This repository has no description
3.5 kB
115 lines
1{ lib, ... }:
2let
3 # Helper to read age keys with different types
4 readAgeKeys =
5 baseDir:
6 let
7 dir = baseDir + "/age";
8 in
9 if builtins.pathExists dir then
10 let
11 allFiles = builtins.readDir dir;
12 # Group files by base name and type
13 processFile =
14 name: type:
15 if type == "regular" then
16 let
17 parts = lib.splitString "." name;
18 baseName = builtins.head parts;
19 extension = if builtins.length parts > 1 then lib.last parts else "";
20 in
21 {
22 name = baseName;
23 value =
24 if extension == "age" then
25 {
26 public = builtins.readFile (dir + "/${name}");
27 identity = null;
28 }
29 else if extension == "identity" then
30 {
31 public = null;
32 identity = builtins.readFile (dir + "/${name}");
33 }
34 else
35 null;
36 }
37 else
38 null;
39
40 # Process all files and merge by base name
41 fileAttrs = lib.filterAttrs (_n: v: v != null) (lib.mapAttrs processFile allFiles);
42
43 # Merge entries with same base name
44 mergeEntries = lib.foldl' (
45 acc: entry:
46 let
47 existing =
48 acc.${entry.name} or {
49 public = null;
50 identity = null;
51 };
52 merged = {
53 public = if entry.value.public != null then entry.value.public else existing.public;
54 identity = if entry.value.identity != null then entry.value.identity else existing.identity;
55 };
56 in
57 acc // { ${entry.name} = merged; }
58 ) { } (lib.attrValues fileAttrs);
59 in
60 mergeEntries
61 else
62 { };
63
64 # Helper to read SSH keys (handle key pairs and encrypted private keys)
65 readSshKeys =
66 baseDir:
67 let
68 dir = baseDir + "/ssh";
69 in
70 if builtins.pathExists dir then
71 let
72 allFiles = builtins.readDir dir;
73 # Group files by their base name (remove all suffixes)
74 keyNames = lib.unique (
75 map (name: builtins.head (lib.splitString "." name)) (builtins.attrNames allFiles)
76 );
77 in
78 lib.listToAttrs (
79 map (
80 keyName:
81 let
82 publicKeyFile = dir + "/${keyName}.pub";
83 encryptedPrivateKeyFile = dir + "/${keyName}.age";
84 hasPublicKey = builtins.pathExists publicKeyFile;
85 hasEncryptedPrivateKey = builtins.pathExists encryptedPrivateKeyFile;
86 in
87 lib.nameValuePair keyName {
88 public = if hasPublicKey then builtins.readFile publicKeyFile else null;
89 # Expose encrypted private keys (safe), but never unencrypted ones
90 private = if hasEncryptedPrivateKey then encryptedPrivateKeyFile else null;
91 encrypted = hasEncryptedPrivateKey;
92 }
93 ) keyNames
94 )
95 else
96 { };
97
98in
99{
100 flake.keys = {
101 # SSH keys (handle both public and private key files)
102 ssh = readSshKeys ./.;
103
104 # PGP/GPG keys - define directly with metadata
105 pgp = {
106 yubi_pgp = {
107 key = ./pgp/yubi_pgp.pgp;
108 id = "DBCD757846069B392EA9401D6657BE8A8D1EE807";
109 };
110 };
111
112 # Age keys (public keys only)
113 age = readAgeKeys ./.;
114 };
115}