| 1 | let |
| 2 | keys = import ../keys.nix; |
| 3 | |
| 4 | secrets = with keys.ssh.machines; { |
| 5 | alertmanager-matrix-forwarder = [ pluto ]; |
| 6 | alertmanager-oauth2-proxy-env = [ pluto ]; |
| 7 | elasticsearch-exporter-env = [ pluto ]; |
| 8 | fastly-exporter-env = [ pluto ]; |
| 9 | grafana-secret-key = [ pluto ]; |
| 10 | hydra-aws-credentials = [ mimas ]; |
| 11 | hydra-github-client-secret = [ mimas ]; |
| 12 | hydra-mirror-aws-credentials = [ pluto ]; |
| 13 | hydra-mirror-git-credentials = [ pluto ]; |
| 14 | owncast-admin-password = [ pluto ]; |
| 15 | pluto-backup-secret = [ pluto ]; |
| 16 | pluto-backup-ssh-key = [ pluto ]; |
| 17 | rfc39-credentials = [ pluto ]; |
| 18 | rfc39-github = [ pluto ]; |
| 19 | rfc39-record-push = [ pluto ]; |
| 20 | storagebox-exporter-token = [ pluto ]; |
| 21 | tarball-mirror-aws-credentials = [ pluto ]; |
| 22 | zrepl-ssh-key = [ |
| 23 | titan |
| 24 | mimas |
| 25 | ]; |
| 26 | |
| 27 | # builders/ |
| 28 | elated-minsky-queue-runner-token = [ |
| 29 | mimas |
| 30 | elated-minsky |
| 31 | ]; |
| 32 | goofy-hopcroft-queue-runner-token = [ |
| 33 | mimas |
| 34 | goofy-hopcroft |
| 35 | ]; |
| 36 | hopeful-rivest-queue-runner-token = [ |
| 37 | mimas |
| 38 | hopeful-rivest |
| 39 | ]; |
| 40 | sleepy-brown-queue-runner-token = [ |
| 41 | mimas |
| 42 | sleepy-brown |
| 43 | ]; |
| 44 | |
| 45 | # macs/ |
| 46 | eager-heisenberg-queue-runner-token = [ |
| 47 | mimas |
| 48 | eager-heisenberg |
| 49 | ]; |
| 50 | enormous-catfish-queue-runner-token = [ |
| 51 | mimas |
| 52 | enormous-catfish |
| 53 | ]; |
| 54 | growing-jennet-queue-runner-token = [ |
| 55 | mimas |
| 56 | growing-jennet |
| 57 | ]; |
| 58 | intense-heron-queue-runner-token = [ |
| 59 | mimas |
| 60 | intense-heron |
| 61 | ]; |
| 62 | kind-lumiere-queue-runner-token = [ |
| 63 | mimas |
| 64 | kind-lumiere |
| 65 | ]; |
| 66 | maximum-snail-queue-runner-token = [ |
| 67 | mimas |
| 68 | maximum-snail |
| 69 | ]; |
| 70 | norwegian-blue-queue-runner-token = [ |
| 71 | mimas |
| 72 | norwegian-blue |
| 73 | ]; |
| 74 | sweeping-filly-queue-runner-token = [ |
| 75 | mimas |
| 76 | sweeping-filly |
| 77 | ]; |
| 78 | }; |
| 79 | |
| 80 | # Not all SSH key types support encryption |
| 81 | filterUnsupportedKeys = |
| 82 | keys: |
| 83 | builtins.filter ( |
| 84 | key: |
| 85 | let |
| 86 | # tokenize ssh key |
| 87 | parts = builtins.split "[[:space:]]+" key; |
| 88 | |
| 89 | # first token is the key type |
| 90 | keyType = builtins.elemAt parts 0; |
| 91 | in |
| 92 | # filter out unsupported key types |
| 93 | !(builtins.elem keyType [ |
| 94 | # sk-* keys cannot do encryption or key derivation |
| 95 | # https://github.com/FiloSottile/age/issues/537#issuecomment-1907361675 |
| 96 | # https://github.com/str4d/rage/issues/272#issuecomment-970193691 |
| 97 | "sk-ssh-ed25519@openssh.com" |
| 98 | # "not worth implementing" |
| 99 | # https://github.com/FiloSottile/age/issues/142#issuecomment-1001161195 |
| 100 | "ecdsa-sha2-nistp256" |
| 101 | ]) |
| 102 | ) keys; |
| 103 | |
| 104 | in |
| 105 | builtins.listToAttrs ( |
| 106 | map (secretName: { |
| 107 | name = "secrets/${secretName}.age"; |
| 108 | value.publicKeys = secrets."${secretName}" ++ (filterUnsupportedKeys keys.age.groups.infra-core); |
| 109 | }) (builtins.attrNames secrets) |
| 110 | ) |