shell/gnupg.nix

   1 { pkgs, lib, config, ... }:
   2 {
   3 gnupg.keys = {
   4 "Julien Moutinho <julm@sourcephile.fr>" = {
   5   uid = "Julien Moutinho <julm@sourcephile.fr>";
   6   algo   = "rsa4096";
   7   expire = "3y";
   8   usage  = ["cert" "sign"];
   9   passPath = "members/julm/gpg/password";
  10   subKeys = [
  11     { algo = "rsa4096"; expire = "3y"; usage = ["sign"]; }
  12     { algo = "rsa4096"; expire = "3y"; usage = ["encrypt"]; }
  13     { algo = "rsa4096"; expire = "3y"; usage = ["auth"]; }
  14   ];
  15   backupRecipients = [""];
  16 };
  17 "Julien Moutinho <julm@mermet>" = {
  18   uid = "Julien Moutinho <julm@mermet>";
  19   algo   = "rsa4096";
  20   expire = "3y";
  21   usage  = ["cert" "sign"];
  22   passPath = "members/julm/gpg/password";
  23   subKeys = [
  24     { algo = "rsa4096"; expire = "3y"; usage = ["sign"]; }
  25     { algo = "rsa4096"; expire = "3y"; usage = ["encrypt"]; }
  26     { algo = "rsa4096"; expire = "3y"; usage = ["auth"]; }
  27   ];
  28   backupRecipients = [""];
  29 };
  30 } // lib.listToAttrs (builtins.map (srv: lib.nameValuePair "root@${srv}.sourcephile.fr" {
  31   uid = "root@${srv}.sourcephile.fr";
  32   algo   = "rsa4096";
  33   expire = "0";
  34   usage  = ["cert" "sign"];
  35   passPath = "servers/${srv}/root/key.pass";
  36   subKeys = [
  37     { algo = "rsa4096"; expire = "0"; usage = ["encrypt"]; }
  38   ];
  39   backupRecipients = [""];
  40   # This encrypt subkey is put into a root/key.gpg, and then on the Nix stores,
  41   # to decrypt servers."${srv}".config.security.pass.secrets .
  42   # Its passphrase in root/key.pass is decrypted and sent by ssh before each call to nix copy
  43   # by adding to servers."${srv}".config.install.nixos-ssh.script .
  44   postRun = ''
  45     info "  generate $PASSWORD_STORE_DIR/servers/${srv}/root/key.gpg"
  46     test -s "$PASSWORD_STORE_DIR/servers/${srv}/root/key.gpg" || {
  47       ${pkgs.gnupg}/bin/gpg --batch --pinentry-mode loopback --export-secret-keys --armor \
  48        --passphrase-fd 3 3< <(${pkgs.gnupg}/bin/gpg --decrypt "$PASSWORD_STORE_DIR/servers/${srv}/root/key.pass.gpg") \
  49        --export-options export-minimal @root@${srv}.sourcephile.fr |
  50       ${pkgs.gnupg}/bin/gpg --symmetric --batch --pinentry-mode loopback \
  51        --passphrase-fd 3 3< <(${pkgs.gnupg}/bin/gpg --decrypt "$PASSWORD_STORE_DIR/servers/${srv}/root/key.pass.gpg") \
  52        --output "$PASSWORD_STORE_DIR/servers/${srv}/root/key.gpg"
  53     }
  54   '';
  55 }) (builtins.attrNames (import ../servers.nix)));
  56 }