Rekey secrets

secrets/cube/password.grafana.age

@@ -1,5 +1,15 @@
 age-encryption.org/v1
--> ssh-ed25519 +rZ0Tw 9dsCOc/hpTof2yjqGKzAJozjXnc0RPgnv3pNaccmBAQ
-s6+1D/Sn6tuIh3aIbgBHYKTATyGbQKcaKPW+6HvMNFQ
---- pr1ZimpiaA8RO8Oayn6tHJN+rTGSLxcaddmYWpSiWLs
-"LÜàPœw5¿Û&<26>Ž C"Â\ø¬íòŽTQD¯IZdê¤ìˆV÷Â\d
+-> ssh-ed25519 +rZ0Tw gE4UBo2Znt0jAme9xbdFguMCZd+EyZ/2hVFF6mz26SY
+uNg+9uEluZ4wkQmPbc75PHNiBOrnVUAZQJGrPBlgE1g
+-> ssh-rsa jPaU3Q
+lT5OMZ9jGGwGDLap9gymqEtyolF7pXVflP8nZKxaYpJSZzr+3rJfK8zmPGUnj4JM
+Do3nAF+a5+dnsDjUKYlkWBlx1wyOkd98WBOi0xSnVf2tqpTz9zBWsMQpW7zu2gLV
+c7gMKfbQUGSTVblsFCuGfa+6lSqmm6enfnVlKWgN3M+slOS+leAXI2/C12QVT8pb
+Y7l0fVXF3PW1qaaMQQd7sXGKovAJ0F8E+rHFVW2VxrWBJuMNf5LD/uiahduEwcho
+luOTo7FzMh87C5L8iZaZn/UXDkE9EBzwZjHtf2a+No3xjN1enNM+eJ2qxglkGRkm
+zrEOd5MOEztnXR31M0OMp/vU0vxLEVOQa367ufTXcCxHCc0BcM6Oz3wBMZRQATle
+p9ipDWu98Vu7ezxDUVq7pzaH3FM3jcfErGhQa2t2mV0pJpZh6RTNJ1ThHxZeAODc
+pxhXXht0Fbdk4bDEX5eTND3wmWBFAGhpwoxHe4gBNoeN+tMuINGJ6E7LJBOOWIPe
+
+--- 3UdrGoYrc+XIpua3j8FPRNOuWtEs83UHQEwwGWL+u6k
+<EFBFBD>*nyﾔ1ﾒｪﾌ｢<EFBE8C>_景B<E699AF>~<7E>3怨ﾎ槢<EFBE8E>P`ﾉ<>ﾍ階)P<>

secrets/cube/password.hash.mail.age

@@ -1,5 +1,16 @@
 age-encryption.org/v1
--> ssh-ed25519 +rZ0Tw TfBRX20lzpvdqJbfLfLxVrEtmyLugZP4R+ciIS+2OU8
-6cDklEH6JENEOYXyEOfIx8PWp+WordD2LD+qaDIL1pU
---- whtZ9Gb9dGroDe6lkwzXnWE5bKPEXEbAFhQBJyaoyyY
-ßÞ~ÿœ»Ø|<7C>ô*(Ë>N•\ÅöÏš†ˆBªï¤é¶po]oTüç ±<>-K?õÃ9xV7¶Ü!)í,‰á<ø¼¸}Ã*8­N“ÛÅéÅÍ¥<[–å¯K‡Ú
+-> ssh-ed25519 +rZ0Tw z6CvqSwbBQJGRRSBRcxcNjV7llQ8Ar9SMoWe5eZmWRM
+ToYvbyOx7oPC6ZlZJyVFsG+XxknpYEIls2pGw8Zzu2A
+-> ssh-rsa jPaU3Q
+utCXtQPzKTmQhEwk8tugo2rFpa8k4MYLW1gea5nJQZzpnhUUq9KZWv238eyBGor1
+MtyWz8ny7kXSXr9TvcUTG6m5nMc0/fqsoQW8dT4//h95r5WMx1Z1lrPXw42NiQrv
+UzDsDjXTPBl4I2h2D6p5u/ue+7rWXIpyj5MHLCMu2nIxaEcE2H62POUofIe3qOa4
+mQLuSdYc9nnTXar+gcI2peaZKcCMaPezHBuL3SMq98XFKOxOmdtkqioi5MtMh0ky
+I97VBJE9NDDaVq9+H8TuB30KYypuFwb9VYCG2J17kyN4zqk6d5HXOgP0wuC3a+/X
+4BRSkNcn6gDdLXD/QwiYaQo1FZa7uoDl1BWvdPCVgjgaOhp9QMwLUA4un5FJtzau
+gR2BsGzierqhjlkJPO/zrskzVT0h57YdgDR0pquuN9zJ5nTU817PklBGnb/lm1aJ
+G95Flt5U3hIL7Pe0i9Pow/n37ssEuMM25/qt+j5VD/Z95y60pOzuyyZFvVK3hNxe
+
+--- vbgQAwzPDqiIFNpUW3iKiVTyS5XCZqz2t0T/sGwbxKw
+A`(‚ÄZnD<6E>ĂŇ –9Żäzo@µ
—M`pÚ<ÎóMŐžW-<2D>
+NµQ˘F|:îÔQ7¸‰ż<12>š©;Ř虸IE®ťµ¬1‡qzČĚPű÷Ţ&s·~ÚşşÉŐ

