secrets: move the actual secrets with hosts config

Having the secrets closer to the host is easier to manage. At the moment
I don't have secrets that are shared across multiple hosts, so that's an
OK approach.

11 files changed, 56 insertions, 13 deletions

diff --git a/hosts/aptos/secrets/secrets.nix b/hosts/aptos/secrets/secrets.nix
new file mode 100644
index 0000000..28c4078
--- /dev/null
+++ b/hosts/aptos/secrets/secrets.nix
@@ -0,0 +1,4 @@
+let
+  aptos =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIdlm/qoR/dnMjZhVSTtqFzkgN3Yf9eQ3pgKMiipg+dl";
+in { "wireguard_privatekey.age".publicKeys = [ aptos ]; }
diff --git a/modules/secrets/network/aptos/wireguard_privatekey.age b/hosts/aptos/secrets/wireguard_privatekey.age
index 2f6edf3..2f6edf3 100644
--- a/modules/secrets/network/aptos/wireguard_privatekey.age
+++ b/hosts/aptos/secrets/wireguard_privatekey.age
Binary files differdiff --git a/hosts/tahoe/secrets/rclone/config.ini.age b/hosts/tahoe/secrets/rclone/config.ini.age
new file mode 100644
index 0000000..a017b29
--- /dev/null
+++ b/hosts/tahoe/secrets/rclone/config.ini.age
Binary files differdiff --git a/hosts/tahoe/secrets/rclone/gcs_service_account.json.age b/hosts/tahoe/secrets/rclone/gcs_service_account.json.age
new file mode 100644
index 0000000..982dd30
--- /dev/null
+++ b/hosts/tahoe/secrets/rclone/gcs_service_account.json.age
Binary files differdiff --git a/hosts/tahoe/secrets/restic/repo-systems.age b/hosts/tahoe/secrets/restic/repo-systems.age
new file mode 100644
index 0000000..79363e6
--- /dev/null
+++ b/hosts/tahoe/secrets/restic/repo-systems.age
@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 wtownA Rv+TIuyxDf6bsdVH4W1inxwvbTNPAoIfBGDLQvyhaV0
+qZ6JAZq5P0WGdCLJ5scQl+mlOJ3fwkwMtlEEB1wIMlc
+-> ssh-ed25519 +LF+iw TqTfv9yx+6yOExJ151o03d0VsWQ8jm5KQW1XmmYoqlY
+AeXv4e1APSIgoPR7Ty0ysrC/fowp7ACA6+nKqsrFFks
+-> ssh-ed25519 dtgBNg giDZ+PMXQd98UsIrGM4bqSOBWEK071PuVcd326imbB8
+AplnAox8y+b34fC0vlshoh6KCfhJP9LPGyfF4o2cUCo
+-> 6o>-grease )}i\s<hC Qhde N p4=H
+kTdnW/JPzgMexPznHQWhH0hXgwgxCxJCTePD1HYTEeebXic3FL0/CNJ2sjcrl/y+
+5XdlBPc
+--- fn55JPZabkZRlf7DsIw7O46mis6C6fIqx5KEpTyXwak
+���H7'�\��̹����_��O��ؙ��Y��[&��� �n.L�T{��"
\ No newline at end of file
diff --git a/hosts/tahoe/secrets/secrets.nix b/hosts/tahoe/secrets/secrets.nix
new file mode 100644
index 0000000..d6b7272
--- /dev/null
+++ b/hosts/tahoe/secrets/secrets.nix
@@ -0,0 +1,14 @@
+let
+  fcuny_aptos =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIdlm/qoR/dnMjZhVSTtqFzkgN3Yf9eQ3pgKMiipg+dl";
+in {
+  "wireguard_privatekey.age".publicKeys = [ fcuny_aptos ];
+
+  "traefik/gcp_service_account.json.age".publicKeys = [ fcuny_aptos ];
+
+  "unifi/unifi-poller.age".publicKeys = [ fcuny_aptos ];
+
+  "restic/repo-systems.age".publicKeys = [ fcuny_aptos ];
+  "rclone/config.ini.age".publicKeys = [ fcuny_aptos ];
+  "rclone/gcs_service_account.json.age".publicKeys = [ fcuny_aptos ];
+}
diff --git a/hosts/tahoe/secrets/traefik/gcp_service_account.json.age b/hosts/tahoe/secrets/traefik/gcp_service_account.json.age
new file mode 100644
