From 92bbe4d059bc7f9439878c8123fddf03e841d97b Mon Sep 17 00:00:00 2001
From: Tyler Starr <starrtyler88@gmail.com>
Date: Sun, 21 Jul 2024 11:52:02 -0700
Subject: [PATCH] first agenix key setup

---
 home/private_dot_ssh/config                   |   2 +-
 home/private_dot_ssh/keys/.placeholder        |   0
 provision/age-secrets/git/github_personal.age | Bin 0 -> 786 bytes
 provision/age-secrets/secrets.nix             |  10 ++
 provision/flake.lock                          | 114 ++++++++++++++++--
 provision/flake.nix                           |   7 +-
 provision/modules/system/secrets.nix          |  13 +-
 7 files changed, 133 insertions(+), 13 deletions(-)
 delete mode 100644 home/private_dot_ssh/keys/.placeholder
 create mode 100644 provision/age-secrets/git/github_personal.age
 create mode 100644 provision/age-secrets/secrets.nix

diff --git a/home/private_dot_ssh/config b/home/private_dot_ssh/config
index 4e69cc6c..627802f2 100644
--- a/home/private_dot_ssh/config
+++ b/home/private_dot_ssh/config
@@ -1,3 +1,3 @@
 Host github.com
   AddKeysToAgent yes
-  IdentityFile ~/.ssh/keys/github_personal 
+  IdentityFile /run/agenix/git/github_personal 
diff --git a/home/private_dot_ssh/keys/.placeholder b/home/private_dot_ssh/keys/.placeholder
deleted file mode 100644
index e69de29b..00000000
diff --git a/provision/age-secrets/git/github_personal.age b/provision/age-secrets/git/github_personal.age
new file mode 100644
index 0000000000000000000000000000000000000000..6f50d08a245fc2b881ce1d16266376ffeda1d75c
GIT binary patch
literal 786
zcmV+t1MU1_XJsvAZewzJaCB*JZZ2<fXD@a!3N1b$b8~1dWn?lnH8D9LV=r<qFi{|G
zO+z?pVo75#XEtXsSyo13ZdY1WdQC%hM00gUW-mx~a5Y0~N_aLaS6K>6LsB$Ub!TQ)
zWHMGtLUA=_VRJE1W=c_cVoYIEFkx^^D{fP3VJ~54SYrw;J|J^*Xf0)AGBq_ZIUq)Q
zFLP0MAT@F_cXx9uR(3@~N-#%CNltDub~Q9*W@>41G%;FZWLR!(FLqUTQ&UuT3Uhfy
zVnZ@bR7^H$MPe^PcWF*UFGDY4NlH0pMQ$)rVL5hHFh@*5WKB|Y3N0-yATMoKXktY)
zQD=5&S2-_kc27cdVl!uTPFihmFk(ztD@0d9D{xb5d1NtB3OD2|9wTVGPH=rLCC21h
zEn~VHrXUtOX7&+NC3_^T^;7(Tr!8SNQ<34`7Yg=jA+NB8HHZ|;V>Q_m$0RcB684b<
z=@_Ye+pu;hAwH0NJ9Sk9>wF}2i{@cpJ>>ZsGY@cX3gN(5)nW~~-lkH4(DkkcO6qk#
z8`ZB#tZ6#ud-8k49wtUbr7iwhJ+Uumg9$dV<$xH#zT+ko#kWm70dW^_dZpdtok<XW
zkMc|d#S1lry@Qo@5sg(U;cgFnI#W9Kp^b#>YlnyY;3(HW9#7?%4lpL8P5@)ZE^g2c
zHBdzSx7(e^p^0jN)KYE<1z91FZ;85x0>b0FQDtOdBRr*b$@}?#Q%QA71}!fQqvVv>
zU(GtYW-ro%+fR-2@$=`{KQRhMHGQQ`6U{J+5?5e_YC_@E>Tz#dnt?62G*c9v;n(wu
zW@#9Td5qkZW)Zwe-;8$=&yiu-u4Ord%pV^2V}MGOOcjs)o!Vqf0`-PwC6nnH;CxYY
zM{I!G1<GU4wdV$pYY4!1%+9G{^q$LQTT=eKTGiw9iqGhp)e)FBBQM%L7$?9|aEM^V
zaXGIgmHzbRiuXYi!2)2&X+@K34O3)7J`v#*8Bbz+-M+PWV8DiEe<8O%V*m-+Qsyn+
QUmC~cji?9cW%!Ju0LQdRH~;_u