secrets/cube/password.nextcloud.age

@@ -1,6 +1,15 @@
 age-encryption.org/v1
--> ssh-ed25519 +rZ0Tw nC4kjQMxf3JqdZdJr4h1pTMQeeeBrS9WSaw/nGXFDgY
-KcHS4hDRdljdUxfjzoSwHoRlQwKX0Dc9VqNjaDSfkxQ
---- aN1U3QWGIJ9wq7kB8ey+GnaFLoIcGKYqgcHXAveuH7s
-<p#6èÜÆ«…©3a‘
	
娔PvZØ1V
-2YO
¾®f	.W®
+-> ssh-ed25519 +rZ0Tw Xag13LAVfzVrAgZ3OmMfP2CubVNCIqvY/5BY/4/zjxA
+d9tExq+6E4G5V9r2cj8glFw00MmpVmPvGrNu+jwFhWA
+-> ssh-rsa jPaU3Q
+Rr9saxBynuTVU1uch+YJXgGMkeUC3seOkpzhwSLZ0Gm4mMkzYeZ42OJCi2a8E6lb
+Uz+qFaG7tk9eHhnitZYg9SDr/WjVly15DtF1SZIJSwkGIa17hHusfNr3h72rAqIx
+XXNbS1OC/FzK/uTghshpWxuM6wFjLNPVoUSsdAqZkWZIO0ZGzFY18lbTO4FJeFxe
+Z5Uuze/spW/Eoi0auUJdHTC3WkKXkjshMa3nttIi9nvEQAlEgjJanievAJoU3aQV
+aRlQeK9rJor9hpA5dEIDAiu7wHKxZ6Y3Z3Lgj0I+4eqbjh3m3aYzieM5stQW5zpI
+Nhd0bYFPK3KFcKW+xWyXo5hdJWYuE59KZzZD66m1pob3TI9+aadZlmW4sSas8XLX
+a1MmCOKUTKDZJkEWmzPQ+RG3SAtrWieQV/u6q+APSNFxZitKoUbzZ5oxMsKpOcRL
+Zr7mOJ2zrcsCWSpb0OMmusYBUIkvf2PmBlRN2DPVRoYaoLPIMrjQOY+iTf+HYCHv
+
+--- K5pWJItZmcY3jTdgOQ65PwfAsfpfWtVxvM0ABIffdwk
+‡„f%-4m)ôµ¾zZ¦Q“,©œtÛkd¦_Uòס<C397>¥ˆ…i•0¥m3Ñ>

secrets/enka/password.hash.said.age

@@ -1,13 +1,13 @@
 age-encryption.org/v1
 -> ssh-rsa jPaU3Q
-fcLnXbOJUuKFwACpygk4zFbvl77TiC/xhsqYKjqOBbuWUq29rvj1nBVAXMkaKBtY
-NZmJ21FIvvYhu7Yt8C49ePVdHbQnxix9TDjzAz8D3G3uuKcBJ8SO9t2faA64hPjV
-uNHWO5KMrtjdmYl195yg2BS//gBMgQVcoOSkE1ydla8Dso4pv27x6ZULVqeTlV+Z
-WMuK6RUknqJqlCLjaAIcUd7y/ALZJFucJ6yJk4JtUVbyxEYGt52wBEiELD/rXWop
-LWMgzKnLrL5xK07Z+9X94HUigtOMvpUDQUak6e4P46cZwzic6qZOCWBswnkQSuIe
-yWkGD0hpYkCDNlUkQXAs2jqICbpGXCNQ3plCeFp84B0hSs1gcg3gSkY8S8s9vUIv
-yx/BGdqz/Ev6tvqvYpSB8EN3bMEXzhW1wr698GFQVHNdcIAQrhuyPboa5rbsJZn5
-KueQnyH0ZNCBYs1tJC3u9IjRjS1Zi8i86nWmLvpKa6RXKHqVsbvi2Llvqn7SSE2o
+ME9B1Sxvl5SLczswQ8HVigafUPh/VGqXeZaYjYUQjQNqEkzG8DKknNU2QE5gey6Q
+5hsxfs7FiM/zBfuDQwILD+BdZ56WGsdINzHpSYRifYsDGRawid9Yz/aPAfR765Ey
+LFK0af8uftBaCIXuZtt2Gxk9uXDE9MkkbgVxWPaCzpGYSibDhHd10GiBB74ZBvvD
+ZZah25fUs5lGwqxIGKqpoR3U4Q2xSmIJmohV9VVe1nb7rHIRnHVdtyqDU+O40H0p
+fTUdfii7/gMnBkyOJXf1eTVHlkGWAD0z6gTopuqoA6GsSQEMR8BpgorxW20iKA2/
+U0ObTXE8vJAa+LzUP4jC4wbnlfssu5fovAFCR7FVvVLRNUhodgviYDNwsnU0MbaO
+qcLAN2AB80GnEnkuoWt87zrxQ5c/Vz3ReniXz0M7ldGm5xxDCjDPM3t992QsfHwC
+aTD9G5M7m1oGLkOmaaVnBjloBC102rfUkZGZ3G28pADkrZ3hfzYJq4BZPO3ZWnBH
 
