shell/gnupg.nix

   1 { inputs, pkgs, lib, config, ... }:
   2 {
   3 gnupg.keys = {
   4 "Julien Moutinho <julm@sourcephile.fr>" = {
   5   uid = "Julien Moutinho <julm@sourcephile.fr>";
   6   algo   = "rsa4096";
   7   expire = "3y";
   8   usage  = ["cert" "sign"];
   9   passPath = "members/julm/gpg/password";
  10   subKeys = [
  11     { algo = "rsa4096"; expire = "3y"; usage = ["sign"]; }
  12     { algo = "rsa4096"; expire = "3y"; usage = ["encrypt"]; }
  13     { algo = "rsa4096"; expire = "3y"; usage = ["auth"]; }
  14   ];
  15   backupRecipients = [""];
  16 };
  17 "Julien Moutinho <julm@mermet>" = {
  18   uid = "Julien Moutinho <julm@mermet>";
  19   algo   = "rsa4096";
  20   expire = "3y";
  21   usage  = ["cert" "sign"];
  22   passPath = "members/julm/gpg/password";
  23   subKeys = [
  24     { algo = "rsa4096"; expire = "3y"; usage = ["sign"]; }
  25     { algo = "rsa4096"; expire = "3y"; usage = ["encrypt"]; }
  26     { algo = "rsa4096"; expire = "3y"; usage = ["auth"]; }
  27   ];
  28   backupRecipients = [""];
  29 };
  30 } // lib.listToAttrs (
  31   let domain = "sourcephile.fr"; in
  32   builtins.map (machine: lib.nameValuePair "root@${machine}.${domain}" {
  33   uid = "root@${machine}.${domain}";
  34   algo = "rsa4096";
  35   expire = "0";
  36   usage = ["cert" "sign"];
  37   passPath = "machines/${machine}/root/key.pass";
  38   subKeys = [
  39     { algo = "rsa4096"; expire = "0"; usage = ["encrypt"]; }
  40   ];
  41   backupRecipients = [""];
  42 }) (builtins.attrNames inputs.self.nixosConfigurations));
  43 }