From a121569f84ac91d380924b42fb66a010b72c6b49 Mon Sep 17 00:00:00 2001 From: Andrea Ciceri Date: Fri, 29 Nov 2024 11:17:45 +0100 Subject: [PATCH] Do not use gpg for ssh keys anymore --- hmModules/gpg/default.nix | 1 - hosts/janeway/default.nix | 1 - lib/default.nix | 1 - modules/ssh-initrd/default.nix | 1 - secrets/secrets.nix | 58 +++++++++++++++------------------- 5 files changed, 26 insertions(+), 36 deletions(-) diff --git a/hmModules/gpg/default.nix b/hmModules/gpg/default.nix index 469c27a..d3aa919 100644 --- a/hmModules/gpg/default.nix +++ b/hmModules/gpg/default.nix @@ -3,7 +3,6 @@ services.gpg-agent = { enable = true; enableSshSupport = true; - sshKeys = [ "CE2FD0D9BECBD8876811714925066CC257413416" ]; extraConfig = let pinentryRofi = pkgs.writeShellApplication { diff --git a/hosts/janeway/default.nix b/hosts/janeway/default.nix index 150e4e0..59733f6 100644 --- a/hosts/janeway/default.nix +++ b/hosts/janeway/default.nix @@ -46,7 +46,6 @@ in $DRY_RUN_CMD echo ${hosts.sisko} >> "${config.user.home}/.ssh/authorized_keys" $DRY_RUN_CMD echo ${hosts.kirk} >> "${config.user.home}/.ssh/authorized_keys" $DRY_RUN_CMD echo ${users.ccr-ssh} >> "${config.user.home}/.ssh/authorized_keys" - $DRY_RUN_CMD echo ${users.ccr-gpg} >> "${config.user.home}/.ssh/authorized_keys" if [[ ! -d "${sshdDirectory}" ]]; then $DRY_RUN_CMD rm $VERBOSE_ARG --recursive --force "${sshdTmpDirectory}" diff --git a/lib/default.nix b/lib/default.nix index 7b98ca0..a923f7d 100644 --- a/lib/default.nix +++ b/lib/default.nix @@ -1,7 +1,6 @@ { keys = { users = { - ccr-gpg = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5cEUx25pnZiH3eBrE2xNbJ92gJiKSznDUNRzcEL4ti6FlJm+75p4q0hgdqHwStR8+uCWBL6viVFCGutOVMFE5MX1Oc3A8fJdR6H9Rrwvk/1UQzqzc9tWxw1qPLKz+fnPDomjOvNofghCWQRwX3Xf1HnIqvRwELpNbR9i+/cHkDGzLJxkstbt4gol8ywMPkw02QdKk8s5MEd1vawxc+7Chs0JPW57RDqDYFErYys52JLeAViCBB9bofF+KT42LuRXKSjWlvCV9kR5TL49vUeBgzMQWMh++WQdN4m9lpqFqYyc75I49/E0HGf8LChDSS+hvRnb5MbtnVGjEA4WDHyldmJCvUNob5CUo4FjoSPRi+S/J3Ads8D4JVwaJOJEVqmMKEhiQ0Hzk4hwe3eV/VumlZj4U/QjaCrqqi4TW/iP0gNRfzcfiM+G/z5R7w1NMUpTX7oilyKjMQmGnXB857D3SSptS7dwh5OiKhVmrQMRCduooUsj236abqLU28K//RnxhOgh8kDGgoUHApnTiMZNKhgLiR42lKrubNcW1tAAqoNyFLMwwXeMLjh0iP1b5y8ntfNPNIcGb7vcwpS24z/aIjW7rQ4J7x5EBphHGhys6ne+irdhOM8c7kFr+c8+Q2oU0YAtFuMYztAFOHm1e20X00Zvys2nuee+hT9F1NungAQ== andrea.ciceri@autistici.org"; ccr-ssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzCmDCtlGscpesHuoiruVWD2IjYEFtaIl9Y2JZGiOAyf3V17KPx0MikcknfmxSHi399SxppiaXQHxo/1wjGxXkXNTTv6h1fBuqwhJE6C8+ZSV+gal81vEnXX+/9w2FQqtVgnG2/mO7oJ0e3FY+6kFpOsGEhYexoGt/UxIpAZoqIN+CWNhJIASUkneaZWtgwiL8Afb59kJQ2E7WbBu+PjYZ/s5lhPobhlkz6s8rkhItvYdiSHT0DPDKvp1oEbxsxd4E4cjJFbahyS8b089NJd9gF5gs0b74H/2lUUymnl63cV37Mp4iXB4rtE69MbjqsGEBKTPumLualmc8pOGBHqWIdhAqGdZQeBajcb6VK0E3hcU0wBB+GJgm7KUzlAHGdC3azY0KlHMrLaZN0pBrgCVR6zBNWtZz2B2qMBZ8Cw+K4vut8GuspdXZscID10U578GxQvJAB9CdxNUtrzSmKX2UtZPB1udWjjIAlejzba4MG73uXgQEdv0NcuHNwaLuCWxTUT5QQF18IwlJ23Mg8aPK8ojUW5A+kGHAu9wtgZVcX1nS5cmYKSgLzcP1LA1l9fTJ1vqBSuy38GTdUzfzz7AbnkRfGPj2ALDgyx17Rc5ommjc1k0gFoeIqiLaxEs5FzDcRyo7YvZXPsGeIqNCYwQWw3+U+yUEJby8bxGb2d/6YQ== andrea.ciceri@autistici.org"; oneplus8t = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO8da1Mf11vXFF0kVDgxocVoGwpHHMEs9emS9T+v8hLb oneplus8t"; hercules-ci-agent = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGPupm00BiveTIYF6CNwuMijF5VvEaPDMjvt+vMlAy+N hercules-ci-agent"; diff --git a/modules/ssh-initrd/default.nix b/modules/ssh-initrd/default.nix index a67e1f3..067f08d 100644 --- a/modules/ssh-initrd/default.nix +++ b/modules/ssh-initrd/default.nix @@ -15,7 +15,6 @@ HostKey /ssh_initrd_host_ed25519_key ''; authorizedKeys = with (import ../../lib).keys; [ - users.ccr-gpg users.ccr-ssh hosts.sisko ]; diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 52a3217..2cebf84 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -6,7 +6,6 @@ with keys.users; { "cachix-personal-token.age".publicKeys = [ ccr-ssh - ccr-gpg mothership kirk sisko @@ -15,90 +14,85 @@ with keys.users; ]; "magit-forge-github-token.age".publicKeys = [ ccr-ssh - ccr-gpg mothership kirk ]; "git-workspace-tokens.age".publicKeys = [ ccr-ssh - ccr-gpg mothership kirk picard ]; "hydra-admin-password.age".publicKeys = [ ccr-ssh - ccr-gpg mothership ]; "hydra-github-token.age".publicKeys = [ ccr-ssh - ccr-gpg mothership ]; "cache-private-key.age".publicKeys = [ ccr-ssh - ccr-gpg mothership ]; "autistici-password.age".publicKeys = [ ccr-ssh - ccr-gpg + kirk picard sisko ]; "hercules-ci-join-token.age".publicKeys = [ ccr-ssh - ccr-gpg + mothership sisko picard ]; "hercules-ci-binary-caches.age".publicKeys = [ ccr-ssh - ccr-gpg + mothership sisko picard ]; "hercules-ci-secrets-json.age".publicKeys = [ ccr-ssh - ccr-gpg + mothership sisko picard ]; "minio-credentials.age".publicKeys = [ ccr-ssh - ccr-gpg + picard sisko ]; "aws-credentials.age".publicKeys = [ ccr-ssh - ccr-gpg + picard sisko ]; "nextcloud-admin-pass.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "home-planimetry.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "home-assistant-token.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "chatgpt-token.age".publicKeys = [ ccr-ssh - ccr-gpg + kirk mothership picard @@ -106,86 +100,86 @@ with keys.users; ]; "cloudflare-dyndns-api-token.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "restic-hetzner-password.age".publicKeys = [ ccr-ssh - ccr-gpg + picard sisko kirk ]; "hass-ssh-key.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "grafana-password.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "matrix-registration-shared-secret.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "matrix-sliding-sync-secret.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "forgejo-runners-token.age".publicKeys = [ ccr-ssh - ccr-gpg + picard ]; "forgejo-nix-access-tokens.age".publicKeys = [ ccr-ssh - ccr-gpg + picard ]; "garmin-collector-environment.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "hetzner-storage-box-sisko-ssh-password.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "sisko-restic-password.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "sisko-attic-environment-file.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; # WireGuard "picard-wireguard-private-key.age".publicKeys = [ ccr-ssh - ccr-gpg + picard ]; "sisko-wireguard-private-key.age".publicKeys = [ ccr-ssh - ccr-gpg + sisko ]; "kirk-wireguard-private-key.age".publicKeys = [ ccr-ssh - ccr-gpg + kirk ]; "deltaflyer-wireguard-private-key.age".publicKeys = [ ccr-ssh - ccr-gpg + deltaflyer ]; }