From d011cb04e1c71381dcf17e9d74a7a2384887a166 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Sun, 5 Nov 2023 19:35:37 +0100
Subject: [PATCH] feat: add declarative root ssh key on nachtigall

---
 hosts/nachtigall/configuration.nix  |   6 ++++++
 secrets/nachtigall-root-ssh-key.age | Bin 0 -> 1858 bytes
 secrets/secrets.nix                 |   3 +++
 3 files changed, 9 insertions(+)
 create mode 100644 secrets/nachtigall-root-ssh-key.age

diff --git a/hosts/nachtigall/configuration.nix b/hosts/nachtigall/configuration.nix
index ea1b774..0aeb9a1 100644
--- a/hosts/nachtigall/configuration.nix
+++ b/hosts/nachtigall/configuration.nix
@@ -58,6 +58,12 @@
   users.groups.hakkonaut = {};
 
   users.users.root.initialHashedPassword = "$y$j9T$bIN6GjQkmPMllOcQsq52K0$q0Z5B5.KW/uxXK9fItB8H6HO79RYAcI/ZZdB0Djke32";
+  age.secrets."nachtigall-root-ssh-key" = {
+    file = "${flake.self}/secrets/nachtigall-root-ssh-key.age";
+    path = "/root/.ssh/id_ed25519";
+    mode = "400";
+    owner = root;
+  };
 