index 0000000..0f99905
--- /dev/null
+++ b/hosts/tahoe/secrets/traefik/gcp_service_account.json.age
Binary files differdiff --git a/hosts/tahoe/secrets/unifi/unifi-poller.age b/hosts/tahoe/secrets/unifi/unifi-poller.age
new file mode 100644
index 0000000..bd71926
--- /dev/null
+++ b/hosts/tahoe/secrets/unifi/unifi-poller.age
@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-ed25519 wtownA 0VcUc7jKvTUSaSN8mj5DavrRh5OOu9tmlESZTZM1vy0
+YLbthCfZpcqKlUj0SKEvaczL1bWepXo6pTpurP4pyRU
+-> ssh-ed25519 +LF+iw L+QyJtlQS7KGsWafQRTSfWbX13pb8Vl0skQsX+yVNjo
+7hhNe1E3ctyLCfYjSHH9RuB220x368Ut312Ql+0E8MM
+-> ssh-ed25519 dtgBNg h0M/tnUsWja+Y+06eBnKJYcLBX5RSRn19B+idfnTtGs
+To6JQ/h7ag1H+xLkC4/tWnWGf0cjvq6NGBPqNeqExAU
+-> #qx-grease ie.h
+gEn12esIeUQ7g/SwgEiw3TH1Mqd3IZ/iyn+OJt16UIIUCi3ox7MgDLyS8ngicmOj
+idBj8DS72toie9iG5rt9IDzV
+--- 9jnTt5KR/MIJfT9s6gLP4cgqFZD2W0UQf4FF8HOBPX4
+�n,�0c���C]�KfNYp��R�n�uI�j
+_{/k���
\ No newline at end of file
diff --git a/hosts/tahoe/secrets/wireguard_privatekey.age b/hosts/tahoe/secrets/wireguard_privatekey.age
new file mode 100644
index 0000000..4304cfe
--- /dev/null
+++ b/hosts/tahoe/secrets/wireguard_privatekey.age
Binary files differdiff --git a/lib/private-wireguard.nix b/lib/private-wireguard.nix
index d77c7dd..706dfd8 100644
--- a/lib/private-wireguard.nix
+++ b/lib/private-wireguard.nix
@@ -19,8 +19,7 @@ in {
     networking = {
       wireguard.interfaces.wg0 = {
         listenPort = port;
-        privateKeyFile =
-          secrets."network/${config.networking.hostName}/wireguard_privatekey".path;
+        privateKeyFile = secrets."wireguard_privatekey".path;
         ips = [
           "${wgcfg.subnet4}.${toString thisPeer.ipv4}/${toString wgcfg.mask4}"
         ];
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
index 556bf32..20dbfd2 100644
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -1,22 +1,23 @@
 { config, inputs, lib, options, ... }:
-with builtins; {
+with builtins;
+with lib;
+let
+  secretsDir = "${toString ../../hosts}/${config.networking.hostName}/secrets";
+  secretsFile = "${secretsDir}/secrets.nix";
+in {
   imports = [ inputs.agenix.nixosModules.age ];
 
   config.age = {
     secrets = let
-      toName = lib.removeSuffix ".age";
       userExists = u: builtins.hasAttr u config.users.users;
       # Only set the user if it exists, to avoid warnings
       userIfExists = u: if userExists u then u else "root";
-      toSecret = name:
-        { owner ? "root", ... }: {
-          file = ./. + "/${name}";
-          owner = lib.mkDefault (userIfExists owner);
-        };
-      convertSecrets = n: v: lib.nameValuePair (toName n) (toSecret n v);
-      secrets = import ./secrets.nix;
-    in lib.mapAttrs' convertSecrets secrets;
-
+    in if pathExists secretsFile then
+      mapAttrs' (n: _:
+        nameValuePair (removeSuffix ".age" n) { file = "${secretsDir}/${n}"; })
+      (import secretsFile)
+    else
+      { };
     identityPaths = options.age.identityPaths.default ++ (filter pathExists
       [ "${config.users.users.fcuny.home}/.ssh/id_ed25519" ]);
   };