]> Git — Sourcephile - sourcephile-nix.git/blob - shell/gnupg.nix
gnupg: create remaining servers' key
[sourcephile-nix.git] / shell / gnupg.nix
1 { pkgs, lib, config, ... }:
2 {
3 gnupg.keys = {
4 "Julien Moutinho <julm@sourcephile.fr>" = {
5 uid = "Julien Moutinho <julm@sourcephile.fr>";
6 algo = "rsa4096";
7 expire = "3y";
8 usage = ["cert" "sign"];
9 passPath = "members/julm/gpg/password";
10 subKeys = [
11 { algo = "rsa4096"; expire = "3y"; usage = ["sign"]; }
12 { algo = "rsa4096"; expire = "3y"; usage = ["encrypt"]; }
13 { algo = "rsa4096"; expire = "3y"; usage = ["auth"]; }
14 ];
15 backupRecipients = [""];
16 };
17 "Julien Moutinho <julm@mermet>" = {
18 uid = "Julien Moutinho <julm@mermet>";
19 algo = "rsa4096";
20 expire = "3y";
21 usage = ["cert" "sign"];
22 passPath = "members/julm/gpg/password";
23 subKeys = [
24 { algo = "rsa4096"; expire = "3y"; usage = ["sign"]; }
25 { algo = "rsa4096"; expire = "3y"; usage = ["encrypt"]; }
26 { algo = "rsa4096"; expire = "3y"; usage = ["auth"]; }
27 ];
28 backupRecipients = [""];
29 };
30 } // lib.listToAttrs (builtins.map (srv: lib.nameValuePair "root@${srv}.sourcephile.fr" {
31 uid = "root@${srv}.sourcephile.fr";
32 algo = "rsa4096";
33 expire = "0";
34 usage = ["cert" "sign"];
35 passPath = "servers/${srv}/root/key.pass";
36 subKeys = [
37 { algo = "rsa4096"; expire = "0"; usage = ["encrypt"]; }
38 ];
39 backupRecipients = [""];
40 # This encrypt subkey is put into a root/key.gpg, and then on the Nix stores,
41 # to decrypt servers."${srv}".config.security.pass.secrets .
42 # Its passphrase in root/key.pass is decrypted and sent by ssh before each call to nix copy
43 # by adding to servers."${srv}".config.install.nixos-ssh.script .
44 postRun = ''
45 info " generate $PASSWORD_STORE_DIR/servers/${srv}/root/key.gpg"
46 test -s "$PASSWORD_STORE_DIR/servers/${srv}/root/key.gpg" || {
47 ${pkgs.gnupg}/bin/gpg --batch --pinentry-mode loopback --export-secret-keys --armor \
48 --passphrase-fd 3 3< <(${pkgs.gnupg}/bin/gpg --decrypt "$PASSWORD_STORE_DIR/servers/${srv}/root/key.pass.gpg") \
49 --export-options export-minimal @root@${srv}.sourcephile.fr |
50 ${pkgs.gnupg}/bin/gpg --symmetric --batch --pinentry-mode loopback \
51 --passphrase-fd 3 3< <(${pkgs.gnupg}/bin/gpg --decrypt "$PASSWORD_STORE_DIR/servers/${srv}/root/key.pass.gpg") \
52 --output "$PASSWORD_STORE_DIR/servers/${srv}/root/key.gpg"
53 }
54 '';
55 }) (builtins.attrNames (import ../servers.nix)));
56 }