machines/.sops.yaml

@@ -18,6 +18,7 @@ keys:
   - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
   - &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
   - &machine_ns1 age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
+  - &machine_goldman age10gk6kydhljjk99vmaj6z0sz5d9x7pwp458gpr3hzqpl5hh04z5xqgley7j
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -132,6 +133,14 @@ creation_rules:
       age:
       - *machine_ns1
       - *admin_atlan
+  - path_regex: goldman/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *machine_goldman
+      - *admin_atlan
   - path_regex: .*/secrets/.*
     key_groups:
     - pgp:

machines/goldman/configuration.nix

@@ -10,13 +10,20 @@ in
   imports =
     [ 
       inputs.gatekeeper.nixosModules.gatekeeper
-      ../modules/malobeo_user.nix
+      inputs.self.nixosModules.malobeo.users
       #inputs.nixos-hardware.nixosModules.raspberry-pi-3
       (modulesPath + "/profiles/minimal.nix")
       #(modulesPath + "/installer/sd-card/sd-image.nix")
       ../modules/autoupdate.nix
     ];
 
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+    backup = false;
+    hostKeyLocation = "/etc/ssh/ssh_host_ed25519_key";
+  };
+
   fileSystems."/" =
     { device = "/dev/disk/by-label/NIXOS_SD";
       fsType = "ext4";
@@ -59,18 +66,13 @@ in
       settings.allow_anonymous = true;
     }];
   };
-
+  sops.secrets.gatekeeperEnv = {
+    sopsFile = ./secrets.yaml;
+  };
   services = {
     gatekeeper = {
       enable = true;
-      envFile = pkgs.writeText "env" ''
-        MIFARE_APP_MASTER_KEY="7b195adb892073c9e34ebe7e0ca28b2b"
-        MIFARE_ACL_READ_BASE_KEY="741a50f2b189cc9f151e0600f50a6e1a"
-        MIFARE_ACL_WRITE_BASE_KEY="f1aa99f81cca268de98d422ee0ccb65c"
-        SECRET_KEY="8b14d0b447bff7efa24d5019cc59a999786e31f6f865173bbd642bf18de5ad85"
-        MQTT_HOST = "localhost"
-        MQTT_PORT = "1883"
-      '';
+      envFile = config.sops.secrets.gatekeeperEnv.path;
       mock = "False";
     };
   };

