sops to create ssh keys for users

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1716394172,
+        "lastModified": 1716431128,
-        "narHash": "sha256-B+pNhV8GFeCj9/MoH+qtGqKbgv6fU4hGaw2+NoYYtB0=",
+        "narHash": "sha256-t3T8HlX3udO6f4ilLcN+j5eC3m2gqsouzSGiriKK6vk=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "23c63fb09334c3e8958b57e2ddc3870b75b9111d",
+        "rev": "7ffc4354dfeb37c8c725ae1465f04a9b45ec8606",
         "type": "github"
       },
       "original": {
@@ -27,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1715930644,
+        "lastModified": 1716448020,
-        "narHash": "sha256-W9pyM3/vePxrffHtzlJI6lDS3seANQ+Nqp+i58O46LI=",
+        "narHash": "sha256-u1ddoBOILtLVX4NYzqSZ9Qaqusql1M4reLd1fs554hY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e3ad5108f54177e6520535768ddbf1e6af54b59d",
+        "rev": "25dedb0d52c20448f6a63cc346df1adbd6ef417e",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1716409441,
+        "lastModified": 1716456952,
-        "narHash": "sha256-9H4tYbE2JAB+2+zc+ZfjKgaFa/dVsg80Bn1pv7lsw14=",
+        "narHash": "sha256-fd57j4M++Fte1hrRZkDIqGbYbimqPNmERlFr/Fbh1Ek=",
         "ref": "refs/heads/master",
-        "rev": "87aeda54c8ce2f34e22585c158021636801c8c1f",
+        "rev": "f5abdf254dbee888be5f65c96a4a571f2a91da91",
-        "revCount": 24,
+        "revCount": 28,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },
@@ -101,11 +101,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1716293225,
+        "lastModified": 1716330097,
-        "narHash": "sha256-pU9ViBVE3XYb70xZx+jK6SEVphvt7xMTbm6yDIF4xPs=",
+        "narHash": "sha256-8BO3B7e3BiyIDsaKA0tY8O88rClYRTjvAp66y+VBUeU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3eaeaeb6b1e08a016380c279f8846e0bd8808916",
+        "rev": "5710852ba686cc1fd0d3b8e22b3117d43ba374c2",
         "type": "github"
       },
       "original": {

hosts/common/core/sops.nix

@@ -1,9 +1,8 @@
-{ pkgs, inputs, config, ... }:
+{ pkgs, inputs, config, username, ... }:
+
 let
   secretsDirectory = builtins.toString inputs.nix-secrets;
   secretsFile = "${secretsDirectory}/secrets.yaml";
-  hostname = config.networking.hostName;
-  username = config.username;
 in
 {
   imports = [
@@ -17,10 +16,11 @@ in
     age = {
       sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     };
-    secrets = builtins.merge ({
+    secrets =  {
         "passwords/root".neededForUsers = true;
-     })
+        "ssh_keys/deploy_key/id_ed25519" = {
-     if username != null then { "passwords/${username}".neededForUsers = true; } else {};
+          path = "/etc/ssh/deploy_key-ssh-ed25519";
+        };
     };
   };
 }

hosts/common/optional/openssh.nix

@@ -23,5 +23,11 @@ in
   security.pam = {
     sshAgentAuth.enable = true;
   };
+  programs.ssh.extraConfig = '' 
+    Host git.bitlab21.com
+        IdentitiesOnly yes
+        StrictHostKeyChecking no
+        IdentityFile /etc/ssh/deploy_key-ssh-ed25519
+  '';
   networking.firewall.allowedTCPPorts = [ sshPort ];
 }

hosts/common/users/media/default.nix

@@ -3,6 +3,8 @@ let
   pubKeys = lib.filesystem.listFilesRecursive (../keys);
   hostname = config.networking.hostName;
   sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/media".path;
+  secretsDirectory = builtins.toString inputs.nix-secrets;
+  secretsFile = "${secretsDirectory}/secrets.yaml";
 in 
 {
   users.users.media = {
@@ -19,6 +21,19 @@ in
 
   };
 
+  sops.secrets."passwords/media" = {
+    sopsFile = "${secretsFile}";
+    neededForUsers = true;
+  };
+
+  sops.secrets."ssh_keys/media/id_ed25519" = {
+    path = "/home/media/.ssh/id_ed25519";
+  };
+
+  sops.secrets."ssh_keys/media/id_ed25519.pub" = {
+    path = "/home/media/.ssh/id_ed25519.pub";
+  };
+
   programs.zsh.enable = true;
   programs.fuse.userAllowOther = true;
 

hosts/common/users/sam/default.nix

@@ -3,7 +3,8 @@ let
   hostname = config.networking.hostName;
   pubKeys = lib.filesystem.listFilesRecursive (../keys);
   sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/sam".path;
-
+  secretsDirectory = builtins.toString inputs.nix-secrets;
+  secretsFile = "${secretsDirectory}/secrets.yaml";
 in 
 {
   users.users.sam = {
@@ -23,6 +24,11 @@ in
 
   };
 
+  sops.secrets."passwords/sam" = {
+    sopsFile = "${secretsFile}";
+    neededForUsers = true;
+  };
+
   programs.zsh.enable = true;
 
   home-manager = {

hosts/sparky/default.nix

@@ -1,6 +1,8 @@
 { inputs, config, lib, pkgs, outputs,... }:
 let
   sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/root".path;
+  secretsDirectory = builtins.toString inputs.nix-secrets;
+  secretsFile = "${secretsDirectory}/secrets.yaml";
 in
 {
   imports =
@@ -48,7 +50,7 @@ in
       "/etc/ssh/ssh_host_ed25519_key"
       "/etc/ssh/ssh_host_ed25519_key.pub"
     ];
-    users.${config.username} = {
+    users.media= {
         directories = [
           "sync"
           "keep"