literal 0
HcmV?d00001

diff --git a/provision/age-secrets/secrets.nix b/provision/age-secrets/secrets.nix
new file mode 100644
index 00000000..c816a817
--- /dev/null
+++ b/provision/age-secrets/secrets.nix
@@ -0,0 +1,10 @@
+let
+  kestrel = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM2iE16XVkriD0x6GhnqmvGDA1qNBibvHVIi5xY+c7Iu";
+  systems = [ kestrel ];
+
+  tstarr_kestrel = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINr2BUUToMswbAbxZMXarl2pQEomM+jADyZbEK31VGu/";
+  users = [ tstarr_kestrel ];
+in
+{
+  "git/github_personal.age".publicKeys = users ++ systems;
+}
diff --git a/provision/flake.lock b/provision/flake.lock
index ae2e2416..62494f70 100644
--- a/provision/flake.lock
+++ b/provision/flake.lock
@@ -1,6 +1,70 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs",
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1720546205,
+        "narHash": "sha256-boCXsjYVxDviyzoEyAk624600f3ZBo/DKtUdvMTpbGY=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "de96bd907d5fbc3b14fc33ad37d1b9a3cb15edc6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1703113217,
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -55,8 +119,8 @@
         "hyprlang": "hyprlang",
         "hyprutils": "hyprutils",
         "hyprwayland-scanner": "hyprwayland-scanner",
-        "nixpkgs": "nixpkgs",
-        "systems": "systems",
+        "nixpkgs": "nixpkgs_2",
+        "systems": "systems_2",
         "xdph": "xdph"
       },
       "locked": {
@@ -218,11 +282,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1719075281,
-        "narHash": "sha256-CyyxvOwFf12I91PBWz43iGT1kjsf5oi6ax7CrvaMyAo=",
+        "lastModified": 1703013332,
+        "narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a71e967ef3694799d0c418c98332f7ff4cc5f6af",
+        "rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
         "type": "github"
       },
       "original": {
@@ -249,6 +313,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1719075281,
+        "narHash": "sha256-CyyxvOwFf12I91PBWz43iGT1kjsf5oi6ax7CrvaMyAo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a71e967ef3694799d0c418c98332f7ff4cc5f6af",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1720031269,
         "narHash": "sha256-rwz8NJZV+387rnWpTYcXaRNvzUSnnF9aHONoJIYmiUQ=",
@@ -264,7 +344,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1719468428,
         "narHash": "sha256-vN5xJAZ4UGREEglh3lfbbkIj+MPEYMuqewMn4atZFaQ=",
@@ -282,17 +362,18 @@
     },
     "root": {
       "inputs": {
-        "home-manager": "home-manager",
+        "agenix": "agenix",
+        "home-manager": "home-manager_2",
         "hyprland": "hyprland",
         "hyprland-contrib": "hyprland-contrib",
         "jovian-nixos": "jovian-nixos",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "sops-nix": "sops-nix"
       }
     },
     "sops-nix": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4",
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
@@ -310,6 +391,21 @@
       }
     },
     "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
       "locked": {
         "lastModified": 1689347949,
         "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
diff --git a/provision/flake.nix b/provision/flake.nix
index b3ee1741..cfb36b44 100644
--- a/provision/flake.nix
+++ b/provision/flake.nix
@@ -12,6 +12,7 @@
       flake = false;
     };
     sops-nix.url = "github:Mic92/sops-nix";
+    agenix.url = "github:ryantm/agenix";
     hyprland.url = "github:hyprwm/Hyprland";
     hyprland-contrib = {
         url = "github:hyprwm/contrib";
@@ -19,7 +20,7 @@
     };
   };
 
-  outputs = inputs @ { self, nixpkgs, home-manager, jovian-nixos, sops-nix, hyprland, ... }:
+  outputs = inputs @ { self, nixpkgs, home-manager, jovian-nixos, sops-nix, agenix,hyprland, ... }:
     let
       system = "x86_64-linux";
       pkgs = import nixpkgs {
@@ -37,6 +38,7 @@
             ./hosts/kestrel/configuration.nix
             ./hosts/kestrel/hardware.nix
             sops-nix.nixosModules.sops
+            agenix.nixosModules.default
             home-manager.nixosModules.home-manager {
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
@@ -59,6 +61,7 @@
             ./hosts/shivan/configuration.nix
             ./hosts/shivan/hardware.nix
             sops-nix.nixosModules.sops
+            agenix.nixosModules.default
             home-manager.nixosModules.home-manager {
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
@@ -81,6 +84,7 @@
             ./hosts/torus/configuration.nix
             ./hosts/torus/hardware.nix
             sops-nix.nixosModules.sops
+            agenix.nixosModules.default
             home-manager.nixosModules.home-manager {
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
@@ -103,6 +107,7 @@
             ./hosts/bulwark/configuration.nix
             ./hosts/bulwark/hardware.nix
             sops-nix.nixosModules.sops
+            agenix.nixosModules.default
             home-manager.nixosModules.home-manager {
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
diff --git a/provision/modules/system/secrets.nix b/provision/modules/system/secrets.nix
index f9a3b1ab..73dc0490 100644
--- a/provision/modules/system/secrets.nix
+++ b/provision/modules/system/secrets.nix
@@ -1,11 +1,20 @@
-{ config, lib, pkgs, user, ... }:
+{ config, lib, pkgs, user, inputs, ... }:
 
 let cfg = config.modules.system.secrets;
 in {
   options.modules.system.secrets.enable = lib.mkEnableOption "secrets";
   config = lib.mkIf cfg.enable {
+     
+    environment.systemPackages = [
+      inputs.agenix.packages.x86_64-linux.default 
+    ];
     
-    
+    age.secrets."git/github_personal" = {
+      file = ../../age-secrets/git/github_personal.age;
+      owner = "${user}";
+      group = "users";
+    };
+
     sops = let
       ncHost = (if config.networking.hostName == "torus" then "nextcloud" else "${user}");
     in {