This repository has no description
4.0 kB
133 lines
1# Key structure exposed without nixpkgs dependency
2# Uses only Nix builtins
3let
4 # Helper: split string by delimiter (returns only non-empty string parts)
5 splitString = sep: str: builtins.filter builtins.isString (builtins.split sep str);
6
7 # Helper: get last element of list
8 last = list: builtins.elemAt list (builtins.length list - 1);
9
10 # Helper: check if list is non-empty
11
12 # Helper: unique elements in a list
13 unique =
14 list: builtins.foldl' (acc: elem: if builtins.elem elem acc then acc else acc ++ [ elem ]) [ ] list;
15
16 # Helper to read age keys with different types
17 readAgeKeys =
18 baseDir:
19 let
20 dir = baseDir + "/age";
21 in
22 if builtins.pathExists dir then
23 let
24 allFiles = builtins.readDir dir;
25 fileNames = builtins.attrNames allFiles;
26
27 # Process a single file and return { name, public?, identity? }
28 processFile =
29 fileName:
30 let
31 fileType = allFiles.${fileName};
32 parts = splitString "\\." fileName;
33 baseName = builtins.head parts;
34 extension = if builtins.length parts > 1 then last parts else "";
35 in
36 if fileType == "regular" then
37 if extension == "age" then
38 {
39 name = baseName;
40 public = builtins.readFile (dir + "/${fileName}");
41 identity = null;
42 }
43 else if extension == "identity" then
44 {
45 name = baseName;
46 public = null;
47 identity = builtins.readFile (dir + "/${fileName}");
48 }
49 else
50 null
51 else
52 null;
53
54 # Process all files
55 processed = builtins.filter (x: x != null) (map processFile fileNames);
56
57 # Merge entries with same base name
58 merged = builtins.foldl' (
59 acc: entry:
60 let
61 existing =
62 acc.${entry.name} or {
63 public = null;
64 identity = null;
65 };
66 in
67 acc
68 // {
69 ${entry.name} = {
70 public = if entry.public != null then entry.public else existing.public;
71 identity = if entry.identity != null then entry.identity else existing.identity;
72 };
73 }
74 ) { } processed;
75 in
76 merged
77 else
78 { };
79
80 # Helper to read SSH keys (handle key pairs and encrypted private keys)
81 readSshKeys =
82 baseDir:
83 let
84 dir = baseDir + "/ssh";
85 in
86 if builtins.pathExists dir then
87 let
88 allFiles = builtins.readDir dir;
89 fileNames = builtins.attrNames allFiles;
90
91 # Extract base names (remove all suffixes)
92 keyNames = unique (map (name: builtins.head (splitString "\\." name)) fileNames);
93 in
94 builtins.listToAttrs (
95 map (
96 keyName:
97 let
98 publicKeyFile = dir + "/${keyName}.pub";
99 encryptedPrivateKeyFile = dir + "/${keyName}.age";
100 hasPublicKey = builtins.pathExists publicKeyFile;
101 hasEncryptedPrivateKey = builtins.pathExists encryptedPrivateKeyFile;
102 in
103 {
104 name = keyName;
105 value = {
106 public = if hasPublicKey then builtins.readFile publicKeyFile else null;
107 # Expose encrypted private keys (safe), but never unencrypted ones
108 private = if hasEncryptedPrivateKey then encryptedPrivateKeyFile else null;
109 encrypted = hasEncryptedPrivateKey;
110 };
111 }
112 ) keyNames
113 )
114 else
115 { };
116
117 baseDir = ./.;
118in
119{
120 # SSH keys (handle both public and private key files)
121 ssh = readSshKeys baseDir;
122
123 # PGP/GPG keys - define directly with metadata
124 pgp = {
125 yubi_pgp = {
126 key = ./pgp/yubi_pgp.pgp;
127 id = "DBCD757846069B392EA9401D6657BE8A8D1EE807";
128 };
129 };
130
131 # Age keys (public keys only)
132 age = readAgeKeys baseDir;
133}