use a dedicated SSH key for agenix

The key is still stored in 1password, and we add a script to
synchronize the key to the host.

The existing keys have been rekeyed with the new key.

1 files changed, 9 insertions, 0 deletions

diff --git a/flake.nix b/flake.nix
index 0b1a537..fcbb262 100644
--- a/flake.nix
+++ b/flake.nix
@@ -63,6 +63,7 @@
         system:
         import nixpkgs {
           inherit system;
+          config.allowUnfree = true;
           overlays = overlays;
         };
 
@@ -182,6 +183,14 @@
                   echo "> darwin-rebuild build was successful ✅"
                   echo "> macOS config was successfully applied 🚀"
                 '')
+                (pkgs.writeScriptBin "sync-agenix-key" ''
+                  set -e
+                  echo "> Copying agenix SSH key from 1password ..."
+                  mkdir -p ~/.ssh
+                  ${pkgs._1password-cli}/bin/op --account my.1password.com read "op://Private/agenix/private key?ssh-format=openssh" > ~/.ssh/agenix
+                  ${pkgs._1password-cli}/bin/op --account my.1password.com read "op://Private/agenix/public key" > ~/.ssh/agenix.pub
+                  echo "> agenix SSH key copied successfully 🔐"
+                '')
               ]
             else
               [ ];