refactor: move host-specific secrets to host dirs

8 files changed, 34 insertions, 15 deletions

diff --git a/nixos/hosts/ev/miniflux.nix b/nixos/hosts/ev/miniflux.nix
index 5bf1ccd..73bdf98 100644
--- a/nixos/hosts/ev/miniflux.nix
+++ b/nixos/hosts/ev/miniflux.nix
@@ -11,7 +11,7 @@ in
   };
 
   config = {
-    age.secrets.miniflux-admin.file = <top/secrets/miniflux-admin.age>;
+    age.secrets.miniflux-admin.file = ./secrets/miniflux-admin.age;
 
     services.miniflux = {
       enable = true;
diff --git a/nixos/secrets/miniflux-admin.age b/nixos/hosts/ev/secrets/miniflux-admin.age
index b656b07..b656b07 100644
--- a/nixos/secrets/miniflux-admin.age
+++ b/nixos/hosts/ev/secrets/miniflux-admin.age
diff --git a/nixos/hosts/tente/grafana.nix b/nixos/hosts/tente/grafana.nix
index f7c8789..a2ea9b9 100644
--- a/nixos/hosts/tente/grafana.nix
+++ b/nixos/hosts/tente/grafana.nix
@@ -26,7 +26,7 @@ in
   ];
 
   config = {
-    age.secrets.grafana-matrix-forwarder-env.file = <top/secrets/grafana-matrix-forwarder-env.age>;
+    age.secrets.grafana-matrix-forwarder-env.file = ./secrets/grafana-matrix-forwarder-env.age;
 
     services.grafana = {
       enable = true;
diff --git a/nixos/secrets/grafana-matrix-forwarder-env.age b/nixos/hosts/tente/secrets/grafana-matrix-forwarder-env.age
index 84cab14..84cab14 100644
--- a/nixos/secrets/grafana-matrix-forwarder-env.age
+++ b/nixos/hosts/tente/secrets/grafana-matrix-forwarder-env.age
diff --git a/nixos/secrets.nix b/nixos/secrets.nix
new file mode 100644
index 0000000..f44defe
--- /dev/null
+++ b/nixos/secrets.nix
@@ -0,0 +1,31 @@
+let
+  admins = [
+    # martin
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+moAzcnDJsyUalRVdLeJS1D5wezwMDyHuM+Cyk1nQh"
+  ];
+
+  hosts = {
+    hamac = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmjbC0gk2s/qDQ+QR//GJH0ZPld99L0EtX7dPP5h2RN";
+    ev = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINCSypbTOnAYBO32vUUieOsb6ws32gCsDg8nB8JhuFuI";
+    tente = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGTyZdGXxkAjzRulRFB23AX0T/lVLZOaSaFJi+thsjgx";
+  };
+
+  hostSpecific = host:
+    let
+      hostSecrets = "hosts/${host}/secrets";
+      files = builtins.attrNames (builtins.readDir ./${hostSecrets});
+    in
+    builtins.listToAttrs (
+      map (f: {
+        name = "${hostSecrets}/${f}";
+        value = {
+          publicKeys = [hosts.${host}] ++ admins;
+        };
+      }) files
+    );
+in
+{
+  "shared/secrets/vpn-se-privKey.age".publicKeys = [hosts.hamac hosts.ev] ++ admins;
+}
+// hostSpecific "ev"
+// hostSpecific "tente"
diff --git a/nixos/secrets/secrets.nix b/nixos/secrets/secrets.nix
deleted file mode 100644
index f1c8ab8..0000000
--- a/nixos/secrets/secrets.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-let
-  martin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+moAzcnDJsyUalRVdLeJS1D5wezwMDyHuM+Cyk1nQh";
-
-  hamac = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmjbC0gk2s/qDQ+QR//GJH0ZPld99L0EtX7dPP5h2RN";
-  ev = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINCSypbTOnAYBO32vUUieOsb6ws32gCsDg8nB8JhuFuI";
-  tente = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGTyZdGXxkAjzRulRFB23AX0T/lVLZOaSaFJi+thsjgx";
-in
-{
-  "vpn-se-privKey.age".publicKeys = [ martin hamac ev ];
-  "grafana-matrix-forwarder-env.age".publicKeys = [ martin tente ];
-  "miniflux-admin.age".publicKeys = [ martin ev ];
-}
diff --git a/nixos/secrets/vpn-se-privKey.age b/nixos/shared/secrets/vpn-se-privKey.age
index ca2a8eb..ca2a8eb 100644
--- a/nixos/secrets/vpn-se-privKey.age
+++ b/nixos/shared/secrets/vpn-se-privKey.age
diff --git a/nixos/shared/vpn.nix b/nixos/shared/vpn.nix
index 9cbcf45..4015edb 100644
--- a/nixos/shared/vpn.nix
+++ b/nixos/shared/vpn.nix
@@ -1,7 +1,7 @@
 { config, pkgs, ... }:
 
 {
-  age.secrets.vpn-se-privKey.file = ../secrets/vpn-se-privKey.age;
+  age.secrets.vpn-se-privKey.file = ./secrets/vpn-se-privKey.age;
 
   # We're creating the wireguard interfaces in network namespaces so that
   # we can use them on demand: