From 747d0a54b6a7add6b2f0577f01e53202acfd7583 Mon Sep 17 00:00:00 2001
From: Nydragon <contact@ccnlc.eu>
Date: Mon, 9 Sep 2024 11:22:24 +0200
Subject: [PATCH] chore(agenix): rekey

---
 hosts/raptus/configuration.nix |  20 ++++----------------
 secrets/couchdb.age            | Bin 576 -> 518 bytes
 secrets/rustypaste.age         |  18 ++++++++----------
 secrets/secrets.nix            |   5 ++---
 4 files changed, 14 insertions(+), 29 deletions(-)

diff --git a/hosts/raptus/configuration.nix b/hosts/raptus/configuration.nix
index 924a717..d2048c5 100644
--- a/hosts/raptus/configuration.nix
+++ b/hosts/raptus/configuration.nix
@@ -40,6 +40,7 @@ in
   networking.firewall = lib.mkForce {
     enable = true;
     allowedTCPPorts = [
+      80 # for acme challenges
       443
       5984 # couchdb
       3000 # forgejo
@@ -47,22 +48,7 @@ in
     ] ++ config.services.openssh.ports ++ [ config.services.endlessh.port ];
   };
 
-  # User account to run remote builds
-  users.users.remote-build = {
-    isSystemUser = true;
-    hashedPassword = ""; # Only allow login via ssh
-    openssh.authorizedKeys.keys = sshAccess;
-    shell = pkgs.bash;
-    group = "remote-build";
-    extraGroups = [ "wheel" ];
-  };
-
-  security.sudo.wheelNeedsPassword = false;
-
-  users.groups.remote-build = { };
-
-  # Ensure the user can build derivations
-  nix.settings.trusted-users = [ "remote-build" ];
+  age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   security.acme.defaults.email = "admin@ccnlc.eu";
   security.acme.acceptTerms = true;
@@ -97,6 +83,8 @@ in
   services.openssh = {
     enable = true;
     ports = [ 56528 ];
+    # Having automatic generation enabled breaks agenix
+    #hostKeys = [ ];
   };
 
   services.endlessh = {
diff --git a/secrets/couchdb.age b/secrets/couchdb.age
index 265d067cec553d619178f7e5bca7dad38e6b72aa..b270f1c2410456d6659572c8ffbca98e4319c3ab 100644
GIT binary patch
delta 471
zcmV;|0Vw{!1cn5VC4XWwNNi9+AXaTgWMOz(OL;SFK`(k$FF8?9PF6xePGU-JV^>aU
zL{Cm@PDNHnbZkU(3RO*0bZ{_pK~i-^bZ%2`WOhPJFKIPyZ*o|1azsI4b3;`|c3Dkh
zN?|im3N1b$b8~1dWn?lnH8D9LZgpirW<elnH%v@0L|I~aNlkQ1P;oeLZbEfNZ+dcM
zSXfF+b4Y7!H+NYuRcBX0MKV<iH8VCyY-DS5Fjr_;cXVw=OJ-MUH%lvTL`7zJVNFSP
zLT_zHF=J*ccych2@fUw&Mo(%|d2DnsXl8X&Fll5-c{zGHS656yMtD#{I8tp=R##zI
zZe>?vQB?{zRbn+Sa7Ji)P);jjQ&eF{c}i|*Pg!eAb4+?tMoMc&R%CN#PG>POH){$l
zEiE80cuQnWZE`_IXIX49OmkXUHDp#tR!?nAMrLeUV?|PNR#tyGVmVeqYg20qgh41?
z$}s%O?HVTXn<RqI2v9P1b)p=n$P_6unoQ)GH!=mp3q3aa`dyQZq>G(7?|=@3Ttl4-
zL_60zMg;MAwN!a2aq35aF!}&Ytl^ZKM$)|!HgPA^Rb&)s0(<-5Cpy$Z*BoBt6CnQm
NtTS+hw2gSUCdo({tBe2u

delta 530
zcmV+t0`2{V1i%E4C4Wk4OfxV+ATcjXK}axWYGqnYXLmG2YcFC$D?>$QGEPKMOJsCr
zYExHuX=8Lza5YFt3N}heb$K;*O<Fc9b~r~fP*-M2MPf5^cSBM&IaF&fVnj<zS9xJJ
zF-&bu3N1b$b8~1dWn?lnH8D9LZgpirW<elLZedGjc~4YlOHDCtP-bdnS~O*1G)+co
zF?w}RP((^-XL@ZzZZ$_?M>AOpQD`q{O;t@!X+v{oQ)x#xd1-S)ZbxZ&byr1pV@o+$
zFi%Tpb$V}ZNoqKe@fUweG&4CdM@&*mLUv0sYBozZb#+EhY*AA|c5i4zQ%6ceOJ-&>
zc~p06M_CGUa71rJSX4D-Y;IvUI5AgBODkr1ZemkNVOVofVPjY;MMO1GF-t^pW<d%q
zEiE8gO*2JUWim}yOK5C4PG(OqayWKNVM8!vW<y0cHAg})Gb?{{IZ|s;d1W*T8fG-u
zEJasYS@K7t+*RANtIZsk5UBdhA2CN3Zu7Hf;Zez6cA!-6M2yMuhO(btSh<>GE871G
z2T>4Y(uN5|+PiM6{T1k{PLy2I&XE{t2=u^4(?|YY=NNL{MJnl<p@)}o_-yCC%N-9*
z|7XeklB1P6zpFZoilxW_ug`GX?BINZHbf3RpFHt30W5OR4syNM_BwaoN0t(`zzs{t
Ua9Le#XypYzjzplC4|7!BGGkoIp8x;=

diff --git a/secrets/rustypaste.age b/secrets/rustypaste.age
index e9333e7..8266472 100644
--- a/secrets/rustypaste.age
+++ b/secrets/rustypaste.age
@@ -1,11 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 JjL30A 1XNRKnK1XPGFU5+lqgoLMOnaf9IxQT6NV6tFK654gDc
-OBePOZJ+eS1Wl7pAERJgj9MtmGqwNYibpdUWR6B84A8
--> ssh-ed25519 nueAfA SKBEBskfVR/OcKLlNj7SWr0RnYb67Npe8WRmjxytVCk
-fqLgmEwmxISmpyzz3D/X5X0bN4xrIh8/hqs9vDiFkqE
--> ssh-ed25519 WcjW5A cZDomiXanY2cwvZCPWcAG734dQg7RhlnqKMe5pfHMy4
-6jzLkXYDa8ZrUTlyqmAw0W4WRy0x83L53SQS0Aq7gtg
---- B4/2cwHiFwQDnGZELOsHLyxEfmZbl2I5rkZioWhh7GE
-*�X&	[��k�wC�V����$����;*
-�:�z��թ��
g�����PQ+�G��
-)����b���߃�t-r9R�ߍQ�s����č�v/�⇐�<>�'s@?
\ No newline at end of file
+-> ssh-ed25519 b3HlPA 2xnmAbE7usGlBUofIkT0+k9lkAOMfrUifn2kEp6u43w
+IpuhSKZoguXHXBamt2xzKTIRPyKNmzIYPaIdKM90aow
+-> ssh-ed25519 nueAfA LuY9xtX9NcTzA6t4XugshESmLA5omCP6CzgiEItj9CA
+JCLnGxpvRLcMeTZOPy+7L02Jsni/AhYzTzL4mFk74Jo
+-> ssh-ed25519 WcjW5A nQbOkYhDen935yMtYnWKeM54PeRUcAikvGRsjRQ/Ox4
+uL0PpSXX7+Xn91HYHtb/HNf90VNCRaCZ5sQjYCcOdWI
+--- hr+DtkYLhfRAVjc0E6z970/JJT3iaJKTSRwMY0rLMPA
+D���\	YM��W;���������n�E
�i�ۉ�5	_\�Ճj�@��j�c�(�J�}5��nK�7ԾA��h�����=�׹:K?-�V�.���k�����D�6�c�v�
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 552eba8..25dbe50 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -8,10 +8,9 @@ let
     userBrontes
   ];
 
-  raptus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIErbhkpCL0DuJQTxeTqxtrGvELCQFkyZmhTZ8fagszOU";
-  systems = [ raptus ];
+  raptus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdpjGR/pV1roktZdKIVVWqds0JB+x1ksfyQmYPMLK7o";
 in
 {
-  "couchdb.age".publicKeys = [ raptus ];
+  "couchdb.age".publicKeys = [ raptus ] ++ users;
   "rustypaste.age".publicKeys = [ raptus ] ++ users;
 }