   # This value determines the NixOS release with which your system is to be
   # compatible, in order to avoid breaking some software such as database
diff --git a/secrets/nachtigall-root-ssh-key.age b/secrets/nachtigall-root-ssh-key.age
new file mode 100644
index 0000000000000000000000000000000000000000..359a86f7ece00f0320ed47ab95e377b3f51ec5df
GIT binary patch
literal 1858
zcmZA0{qGwE0mtzTCS*sL2#hI2?equH<GX9GPgk9gYwxbTw)fb(>$O{C_uPB#-L=>D
zrg0{^fHC>vkP&_W9ZTk>X8FP|0~3si=$C|SUmuW-Imu??n2`-8juCO9{;*&67rc^p
zJ|D$0mW)7)7vqT?2HV2eg3<!8^k6PYMoWecm&=7(&c-^<%*xTGoC!mm?BZ}UX<891
z$mqzihN(dD9lwG=ATlGG3ZKX&AQE_FT3~TcOEXoC7ii#@{GsSkb|CsPO-}kle@^mk
z&`xgDrUMP5XSrVJkMtqiqAX2JD}^yLYv5IGG*#zB)=@>#rSJkGE0eK<0xi;S2n9%K
zSY4?>2SZEalPV;m?Y39#hH8k$G9ovMBD=_6*WyIUxdhhBqX0JbhprfeJ$m8M_*@{d
z?qr_A1YAQqg}h){L_B2%O(wyL1a7NVrDvBXnt`GLt&vb#2C95Bg_ynq4-Jww{TU{f
zl5uD>HDX$y7NFE%$2_K&A_L0vS|d<;q&KeCC=wU&X`OHgKsTG^R1FMX;6byDN~)w)
z>;fzd7>ErQrjK^1GSN`VL0E<Ia#D6_!x>F+9W&Xn4pR|;d2Yd>9J|ZWrWK_DoKZ76
zk|vx~%y+oBn+;%&n<Q3wl+NanQ)B8llP*G{?l6lHJPiO)azz3|G1q0`>Ov>gG$_<&
zUOkq_I#-H^WG5nKV{R4@wu;$Pk(tQz=zsMvrsucgMjhbdwuqGHBuLL?Go?T#Z5th&
z*C3y3XQahxxGk6Z{ZTuPFsr<9Fr<n*Qk@N`rbuxR3kYUA)7d&msO69`*+{?#bpojm
zCKYFhc>Q5R@8MC^V|2lpXC}o>!M=`J(oCiGmQ?c_KuL#O1uW?Lq#Q5i6hgBLGr<~7
zQnmX%Z>Y+_fQ3n}P$_7#4I?wL6W46M>4A`-_h*X+&<IVfN%{j5MSMw#kzzLIjaZ(_
z6VNvYDB6h-yy~|mVIYb<WJGIzrdvjfoK}lG=_zx-GD1r3VBG~muq}6<RJABWDzsdY
zO;@dvRxwqWnW|<gHc`}Q=9f5F)Q00YFShb5<uw3vY>CyR$6`#WX?YNnMoqu6kn#H1
zTEKF`G<e)8knN6|y4QDn{i6e-$0Sy+CK2waRS5WUXIzDcih!9Tx7${gW-zj)Y)<$F
zR~@qgI1hnQ$J0ruG_!g=%B0IMq4-9=>qZTx1+zgR<=W#!X{wx<g*R$;OR5ynoFayb
zH7YT}Je@28vuM;~ry|n26mh6Dp^;c)Nm>`Ol1u?!s(6fw3BJ*XD|)fi#zZR9Ov0a|
z3v5z?Fk)8hBQDY$ayM#qDOm_;4lIuRnN=Hd6`y7^H`CE}CYQS?o-eAkk?mAc*#f7m
z+-Pw?FEqW06?Cmu)vxvl88uXJuCkQe?O>5;+i{t%%X-xC+k^jW56>3%7m_6_Hk8E3
zJ>c!`1M$dU5JT0(g`4Jihlm9tEye*NQHq-9$JDSyLiw@bg0WH@j0R*#4ug798e286
z4=gP$<?`Twue(FknKc;3bS#7wdL0Ri7_qLj<XUT9lsZfv#3+&j(6^#5UAyDK+E2GG
zX?Lxz?YZ>wquQoT_NLJW`s9TtiR$Sy|9JzdITwF`M62ts>^!vCm|R)AdOPt_cI`LA
zTdp2l=kNHi0|Bd_IK2mad;b~ij+-vJ4;_5`{JUF@-gMW-W&DxBfqZq_+VdO!75uLA
zSL^kX^_M69d~WiM;97!8*fZaK0n1-L>)v_!!ja{7o;Y^=zH;`xIKAbQ-}Wy3bM)kW
zYsSq1diz5s@`rcaKle^Nd)uAQ{^9t!OFw+=k!9!L#}0JCdp<a|cjwx3^jH5)+;;J!
z)1M(;-SW!%XI?&k{1?Id_wV1m7hBn(h1;M0+~!w5zVFAs;wSV+uY7iP<;%}CU;kjb
z`S3TltdAc1{qB8hXVC*++}6A2ozrjfKY#PkpPoMQ+wX6E>J$%LJCIv_?C_5K_LCdl
z|M2LQn}5Qt?E2Bl*4{d$e(aYko9Ahm{qfvuJMHQ6*6n|zk8OPX@41KVx0p}8d+*Zc
zFTeEZ<JhL^(H&6ZA1gn5Pg{57`MdYPZ|r|By7h&-S5NlUM>p#Fsq<Hl-C6)w<QFeI
za2DG4)P=#<$`NUNeQ*6cyG}dzN=sYcR${JMbT8-5G{15pUS21D>(_f<JhUq;RsIXn
ClBw|k

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 4690924..d65cdd1 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -20,6 +20,9 @@ let
     nachtigall-host
   ];
 in {
+  # ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBB5XaH02a6+TchnyQED2VwaltPgeFCbildbE2h6nF5e root@nachtigall
+  "nachtigall-root-ssh-key.age".publicKeys = nachtigallKeys ++ baseKeys;
+
   "mastodon-secret-key-base.age".publicKeys = nachtigallKeys ++ baseKeys;
   "mastodon-otp-secret.age".publicKeys = nachtigallKeys ++ baseKeys;
   "mastodon-vapid-private-key.age".publicKeys = nachtigallKeys ++ baseKeys;