---- mkKbbwjMlBGtzye+ey4JDdT1zWxoI6nU2l8pNlG44ow
-)nÒ_ßK¢=M\`ÿ&…ró¹ÐÓvVŸ#ï§)<29>ÚNóš•q°ß¸<C39F>UÔ“»(ܸOÚ‹³¤Z‚f3ÌÏÍxºB9šeE…S£ãݫа¿ê#ò1uä°%ý¢b
+--- kPfZZIIt+QXsp14bYidmWXGkeFLJHzo4gIzL9uUihEE
+<EFBFBD>“²K2Óz}e½TMš<4D>åà©lúafj"3§&é\:õeù¨`Ø`òJ»‘"³åÞ_¶¬† †€N©¬Í®˜]EœK'eqNl…ì#<23><>ìBŸúÌyjo

secrets/secrets.nix

@@ -1,21 +1,26 @@
-rec {
+let
   keys = {
     rgbcube  = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDRSLWxpIMOZIQv9ggDnAwSxmux/TZvuEPgq2HFiH+oI2OE07xYQAiroBVI5HH+aIg1nwpYtArANoD8V9Hrx2XCo2py/fMi9LhJWNMlFVcRLqYrCmrZYhBqZhxXIdY+wXqkSE7kvTKsz84BrhwilfA/bqTgVw2Ro6w0RnTzUhlYx4w10DT3isN09cQJMgvuyWNRlpGpkEGhPwyXythKM2ERoHTfq/XtpiGZQeLr6yoTTd9q4rbvnGGka5IUEz3RrmeXEs13l02IY6dCUFJkRRsK8dvB9zFjQyM08IqdaoHeudZoCOsnl/AiegZ7C5FoYEKIXY86RqxS3TH3nwuxe2fXTNr9gwf2PumM1Yh2WxV4+pHQOksxW8rWgv1nXMT5AG0RrJxr+S0Nn7NBbzCImrprX3mg4vJqT24xcUjUSDYllEMa2ioXGCeff8cwVKK/Ly5fwj0AX1scjiw+b7jD6VvDLA5z+ALwCblxiRMCN0SOMk9/V2Xsg9YIRMHyQwpqu8k= nixos@enka";
     cube     = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINMkCJeHcD0SIOZ4HkyF6rqUmbvlKhSha3HWMZ0hbIjp rgb@cube";
   };
 
-  "cube/id.age".publicKeys = [ keys.rgbcube ];
+  server = key: [ key keys.rgbcube ];
+  normal = key: [ key ];
+in {
+  inherit keys;
 
-  "cube/password.hash.mail.age".publicKeys = [ keys.cube ];
-  "cube/password.hash.rgb.age".publicKeys  = [ keys.cube ];
+  "cube/id.age".publicKeys = normal keys.rgbcube;
 
-  "cube/password.acme.age".publicKeys = [ keys.cube ];
+  "cube/password.hash.mail.age".publicKeys = server keys.cube;
+  "cube/password.hash.rgb.age".publicKeys  = server keys.cube;
 
-  "cube/password.grafana.age".publicKeys   = [ keys.cube ];
-  "cube/password.mail.grafana.age".publicKeys   = [ keys.cube ];
+  "cube/password.acme.age".publicKeys = server keys.cube;
 
-  "cube/password.nextcloud.age".publicKeys = [ keys.cube ];
+  "cube/password.grafana.age".publicKeys   = server keys.cube;
+  "cube/password.mail.grafana.age".publicKeys   = server keys.cube;
 
-  "enka/password.hash.orhan.age".publicKeys = [ keys.rgbcube ];
-  "enka/password.hash.said.age".publicKeys  = [ keys.rgbcube ];
+  "cube/password.nextcloud.age".publicKeys = server keys.cube;
+
+  "enka/password.hash.orhan.age".publicKeys = normal keys.rgbcube;
+  "enka/password.hash.said.age".publicKeys  = normal keys.rgbcube;
 }