From a4335d4e5a7318ee004d898f9d24c844263986c9 Mon Sep 17 00:00:00 2001 From: Lauren Lagarde Date: Sun, 20 Jul 2025 14:37:55 -0500 Subject: [PATCH] Switch to age keys for hosts --- .sops.yaml | 34 ++++++------ secrets.yaml | 147 ++++++++++++++++++--------------------------------- 2 files changed, 71 insertions(+), 110 deletions(-) diff --git a/.sops.yaml b/.sops.yaml index 953007c..90bfd39 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,24 +1,28 @@ +# Get new keys with: +# nix-shell -p ssh-to-age --run 'ssh-keyscan example.com | ssh-to-age' +# nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age' keys: - - &system_bastion da629e3747c4c5a931d0a8f36882051213f30fc8 - - &system_blockhouse a732bf4fdf34013ce8027c42354b571c6fe5c762 - - &system_living_room 3c63bca416f0d21fef1fbc53a3ddfe55af933056 - - &system_ll_latitude 01c02af9d06b4bbc5d26ec01948d79e3093c455c + - &system_bastion age1up8uth9hwtd9gup3v32l8dypdarj77s2lysm8js8w8mwa80rk4ds76ke6d + - &system_blockhouse age14j6ns297c49wx5d8jddctfmek0kvn8rvw3y03nw3pankc03dlpuqhvvy7c + - &system_living_room age1kmt2khucyvscmwvrjnt0v90zggttuap9utx7rw54g9amhtrkzdlq94fe4j + - &system_ll_latitude age19v2gpucsykaqu3hsvskl67ss8mpqstp59vn687am6px9nmg585ksvlhctz - &yubikey_lauren_primary 5F78261B65C565041662A3B7FF8FC3C735BD4A51 creation_rules: - path_regex: secrets.yaml$ key_groups: - pgp: - - *system_bastion - - *system_blockhouse - - *system_living_room - - *system_ll_latitude - - *yubikey_lauren_primary + - *yubikey_lauren_primary + age: + - *system_bastion + - *system_blockhouse + - *system_living_room + - *system_ll_latitude - path_regex: sops/[^/]+\.(yaml|json|env|ini)$ key_groups: - pgp: - - *system_bastion - - *system_blockhouse - - *system_living_room - - *system_ll_latitude - - *yubikey_lauren_primary - + - *yubikey_lauren_primary + age: + - *system_bastion + - *system_blockhouse + - *system_living_room + - *system_ll_latitude diff --git a/secrets.yaml b/secrets.yaml index f0dfffe..8a2c41f 100644 --- a/secrets.yaml +++ b/secrets.yaml @@ -5,107 +5,64 @@ dotspace: Archive: ENC[AES256_GCM,data:vz7o/qRVbIW97FJG0MeljUf3Wc8zhdl6ijgghOfyIikRCKzfuHBAmKhMBKtuIt0uliCJhcCJwbw=,iv:5nZ9R6Mx890n95uMCbiX5mwoJPJOZ/dm/MpsFDrHcQI=,tag:Bk56jnyJJDpz6fm3EfXWGg==,type:str] Frigate: ENC[AES256_GCM,data:rzcjpec10FgCx0IoURkDEPPd4l00SP75kn4X6VEFAv0w1VQ10h6Ww7msyhgttPe1+P5cYJyuzCw=,iv:WSvIezNccUoSc2z3wyCAGrK/u7iwJl4PBg9xM5RjpyE=,tag:u0sSKnQ3fGnudo1KRobOPQ==,type:str] sops: + age: + - recipient: age1up8uth9hwtd9gup3v32l8dypdarj77s2lysm8js8w8mwa80rk4ds76ke6d + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6WHBIaGM3M2xLRmw2Zzlt + VDJvbTE3U3hQNEZLcy9XOFFDOFBDemNlaHhVCkQrckpWQTlUUGRvQmViTXk0R2Vk + clp1YTdYdHhnSlRRT2xaZ0FGeCtxRGsKLS0tIEtiR1BZSjdiOFpYYzc4ZmhoRzIr + TmdOVXBIWS8zeHR1SC9UOWc3elVINVUKvCXooydvkNeZNFhYinrDZ6vh9ufskNU2 + bLkUkFXnPN42XEJMgeZ0cOmxturDPjEcEW5iPIK6ZyISzbIQoa/Amw== + -----END AGE ENCRYPTED FILE----- + - recipient: age14j6ns297c49wx5d8jddctfmek0kvn8rvw3y03nw3pankc03dlpuqhvvy7c + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWeXEvM1JkNlh6TEFhZlZj + bkw1UGRVNEV5S2VJeWVJOWFqb094cmtlVVhzCmhMbnBxaXBhL2dtUitrVFVqMXgz + TjRZUWNWYWM4NlhJVytDNHp2RGJuVGMKLS0tIHJrNyt3K0VkdVRGV2RvMXBIa1BN + UGhndURxMmdJeU5VUDdhTTdUai9HOHcKwVxV6z/2jJ5KMElyAWnKQ9PM5LD5Y4Mf + 6Dvf0SxCkBUbFspTiHIr0J0Qy8ja57KHXFlqPEVVUvy7B+XgDhnRHg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1kmt2khucyvscmwvrjnt0v90zggttuap9utx7rw54g9amhtrkzdlq94fe4j + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYTEQ4YTluaDJWWWNOMU1C + T1ZiRXU3c25ZNUl2TUU0NzRhNlUwRERCTkRzClNaNklsT3J6TmkyQnRhdlh6RVRV + KzZveGFaSHBmUHZWbWFWYW5LRlJvbjQKLS0tIGNTeFdPS0g0VHpmOGlEMWhGRUda + anpObDVFUWwrOG9Ta3ZCYTNZeFQzVmsKpNwoU4laN1EMnHyrtcRBS7W4svyWKkg8 + 2yFpy1wxFyme1HQ1nXTrLdpATequZ7/+Rd2TamRXgfFGbIinTkcBCA== + -----END AGE ENCRYPTED FILE----- + - recipient: age19v2gpucsykaqu3hsvskl67ss8mpqstp59vn687am6px9nmg585ksvlhctz + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPRCtnRTlha3Q0MzJrMWN1 + UmtPTjVnWXpqazFtT3doL2NPNkdhSGtZZGp3CjdWV0hKYVVEWDhiOFRtRmVjUzdJ + RTRiWlBvU2dIOWg3clZNRlNVOHVxODgKLS0tIGd2cmpHaVZodVRja1lKN1g0ZzNu + Rndqd0M1R0FyZDBNZWlQTjVodWd1M0kKbnnarUcvCCpeZ9WVxu2SAd94oz7lP7sG + 45yFJTd5fq7UALImzrGnm+sEXzC3IKVSVTKWtgxnPpbyjlLIxi4XgA== + -----END AGE ENCRYPTED FILE----- lastmodified: "2025-07-14T00:03:14Z" mac: ENC[AES256_GCM,data:LNh/dHuWmt4nL71+r34vBDg7ngJC44fAw6998BuveS/yDP+kYmwd1VSZ7yRRCoboScuapIVbWMNwiyG2nXYA7W9aM7xkzHyDk5f8R6PQvShkCJ2T+TCa2IgZv7epZnNIMs+Zdqhe/Erf3MYV6rmWAY7acXEOdwzXQ7tHX8uvkfc=,iv:8UfzgZRyqUk9VwJaqDwQCjJlD/Az6zR+amof1pnnlqo=,tag:mXBM4U1+RIOzv/t0UnuSZg==,type:str] pgp: - - created_at: "2025-07-19T21:45:16Z" + - created_at: "2025-07-20T19:35:42Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA2iCBRIT8w/IARAAzvG8E1aFtscpZbzV5xaZU/fjrdpEeGkne4u3lf1DMXiK - /+nEPq8E5QimYMKmDerLNRgubzqGyv5/U/ja8xaHJOyluN5YuEQ3VfHRExMD3uqp - NzKexCfyZWcRjpY78/lFi8YS+zAgRnldeMJlFiwKjcAPfJoA0S318II3MjkXj1Hl - tXyd7R9lMJ2qRHoiz2Ll0t567JOvl2fygFqmNYfe1MyhuHEQ0I6x8bYB9MH4OiIC - SdgD5AtM+qMzAMS0gLgZT3qGYuMrDx+V1s+T4vpyuqN0UhHJ1sdAcqjtSRhPzEAe - AxemBp+KuzSrC+uOooZorIpnxgXDUB33KVwsxt/QDdAIAyEp1w2zOGdf5aGpU+dU - dpahu7cJmIGq4FbE/3d0mJQ2cofOGIsqrK6zLSa0+wFqzQhQvV1NBoXU+SinPMdm - 1Qk/0eA51VW2XwlGQZiDAA+F5h/wZW2l8+c8czKTRmdtdFEiJUe8crtBwyfXD1DV - bP4YsewxFbyJln3Bny7tYsqP+inmWR8bOEFSysVbqeelNXiYA0RTYRbr0TMHWHC4 - sukbCUCON7Hpg4sxy38x/WGbjQBKhzl8ws29vwXrvIjr1Zmn8+MDhDxInQAuylhL - CnPxVM6IC7OGQTJBwyiK3280nOs5k0qPIqaJ/C+qTR651AL7OqcaG2Tbec3K3p7S - WAHrLYl+cKW45I44EWQLzbv/Lvfxi6mW/ugUPMATP6KHSAawi+2tzZT48076EpO9 - zGhLvIjaGzRFW6Rp0DOHkebANcBigN5S6sCtHRZa5K3VmCSZJJwk6PQ= - =40uo - -----END PGP MESSAGE----- - fp: da629e3747c4c5a931d0a8f36882051213f30fc8 - - created_at: "2025-07-19T21:45:16Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMAzVLVxxv5cdiAQ/+NOrEqmmtokHzMi1JYY+QeQ5xNoAYODbLO3ON299uBoO3 - sG2SF98vSbDUGAxxOfybhWEVGsndLvANJRozbeL77MHsLGMB2v4dTNhj62RKfCT7 - UWQXyIfmPYaVfRBIXJBnVyYiGrXqTr4b2GtZhBk70XT1pSIBuFQxkD7xMnbch46V - fbReOCJT89fdZAw27emluiCZ4/EBPDCVutPlXebbel737gEWa9XEq6g8k/2XY642 - 3Xjijk1MxhSNTeKglxSk/Xz8Y35OGZCbGpTH9jFITXOa2qlZvO8KYbOH8QCr7vld - c6LlzR4vUktuTusMdW8ecx/1Wd81C86HAWuNLYiDH39RlE7JeecxtIKBH068x0V1 - JG2DNEBa1h5mKP66v1jEePA8oRAMDx6+hdz032wPx7doUJRw2dNbexGn2YyvHJeb - gx32khUCuFmm0Sa/YbtKyPGZINZ+tPUmYY+TMSgwu9CMpYxGhHfQAwrvg8o8F0z2 - 98CMuAjjKiQsgeCu3/GNIlRLzopHYdvgPEo3HdG/YgW961ZlKZVXjDaXSX8nqsJC - c2balTuc6SfeXJsBlkyKr4Tk+lkxCtXIQcGbFXiLH/NcIzGcY4J1izSi4Ps8f8Ay - KGYIaFDnaLwVOokVSXVA8kG/Nn0wG3qW9aKa84rwS0MD88A6zWQGX4XoN2hzl4/S - WAFADKOVzGj+em4Hjmd/eNe4mDV4uoUyDezjyQvxeD/eT1ZPl6GrIJPcmASk6a+Q - hHToIJP27jufTeKNr30RzVreR/CV+1eo+1DFXaUAx+AeYFSp1i+3YuY= - =n0gx - -----END PGP MESSAGE----- - fp: a732bf4fdf34013ce8027c42354b571c6fe5c762 - - created_at: "2025-07-19T21:45:16Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA6Pd/lWvkzBWAQ/+Mu3CcOttRdgvrZvIqDiZ81CoqkrJ1Pr4afiyIzpR+bQO - DCRUJ4Lnnujo8Q9RiRJsNkp0epKk2B2UOJGqIeCD3d22WwKZlSwvs4JOf3bOWvr3 - 8W1kXKjdslaAo6hp2qQ7+qEWZqRjxHUhs2WccatE9xJ1EH6DAJUHHeg+RKLj8GPc - QsvYwYuNrSALvOkRONlMqhAt/7027otpYD3ZaM2TNGspMBO4/A1z25Z1GJHpDmd8 - kOyKckLM0QcdYnOHZ8SnHZDt83zFS4fKg1IorzrVlkSX1vLqIKGssB9eez/cUd8t - RVfWeovI8FQtmWo9mXK0AP91O3vJ5+tuulFA4Qw0bIvBEjOqAmdbvAd4+q5QuBPJ - Q2cizjJtkymB6ACLxhkbJS8nbI/nCpg7ZHf7Lb3G7dXwm0xGkdSA3QnrEXgCtXs8 - IMjQi0g1FdvIlGKV6HJknT+k9Ik+CdwUzQFeY9cqT1jb2EX/wgWW/Mkta7dT/brD - Mf/qHBpb8NGqO59agY0iSVyh2aRDo+g80k9gF7YEedTzWJ+t4VJAJGCQZVKDRoAo - 11hn9wL8IIt12TjsyjBZ+m2zq9QbF41Th289Jg89ciTHlLSaUuRdU2A++1VHczrD - jAC7GDgERZIAUqwLVR99YjpiaIhZn8wPPhXNcq9dN4XLGl60TN1R8noJ1nksuTHS - WAHKg5SpmATPJ7zbhO/gN6wBcMPCMe7Jao7QgvJOSLAbjjvMhLoNlAhnYOQLEb2R - NwJQpgXph9BGtFLU/vn2EKe59l/H8SjPzBJ2Dw658+5NUEl9mdNVD/o= - =VwgK - -----END PGP MESSAGE----- - fp: 3c63bca416f0d21fef1fbc53a3ddfe55af933056 - - created_at: "2025-07-19T21:45:16Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA5SNeeMJPEVcAQ/7BDfjrAh8fbCGXiFb9TeM21J6lcE/9lwluJCuokUWHiw7 - bhXiBoA27LQsAx3x6o/sXuL08rmxf5K3PSpLy+6P6OU7uKr9glwE/lYrIAiXkK/E - UXM21arWaNZRAJWUlplAnHGPfTN3DbP5NYednT5Yps5IcuCLGw3B7+YUu8tEpE5E - gYHOuH64tkAC8tAZWiZvlCn/3RKw8Sii+NmDmXKd8IkCN5tjW2nETi38MXf4yBmW - 33Pr6I47hQ+TNKX4f4Io2TiINpw0p/ZVtNyNGgtp1wt9wPJpGntec+q1CGh9CpB/ - dD/OoT/Wf5Jcevo+H5UkMHAQw8MIbohrjEL1+vZvRjvC0SjkIKw6J086D5CtJAQd - 59w8TEUJf531JcyKH4s23HQ4rB6jg1JOWx6UBznUMO+pD1+rfRZG/1o6KBuiBRLs - 6e8gkKBC92BPCjnEniofhqBGPri2vnXZXfjZkjAWW1acxSB5uKTB536fTKvRDo9u - qCA8mdm+gf1Rsbu5a5NQLvb6SZzEMsT8Ubi64wYXeFj1492ItfylsRMo/wP+RT82 - XC2A7eygoNDi2AAgYMZzODKOhWxQMjjos3HGnFRTuhFpf+6+9xBe0GgRyiNuW3D2 - MtwIApA7GmuYnbvfZx+szTz8iHl/XyzaZaTh/3Y4la2F2KG1ifim1hlnMicEgdnS - WAF52SDtx/viPLMMxJUNLibbdygkbdxOeLzkbJP2EdjfS34Vy+czs5JGMYl6Yvos - 9u8tSbCptzf7mBgqbFlCdhylXohTmsWzrVRM6fiwM9M4xb3jSbPyRrc= - =En2p - -----END PGP MESSAGE----- - fp: 01c02af9d06b4bbc5d26ec01948d79e3093c455c - - created_at: "2025-07-19T21:45:16Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA9BR1U1EkAnnARAAsiP1vUpq6dYQzK+DNyGVJlPNvHQAVVzgH/Mq1jUxEk5k - uswI+6EqsbKisXfWB1IFEMp0ALyd/A3ssM9n5z2MlBLKXYpb79dGAoVAm3/5J3G6 - fZuXqjU0M2uIlDd+Wg4aW/iyUteTzvMbYjKaOVvC8txmdjBdfar40/83EpU9SpNL - 6NQOu0mmORRiqM+EHghXunqnj7yLGG3dwG39lrRsrRbf0fWgg9nOTp89J03GKKbw - kLgHVkLBSBoaSzkPoqNssYDf9qDG1DwrZRfC+i5HhR8bjg/vtM92Ftgfo2jEObtF - 7IzfBnhGWt3Iaf49cDbV/wvUpLoleRQ4bMybA7FfuNaoOJg5JUHevuf10v3uq4JN - FW09UDoODckroXECfXSXP6Mt8kq8nsEzxnWbvJ+RhemgsXUZg2vi+Y10ur/rDJ/e - csUIyEuJ6J8eHggAX4+oIJnjF1+FP+EkUkIpTGNFL7kxGLLvnJCpKtfALk/Mkya4 - 0KebJRltobPFJwNR92+blcTnkytpNPSRqjmH071DHoLctZvzNSZvtmjhH8clxIo1 - 4JZgyhjr+UHv5POd549yTUf7uPvfB1OuevT034Mge+fz7tJDWyi/0KAswahp0Vt6 - pqY+DzIcL22EynxF6NsP80gHuCYfVqo8fy1gCTXp4DsrxPpTD+qMihWPEXqJnLfS - XgE1dU706MWEucDwcSrmx0xTbK7OObZC5a/1KD2TDBMv0WQtXtx3YnC/zJuYrLF9 - rowMOc8N2HEZKs/59gTZ3UOVj6kDbJz4zQy4sWFqxSS3Da4sF6gs00rRovDVFjs= - =IBSV + hQIMA9BR1U1EkAnnAQ/+PqhTAWVvO/Z6NxVaSosQzwoUI1yDm5A7ZGVaLpiu4i26 + omfBAWfkRVi+3A0KSokmnl9+TnWkT1ojJSutNJv5low1GGKuODhUTz4aDgBLqb+c + LHcFkVHnFHzp2SEMZ/8ma+H/cnMHjXbQ+fYJk/P2OCxQ2L++gOUONCDI6UujKN+5 + PWPv542mCz0c+d6vvAFWAMEz9SeLqlKfaifUPZdEtXUPFHsy2sl8W7RVRLMFO/OE + EbVq44JSF2paHNGAOeNdd/n9a2KBDy5Nf/7aklS8JW1cRtOchZUFvcJiL6/lmV1u + aCZPUxuxcvc2s3TTNYCFeu9vd7Q6Ni3p/Tb9GYvjsXGnkWGJ3t6vGqwPxBxJ0OQZ + S8MIqbOPmFund4vVyaWpEDtjF3WzW6TODMSXfCwmQJQLhKzAKWvgXP2PXBZIxB0h + lRweBy1k0ljnjDIun3SpWDvhBItjYkUnAEVwWE6VSPKlsXKApZ1p2mIicMzK+f4e + 3OF5kjZ+U8e2jG36o6k+tkfYO+FuMT9Bove0vKLYjscxrBnwbuQ6+tnjxf0NJfB/ + IStzs+tUziQLfIR7MBi7DDCRd2dgU4MxK6kWDtFbpXqm4IFnBoihA6p53dL88LVv + 8PzYt3E5MA4+7nKrNZn1IHL2io8yG8g3A+RVFUx6ZiB+QuZmcjsPn/5sEbH0bczS + XgHMavFFBZVtuO0S5fetDKOqUObjyFBkXSrg+dBc9kGBHDpPejh0xD4RefXgRtwX + ttivAlOKtGG4yjGz/3G5YhYPLxDTE+p0WoNxjrw/puKKXQy/m5iZj2Xomh1ckgA= + =Jf6Q -----END PGP MESSAGE----- fp: 5F78261B65C565041662A3B7FF8FC3C735BD4A51 unencrypted_suffix: _unencrypted