9ie5Xd6MyQ1c+mRa8TwSiXctq+byS alex.pinwheel-sombrero"
         ];
       };
     };
+  };
 
   environment.systemPackages = with pkgs; [
     gnumake

hosts/sombrero/modules/age/default.nix

@@ -0,0 +1,13 @@
+{ inputs, config, ... }:
+let
+  system = config.config-manager.system;
+in
+{
+  age = {
+    identityPaths = [ "/etc/ssh/sombrero" ];
+  };
+
+  environment.systemPackages = [
+    inputs.agenix.packages."${system}".default
+  ];
+}

hosts/sombrero/modules/ssh/default.nix

@@ -1,6 +1,8 @@
-{ lib, config, ... }:
+{ pkgs, lib, config, ... }:
 let
   enabled = config.mod.ssh.enable;
+
+  authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
 in
 {
   options = {
@@ -10,10 +12,41 @@ in
   };
 
   config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      programs.ssh = {
+        enable = true;
+
+        matchBlocks = {
+          "github.com" = {
+            hostname = "github.com";
+            identityFile = "/home/alex/.ssh/alex.sombrero-github.com";
+          };
+        };
+      };
+    };
+
+    environment.etc."ssh/authorized_keys_command" = {
+      mode = "0755";
+      text = ''
+        #!${pkgs.bash}/bin/bash
+        for file in ${authorizedKeysPath}/*; do
+          ${pkgs.coreutils}/bin/cat "$file"
+        done
+      '';
+    };
+
     services = {
       openssh = {
         enable = true;
         ports = [ 1122 ];
+
+        hostKeys = [{
+          path = "/etc/ssh/sombrero";
+          type = "ed25519";
+        }];
+
+        authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
+        authorizedKeysCommandUser = "root";
       };
     };
 
@@ -22,5 +55,26 @@ in
         allowedTCPPorts = [ 1122 ];
       };
     };
+
+
+    age.secrets = {
+      "alex.pinwheel-sombrero.pub" = {
+        file = ../../../../secrets/pinwheel/alex.pinwheel-sombrero.pub.age;
+        path = "${authorizedKeysPath}/alex.pinwheel-sombrero.pub";
+      };
+
+      "alex.sombrero-github.com" = {
+        file = ../../../../secrets/sombrero/alex.sombrero-github.com.age;
+        path = "/home/alex/.ssh/alex.sombrero-github.com";
+        owner = "alex";
+        group = "users";
+      };
+      "alex.sombrero-github.com.pub" = {
+        file = ../../../../secrets/sombrero/alex.sombrero-github.com.pub.age;
+        path = "/home/alex/.ssh/alex.sombrero-github.com.pub";
+        owner = "alex";
+        group = "users";
+      };
+    };
   };
 }

secrets/pinwheel/alex.pinwheel-sombrero.pub.age

@@ -1,10 +1,12 @@
 age-encryption.org/v1
--> ssh-ed25519 vxPbZg p4V0jEUSH1GQeHcqAzKQVyQb1whfOdBQ1FM+Y3UCeXI
-N6kWm/X+OdIaaipDDCPgM1bHjj3RxBOGf+E/PhJJRR8
--> ssh-ed25519 ek+b7Q iYAYLpirJ/ftOLuu+K7NAVEBXPsINGet+vyjsjTzp1w
-bal6VjX/5iOaJSXVI9T1pJWB3Pk0ees1mhMpdU6lgMc
--> be:Y?D<-grease k$wtP
-kVG6hZ/k+y3O5X9rDF0v1FuNSrKDH1dPgVY20yZwT43Tkhzb59DaNHYKHVrBhYVH
-RWACoa7MP4LE7d6y5URUkcSk1PGKt9s7SbwuH9ExKZM+1z8
---- MtZ6IZYpKhgghsljQXY/psDJVufYuG2E/s5/cpuUsWU
-s6<EFBFBD>:?<3F>g<EFBFBD><67><<3C>^yNH<<3C><>}<7D><><02>„4<0B><>d¬FB(-<2D>\<[W<><57><EFBFBD><19><>3Xԙ<58><D499><EFBFBD><EFBFBD><EFBFBD>6L}<7D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><06><> gP<67>u<EFBFBD>&<26> 3<>MWZ<57>T<>kM<6B><4D><EFBFBD><EFBFBD>ϱ*h<>[<5B><>y<EFBFBD>rR<72><52><EFBFBD>*p<><70>z<EFBFBD><7A><EFBFBD><EFBFBD><EFBFBD>߃<EFBFBD><DF83>:<0F><><EFBFBD><EFBFBD><EFBFBD>e
+-> ssh-ed25519 vxPbZg 1xoU/lpkuPdG+UQW1D9VrAnSSEpK+b6pu+wflgvRQFs
+7jupzfqRmH5wzcVX3VCqQAghHZNXHiPc6YP8es8NYic
+-> ssh-ed25519 MxZlmA QUqt2gwCtIUv8nFTr8LSinLt7hD05EH/N6Yobew6GEI
+JuzbNQrpONfKkIUgi//p8LhwxjCka/SQGYimglCueCU
+-> ssh-ed25519 ek+b7Q AfW7nec0E1vtg72C1f2Qp7RM/qNf19x5eEZgsonXbCs
+joytWP1pp8lAgm2ORh88ETi8giGwPfCo9mwtlqTQ0U8
+-> M,fSDC$-grease {.x R26(e2' v5Y
+5JMhlzqPlW0vBFTe/5gBoSqxHesiKDi9BZp7Ckf+c6P2NiJHe3yurg+l8XoxEjN9
+GQrQTg
+--- luPA8khtSQv2Kg8v+GWx8BPXPqeqcnoiGfghMJqDFuE
+픖~&l<>+I9<49><39>xϞ<78>߼DV<03><06>r<EFBFBD>W<EFBFBD><57>AX r<>i<EFBFBD>Y

secrets/secrets.nix

@@ -1,12 +1,13 @@
 let
   # see `modules/age/default.nix` where these are defined
   pinwheel = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMoI7Q4zT2AGXU+i8fLmzcNLdfMkEnfHYh4PmaEmo2QW root@pinwheel";
+  sombrero = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO/NltCo1L+X1OIBfIKzfrbxLpCOerQ4vTIs+QPTXkf/ root@sombrero";
   alex = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjSFvlbdy5D59UaVWjRMyBndiAT2MtCeT+6GuemkuYe alex.pinwheel";
 in {
   "pinwheel/syncthing-cert.age".publicKeys = [ pinwheel alex ];
   "pinwheel/syncthing-key.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-sombrero.age".publicKeys = [ pinwheel alex ];
-  "pinwheel/alex.pinwheel-sombrero.pub.age".publicKeys = [ pinwheel alex ];
+  "pinwheel/alex.pinwheel-sombrero.pub.age".publicKeys = [ pinwheel sombrero alex ];
   "pinwheel/alex.pinwheel-github.com.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-github.com.pub.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-work.age".publicKeys = [ pinwheel alex ];