machines/goldman/secrets.yaml

@@ -0,0 +1,64 @@
+gatekeeperEnv: ENC[AES256_GCM,data:BwfUsw95AlrPdp68URZsEzUrVtphPtWpsCzkPRdFlC6fH5XM5Om3UNG+fmJce9bWyH2pA4aRcYuJKgQhrk8NttXt9O4nsqE3X7pgRuv2ruZ2A4g0yXZo+smCXFhp9VADCB7VbO18/UbZhi6SHSuSgrlk//8BygTKdrzVNDw0sTOOAKTlGPGLUbjqzLh18bgytVArROOwEs/LO3oQoTyATT01TInczQHqFC+0+PVCKp30jn3QGrOf5tL5OBtqSmlkJUtsh87zZ8npJ0VOF05yBiSEdYKt3ljCha8o9AUfGSJZ6VSWQt+dbYnfeuiAkHWjoR2hYL387k9/dN0i4/fXL1piC7QWIGfd0M8DfS1Jib+CWBUuEEE5XnUuX4tyV07jMGP4OGSwbvA5q1rRIXFtF6HR/ZXyMA6KSwPpejf0QEoZfu6UKvT42uWk5IxYq06YQsfoKjgGXw0wVn1OA/HhIqUIC82KzyS6BV06X8AgDy2dM1k77bjKI01ewW0XcOjErP2og93oqF+skrA7dtJ4gQtkEIKG7K2+Z2EjCZSiTARYG/yHI/D+M2C4SmO22UhgJ3CMDULtlMvto35fzojQokZbflp34lPT4XzziWr/EAmupzG3ZGxjhr51L6hK7HiZbrB8enmaAhUBeNaNzAo7W4CyOm9MvQbUdZvz,iv:zyZgbwKxG9w2OUFeJVB3scXedzFyInGdR4LPVf4F2GE=,tag:DUFeJ1Qj6i/bg1Nv/zgOyg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZVNEdENac1RGaXdzb0ox
+            aXJvQ3RhOHZULzVUMjIzVkFKMUp0aG00ZHlnCmFqQmlLbmZQVUUveG1INGVnbW5x
+            OE1HOUx1TmR6bERuUGxYUjNwSGoyRlEKLS0tIE1tWEJXQk5CT1lMdmdad2FTOENa
+            NW9lOTd5TGNobFN5VFR4Q2xIMjk3MkkKj85PvBY45bF4UlwQ2BhCjmfLdpWvtuD5
+            MmBql3JijU22TVh4d85tvKGrxmwMPenLC+GzawR0wbMXKKwmGu+Tqg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age10gk6kydhljjk99vmaj6z0sz5d9x7pwp458gpr3hzqpl5hh04z5xqgley7j
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4UlYvam94d1hvbmRpdHI2
+            dEhocE5ZQUkwQ1ljcDlwYVZYelRTcHI3T0VnCjVURFNvc1c3Q2tTNXB1cXE5SWZj
+            aXl6YU9TMmJNaERGT1pOZWFEVG9tNDgKLS0tIEE2TzZ2eTJlQXMzOUp5UXIvMGFU
+            b0o0VFdNZGpjOWRSSmQ2RWlkUm9IZkkK33kOgGs5K8QEYwQ/n65y+Lftio1A6SGD
+            UK46fFb+yAoK/H3XRgzot0dt8+7RBTCJwNF+1tHWPl2Nk/1KY2bJ1g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-11-10T14:44:01Z"
+    mac: ENC[AES256_GCM,data:70/rcqZJ5H1wTnEDAPo3MZEVrbAqwifgHu8+gdnc5E0K3Ng2dYWR/LyeX8FiaAssmchVk6kQE+1HQygLm5dk87F26Niu4Y098v0YY3XG5PrzaltRho6voBNRyORb6MtOPIZrMgooUD22hVZJq/0aG+slas3eP+YbbGu1my75/84=,iv:DlEMElxoV/ciX1g6ZdEAFWnejGPKKqxJ3oxaZRXi/3c=,tag:5kraajN1jIaF44g7fGMs/g==,type:str]
+    pgp:
+        - created_at: "2026-11-10T14:43:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQwAmZuazwF5B/LTZMEe6nV+TBPubQN2b4CVI8HEFwfFKPeM
+            sKhn8isOnf+Q7gonZVLRiSraMc/Ttj2VZEJDA1Y76GSBNQK5irIQsYHl6J7fd2c4
+            85+YBbNiFLeSTmUMdkqjRDeo49o2J0ItAy7nwtiqpL59rLVcUq5cPvAHiaEGSTes
+            c1qe23BpRuagvKlzKYOoauGD3cDNyQ+jOhfJxsROlrsAL2N+1QNhIxE95JGhDnX9
+            AirNruuufDGVBsryZVUDo8fdZzc+p5CsL9UHMgowLiH+UjmfEvEr1y6uNgQnjhG3
+            SMVf0qnbJNI7jSpRtnLYg/x0y3NxcmZEWvTqJ7s1LoM3z8Fc8iSYz9W6xLmZXZMg
+            LxmYfd3tmYyE7CAKQ7UAPs0yu9YGbLP9hNRhALEW9mse8wpgQ377wl6nB7CtF3dT
+            F64zrB9P72RAHrn882LQac4gY7hAERkGzgtC1zOfPBUTHUo+b839lNQ1nBDYzNr9
+            On85Sud8dAd2mLEaCCG60lgBDdYz5kzoXkY7trpIG+w9YLJhOwXt4jMsbTlQTs2x
+            NFnCUxik+W65Bl7PIACCmfjsdPoiGy/yrdeAblCZlthjy4AkKlaRb4NpdTKt3tSc
+            9v+JtcrlUFpC
+            =Bhqc
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-11-10T14:43:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ/6Awh/C2TD7Bz3JrOE4+aKm79MuHYHCjwqat2F/bfpRANr
+            MqEjrKi1YpfcPoSd05FbmjJgXdp3vHk1xz7n28rjEtqdNhV30bWyvEEc+XOpcyPV
+            hjAzHcw93Hk7PZDRsq70JhwXo4GFwI+jamgtxKy3stcCeUPpjvX97Z9GhGLhPh+3
+            PVoAR13p0NtliYVLs53IYnJ1ZkAsGoyNaTdjAT4FgeIrXJxfW1QS+8A51ERNpW8f
+            i+GfvYdZhgjBh187hCvPdkW6Bl5tk3Rf9fOTKIQe3mrrqYzzzESQy43UskFod0I4
+            IOobruNzm6nxmdzA9tFITYFljtWSAH3HQMokY+UufsRuJWgc6r+osPWVGZTGrMF8
+            HYly3lYNZ5alwevk5R/jQ1cTQFrRbJr3+iRR6FNVf/clnLLnRzsjAbxlQobFW7tb
+            YxyQYMh7f8jXvl/T+HYM6yM8G4qtFYmaRVhnssHFvyOcBxNTc1rOvr4xrLLX+QG7
+            YYZiS+JYh3/Jf4SGahc4UW9Qq19spBSXz9nAy+WJ+wFv1UUQwBTDxne2dO8DMCQv
+            J5BI0tGc7LiavFJPnUkFtFMvl/+Q56QE6lALc8M0HmEOX4m2y/8HJdptyXO/DasZ
+            y23JHAOxFRgOWbiVEsNjtT2n2wCP3gkZrqYP2XKMTdLXSfvlRbKs/oUlzgMFUBXS
+            WAHCyiUKfKq3CkTknBAORgZDMqbX2L6uFLkDKdoD7XREzJruYxUOfmuzvgUI2/iR
+            RXdxeKrJhCRYTrKwyTO00eT0W+IK08E0clZM0SrMjsbggoYtOcAElyE=
+            =brjr
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

machines/modules/malobeo/users.nix

@@ -21,6 +21,11 @@ in
       default = false;
       description = "enable backup user, ";
     };
+    hostKeyLocation = lib.mkOption {
+      type = lib.types.path;
+      default = "/etc/ssh/${hostName}";
+      description = "path to the hostkey used for sops. Defaults to '/etc/ssh/${hostName}'. Change to '/etc/ssh/ssh_host_ed25519_key' for migrating other machines.";
+    };
   };
   config = lib.mkMerge [
     (lib.mkIf cfg.malobeo {
@@ -81,13 +86,14 @@ in
     })
     {
       users.mutableUsers = false;
+
       services.openssh.hostKeys = [
         {
-          path = "/etc/ssh/${hostName}";
+          path = cfg.hostKeyLocation;
           type = "ssh-ed25519"; 
         }
       ];
-      sops.age.sshKeyPaths = [ "/etc/ssh/${hostName}" ];
+      sops.age.sshKeyPaths = [ cfg.hostKeyLocation ];
       environment.systemPackages = with pkgs; [
         nix-output-monitor
         vim