nixos-servers/nixos/secrets/secrets.nix

# TODO: Just encrypt each file with all hosts' public keys (plus our personal public keys) and deploy when demanded.
let
  pkgs = import <nixpkgs> { };
  lib = pkgs.lib;
  secrets = {
    jefke = {
      publicKeys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIJUSH2IQg8Y/CCcej7J6oe4co++6HlDo1MYDCR3gV3a pim@x260"
      ];
      encryptedFiles = [
        "jefke_host_ed25519.age"
        "jefke_user_ed25519.age"
        "postgresql_server.key.age"
      ];
    };
    atlas = {
      publicKeys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKZ1OGe8jLyc+72SFUnW4FOKbpqHs7Mym85ESBN4HWV7 pim@x260"
      ];
      encryptedFiles = [
        "atlas_host_ed25519.age"
        "atlas_user_ed25519.age"
      ];
    };
    lewis = {
      publicKeys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL5lZjsqS6C50WO8p08TY7Fg8rqQH04EkpDTxCRGtR7a pim@x260"
      ];
      encryptedFiles = [
        "lewis_host_ed25519.age"
        "lewis_user_ed25519.age"
        "database_passwords.env.age"
        "borg_passphrase.age"
        "ec2_borg_server.pem.age"
      ];
    };
  };
in
lib.attrsets.mergeAttrsList (builtins.map
  ({ publicKeys, encryptedFiles }:
  lib.attrsets.mergeAttrsList (builtins.map
    (encryptedFile: { "${encryptedFile}" = { inherit publicKeys; }; })
    encryptedFiles))
  (lib.attrsets.attrValues secrets))