forked from
lass.pds.lassul.us/superconfig
This repository has no description
2.0 kB
72 lines
1{ lib, ... }:
2let
3 # Helper to read age keys (public keys only)
4 readAgeKeys =
5 baseDir:
6 let
7 dir = baseDir + "/age";
8 in
9 if builtins.pathExists dir then
10 lib.mapAttrs' (
11 name: _:
12 let
13 # Remove everything after the first dot
14 keyName = builtins.head (lib.splitString "." name);
15 in
16 lib.nameValuePair keyName (builtins.readFile (dir + "/${name}"))
17 ) (builtins.readDir dir)
18 else
19 { };
20
21 # Helper to read SSH keys (handle key pairs and encrypted private keys)
22 readSshKeys =
23 baseDir:
24 let
25 dir = baseDir + "/ssh";
26 in
27 if builtins.pathExists dir then
28 let
29 allFiles = builtins.readDir dir;
30 # Group files by their base name (remove all suffixes)
31 keyNames = lib.unique (
32 map (name: builtins.head (lib.splitString "." name)) (builtins.attrNames allFiles)
33 );
34 in
35 lib.listToAttrs (
36 map (
37 keyName:
38 let
39 publicKeyFile = dir + "/${keyName}.pub";
40 encryptedPrivateKeyFile = dir + "/${keyName}.age";
41 hasPublicKey = builtins.pathExists publicKeyFile;
42 hasEncryptedPrivateKey = builtins.pathExists encryptedPrivateKeyFile;
43 in
44 lib.nameValuePair keyName {
45 public = if hasPublicKey then builtins.readFile publicKeyFile else null;
46 # Expose encrypted private keys (safe), but never unencrypted ones
47 private = if hasEncryptedPrivateKey then encryptedPrivateKeyFile else null;
48 encrypted = hasEncryptedPrivateKey;
49 }
50 ) keyNames
51 )
52 else
53 { };
54
55in
56{
57 flake.keys = {
58 # SSH keys (handle both public and private key files)
59 ssh = readSshKeys ./.;
60
61 # PGP/GPG keys - define directly with metadata
62 pgp = {
63 yubi = {
64 key = ./pgp/yubi.pgp;
65 id = "DBCD757846069B392EA9401D6657BE8A8D1EE807";
66 };
67 };
68
69 # Age keys (public keys only)
70 age = readAgeKeys ./.;
71 };
72}