redo secret mgmt

Author: esselius

flake.lock

@@ -5,16 +5,20 @@
   };
 
   inputs = {
-    dev.url = "github:esselius/dev";
-    dev.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    dev = {
+      url = "github:esselius/dev";
+      inputs.agenix-rekey.url = "github:esselius/agenix-rekey/fixes";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+    agenix-rekey.follows = "dev/agenix-rekey";
 
     nixpkgs.follows = "nixpkgs-unstable";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     nixpkgs-darwin.follows = "nixpkgs-unstable";
     nixpkgs-nixos.url = "github:NixOS/nixpkgs/nixos-24.11";
 
     raspberry-pi-nix.url = "github:tstat/raspberry-pi-nix/v0.4.1";
-    raspberry-pi-nix.inputs.nixpkgs.follows = "nixpkgs";
+    raspberry-pi-nix.inputs.nixpkgs.follows = "nixpkgs-nixos";
     authentik-nix = {
       url = "github:nix-community/authentik-nix/version/2025.2.1";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -126,11 +130,22 @@
             ./nixos-modules/default.nix
             inputs.raspberry-pi-nix.nixosModules.raspberry-pi
             inputs.agenix.nixosModules.default
+            inputs.agenix-rekey.nixosModules.default
             inputs.authentik-nix.nixosModules.default
             {
               _module.args.mkAuthentikScope = inputs.authentik-nix.lib.mkAuthentikScope;
               nixpkgs-path = inputs.nixpkgs-nixos;
               nixpkgs-unstable-path = inputs.nixpkgs-unstable;
+
+              age.rekey = {
+                hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDfILv+PA582KwZYcJRX2yCcQVBlh7T9uWUieLBFXHo/";
+                masterIdentities = [{
+                  identity = "/Users/peteresselius/.age-plugin-se.key";
+                  pubkey = "age1se1qw3jfq82crjk5x36g7wr8pxscvlynwaxpqjt6wran7j23ped4gjsypanfet";
+                }];
+                storageMode = "local";
+                localStorageDir = ./. + "/secrets/rekeyed/adama";
+              };
             }
             inputs.home-manager-nixos.nixosModules.home-manager
             ({ config, ... }: {
@@ -154,10 +169,21 @@
             ./nixos-configurations/starbuck.nix
             ./nixos-modules/default.nix
             inputs.raspberry-pi-nix.nixosModules.raspberry-pi
+            inputs.agenix.nixosModules.default
+            inputs.agenix-rekey.nixosModules.default
             inputs.authentik-nix.nixosModules.default
             {
               nixpkgs-path = inputs.nixpkgs-nixos;
               nixpkgs-unstable-path = inputs.nixpkgs-unstable;
+              age.rekey = {
+                hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFi1DoYv7wvIkYvTrjUVEqZI00H6d5437IgprVdFMI1+";
+                masterIdentities = [{
+                  identity = "/Users/peteresselius/.age-plugin-se.key";
+                  pubkey = "age1se1qw3jfq82crjk5x36g7wr8pxscvlynwaxpqjt6wran7j23ped4gjsypanfet";
+                }];
+                storageMode = "local";
+                localStorageDir = ./. + "/secrets/rekeyed/starbuck";
+              };
             }
             inputs.home-manager-nixos.nixosModules.home-manager
             ({ config, ... }: {

flake.nix

@@ -1,10 +1,11 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 
 {
   programs.git = {
     enable = true;
 
     userName = "Peter Esselius";
+    userEmail = lib.mkDefault "[email protected]";
 
     aliases = {
       l = "log --graph --decorate --pretty=format:\"%C(yellow)%h%C(reset)%C(auto)%d%C(reset) %s %C(yellow)(%C(cyan)%ar%C(yellow), %C(blue)%an%C(yellow))%C(reset)\"";

home-modules/git.nix

@@ -42,11 +42,11 @@
   ];
 
   age.secrets = {
-    grafana-env.file = ../secrets/grafana-env.age;
-    authentik-env.file = ../secrets/authentik-env.age;
+    grafana-env.rekeyFile = ../secrets/grafana-env.age;
+    authentik-env.rekeyFile = ../secrets/authentik-env.age;
     z2m = {
       name = "z2m.yaml";
-      file = ../secrets/z2m.age;
+      rekeyFile = ../secrets/z2m.age;
       owner = "zigbee2mqtt";
       group = "zigbee2mqtt";
     };

nixos-configurations/adama.nix

@@ -1,7 +1,7 @@
 { config, ... }:
 
 {
-  age.secrets.step-ca.file = ../secrets/step-ca.age;
+  age.secrets.step-ca.rekeyFile = ../secrets/step-ca.age;
 
   services.step-ca = {
     enable = true;

nixos-modules/ca.nix

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 cHttuw 4N7ofBvAsVMFCQy2ds+NI4i29kchQbEbcNab1aKmfjo
+AHDORl1WRPSipt5bwowUzTHtZ5efQC55W8m5jZimXV0
+-> EP!-grease
+pJOR
+--- lFUYLqlTEP1O36SdfZtjoZp6Yb4cVba2HrZWLdpn9fY
+G��#mrV]
+UZ�RM$�z�Jm�>���Sb� ��ЦZ]����ܡ��ɪ�V�X{�5� ���.