Trolli Schmittlauch
fe50bf0b58
I've decided to just create some ssh host keys via `sudo ssh-keygen -A` to make the key management parallel to linux hosts.
24 lines
1 KiB
YAML
24 lines
1 KiB
YAML
# XXX: missing: thinknix?, at some point mobile
|
|
# XXX: consider key groups
|
|
keys:
|
|
- &admin_framenix age1q80zzsgglj438verw74jghezn8ndpqldvg0mfxzwtaq4v5h7apusqysavz #framenix
|
|
- &admin_workmac age1fft2ynhazjwtjmxsvt37qervtekktdln2968gjp4vcp5sp3jeg5segkz3x #workmac
|
|
# Generate AGE keys from SSH keys with:
|
|
# nix-shell -p ssh-to-age --run 'ssh some.example.com cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
|
|
- &machine_framenix age1kx93vp8l8jd6kz0kvk379udr5z8a9t6946w0ff5t9a2esn47nqzqlfzvwe
|
|
- &machine_workmac age1rpygw5lkhc0a5hq8fuhjzy57ls7pn5u76097z6g2p4nmlctl8pvsxrztd8
|
|
creation_rules:
|
|
# per-host secrets for host specific ones, but for service modules we could store and manage them also per module scope
|
|
- path_regex: hosts/framenix/secrets\.(yaml|json|env|ini)$
|
|
key_groups:
|
|
- age:
|
|
- *admin_framenix
|
|
- *machine_framenix
|
|
- path_regex: common/secrets\.(yaml|json|env|ini)$
|
|
key_groups:
|
|
- age:
|
|
- *admin_framenix
|
|
- *admin_workmac
|
|
- *machine_workmac
|
|
- *machine_framenix
|
|
|