[sops] change reproducible secrets file structure

machines/.sops.yaml

@@ -95,7 +95,7 @@ creation_rules:
       - *admin_kalipso_dsktp
       age:
       - *admin_atlan
-  - path_regex: secrets/keys/itag/.*/.*
+  - path_regex: .*/secrets/.*
     key_groups:
     - pgp:
       - *admin_kalipso

scripts/add_new_host_keys.sh

@@ -16,22 +16,24 @@ if [ ! -e flake.nix ]
     done
 fi
 
-pwpath="machines/secrets/keys/itag"
+pwpath="machines"
+hostkey="ssh_host_ed25519_key"
+initrdkey="initrd_ed25519_key"
 read -p "Enter new host name: " host
 
 if [ "$host" = "" ]; then exit 0
 fi
 
-mkdir -p $pwpath/$host
+mkdir -p $pwpath/$host/secrets
-cd $pwpath/$host
+cd $pwpath/$host/secrets
 
 # Generate SSH keys
-ssh-keygen -f "$host" -t ed25519 -N ""
+ssh-keygen -f $hostkey -t ed25519 -N ""
-ssh-keygen -f "$host"-init -t ed25519 -N ""
+ssh-keygen -f $initrdkey -t ed25519 -N ""
 
 #encrypt the private keys
-sops -e -i ./"$host"
+sops -e -i ./$hostkey
-sops -e -i ./"$host"-init
+sops -e -i ./$initrdkey
 
 #generate encryption key
 tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20 > disk.key
@@ -40,7 +42,7 @@ sops -e -i ./disk.key
 # Info
 echo
 echo "Hier ist der age public key für sops etc:"
-echo "$(ssh-to-age -i ./$host.pub)"
+echo "$(ssh-to-age -i ./"$hostkey".pub)"
 echo
 echo "Hier ist eine reproduzierbare mac-addresse:"
 echo "$host"|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/'

scripts/remote-install-encrypt.sh

@@ -25,7 +25,9 @@ fi
 
 hostname=$1
 ipaddress=$2
-pwpath="machines/secrets/keys/itag"
+pwpath="machines/$hostname/secrets"
+hostkey="ssh_host_ed25519_key"
+initrdkey="initrd_ed25519_key"
 
 # Create a temporary directory
 temp=$(mktemp -d)
@@ -40,13 +42,13 @@ trap cleanup EXIT
 install -d -m755 "$temp/etc/ssh/"
 install -d -m755 "$temp/root/"
 
-diskKey=$(sops -d $pwpath/$hostname/disk.key)
+diskKey=$(sops -d $pwpath/disk.key)
 echo "$diskKey" > /tmp/secret.key
 echo "$diskKey" > $temp/root/secret.key
 
-sops -d "$pwpath/$hostname/$hostname" > "$temp/etc/ssh/$hostname"
+sops -d "$pwpath/$hostkey" > "$temp/etc/ssh/$hostname"
 
-sopd -d "$pwpath/$hostname/$hostname"-init > "$temp/etc/ssh/initrd"
+sopd -d "$pwpath/$initrdkey" > "$temp/etc/ssh/initrd"
 
 # # Set the correct permissions so sshd will accept the key
 chmod 600 "$temp/etc/ssh/$hostname"

scripts/unlock-boot.sh

@@ -19,7 +19,7 @@ if [ ! -e flake.nix ]
     done
 fi
 
-diskkey=$(sops -d machines/secrets/keys/itag/$HOSTNAME/disk.key)
+diskkey=$(sops -d machines/$HOSTNAME/secrets/disk.key)
 
 echo
 if [ $# = 1 ]