hosts/tahoe/secrets/secrets.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

let
  root = "age1nxwgdy3p9fft0zsae440wyulknf5rk82s0wnxssrpxu4nezysa4qexcvpl";
  fcuny = "age1keyvdhpspgqp4g5zjthdphau5q5qlt6fs0ex0wqnve66dmup9pzqn4sakj";
  backup = "age1fh4960rdrk4d7m4c5lwd3trvw9ylk09dvucj2gd2udy7d5cz2a0svcqws6";
  all = [ root fcuny backup ];
in
{
  "wireguard_privatekey.age".publicKeys = all;

  "acme/credentials.age".publicKeys = all;
  "acme/gcp_service_account.json.age" = {
    publicKeys = all;
    owner = "acme";
  };

  "syncthing/key.age" = {
    publicKeys = all;
    owner = "fcuny";
  };

  "syncthing/cert.age" = {
    publicKeys = all;
    owner = "fcuny";
  };

  "unifi/unifi-poller.age" = {
    publicKeys = all;
    owner = "unpoller-exporter";
  };

  "gandi/apikey.age" = {
    publicKeys = all;
    owner = "acme";
  };

  "restic/repo-systems.age".publicKeys = all;
  "rsync.net/ssh-key.age".publicKeys = all;
}