path: root/secrets/secrets.nix

let
  hosts = {
    vm-synology = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHKZAKlqOU6bSuMaaZAsYJdZnmNASWuIbbrrOjB6yGb8 root@vm-synology";
    mba = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDLQTIPZraE+jpMqGkh8yUhNFzRJbMarX5Mky3nETw6c root@mba-m2";
    do = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID6qsTQwvo6lUACTZKb4T+Je89bW3/BY4DB4aCTqfApz";
    rivendell = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID76U5kt8DfBbuP16rMzfBTVTpjjPFKWnnheMALaCQEd";
    argonath = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHi9jHqRjpMzXlznTXi4nEtlRlFfyIzB6Ur9A+HDfFoq";
  };
  users = {
    fcuny = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdyJepi/NyO6d9eP8m48Ga/gdjB5ENHRXYM1ZqFZR8t";
  };
in
{
  "acme-cloudflare-env.age".publicKeys = [
    users.fcuny
    hosts.rivendell
    hosts.do
    hosts.argonath
  ];
  "restic-pw.age".publicKeys = [
    users.fcuny
    hosts.vm-synology
    hosts.rivendell
  ];
  "nas_client.age".publicKeys = [
    users.fcuny
    hosts.vm-synology
    hosts.rivendell
  ];
  # this is the SSH key we use to access the remote builder.
  "ssh-remote-builder.age".publicKeys = [
    users.fcuny
    hosts.vm-synology
    hosts.mba
  ];
  # this is the SSH key for the digital ocean droplet
  # the public key is ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID6qsTQwvo6lUACTZKb4T+Je89bW3/BY4DB4aCTqfApz
  "do/host-ed25519-key.age".publicKeys = [
    users.fcuny
  ];
  "do/wireguard.age".publicKeys = [
    users.fcuny
    hosts.do
  ];

  "vm-synology/wireguard.age".publicKeys = [
    users.fcuny
    hosts.vm-synology
  ];

  "rivendell/wireguard.age".publicKeys = [
    users.fcuny
    hosts.rivendell
  ];

  "argonath/wireguard.age".publicKeys = [
    users.fcuny
    hosts.argonath
  ];
}