fix(kyber): rotate age identity

[shunkakinoki]

What changed

• replace Kyber's missing age recipient with a newly generated host identity
• re-encrypt the shared GitHub SSH and GPG secrets for Galactica, Kyber, and Matic

Why

Kyber had no ~/.ssh/id_ed25519, so Home Manager could not decrypt gpg.age and silently skipped importing the GPG signing key. Git operations requiring signed commits consequently failed.

Validation

• new Kyber identity decrypts both regenerated ciphertexts
• decrypted GPG payload fingerprint is 05979B68002DED282C2939C0C2E97FCFF482925D
• shellspec spec/activation_shared_spec.sh spec/activate_kyber_spec.sh (49 examples, 0 failures)
• make nix-format-check
• make nix-test

---

Summary by cubic

Rotate Kyber’s age identity and re-encrypt shared SSH/GPG secrets so Kyber can import its GPG signing key. Fixes failed signed Git commits on Kyber.

• Bug Fixes
  • Generated a new Kyber host identity and updated named-hosts/pubkeys.nix.
  • Re-encrypted gpg.age and id_ed25519.age for Galactica, Kyber, and Matic.
  • Verified decryption on Kyber and GPG fingerprint 05979B68002DED282C2939C0C2E97FCFF482925D; all specs pass.

^{Written for commit 4417854. Summary will update on new commits.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 690ba2cb-4dba-4d7c-86c3-d10c932f9aaf

📥 Commits

Reviewing files that changed from the base of the PR and between d502126 and 4417854.

📒 Files selected for processing (3)

• named-hosts/galactica/keys/gpg.age
• named-hosts/galactica/keys/id_ed25519.age
• named-hosts/pubkeys.nix

---

📝 Walkthrough

Summary by CodeRabbit

• Security & Access
  • Updated SSH key material for the Galactica host.
  • Updated the Kyber host’s registered public key to support authentication with the new key.

Walkthrough

Updated Galactica’s encrypted GPG and Ed25519 key files with new age recipients and payloads, and replaced the Kyber host’s SSH public key in the Nix public-key attribute set.

Changes

SSH key rotation

Layer / File(s)	Summary
Encrypted key material named-hosts/galactica/keys/gpg.age, named-hosts/galactica/keys/id_ed25519.age	Age recipient entries and encoded encrypted payloads were replaced with new key material.
Kyber public key registration named-hosts/pubkeys.nix	The kyber SSH public key changed while the ubuntu@kyber identifier remained unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• shunkakinoki/dotfiles#412: Updates the Galactica-to-Kyber SSH key synchronization setup using the same key files and public-key mapping.

Poem

A rabbit hops through encrypted snow,
New keys in tidy rows now glow.
Galactica guards its secrets tight,
Kyber’s public key shines bright.
Hop, hop—secure keys take flight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the Kyber age identity rotation and related secret re-encryption.
Description check	✅ Passed	The description is clearly about the same Kyber age-identity and secret re-encryption changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/rotate-kyber-age-identity

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[indent-zero]

PR Summary

Rotates kyber's age/SSH identity so the host can decrypt shared secrets with a new keypair while galactica and matic retain access. This is a routine credential rotation — updating the single source of truth in pubkeys.nix and re-encrypting the two shared ciphertexts on galactica. Verified the new recipient set (galactica + new kyber + matic) is present in both .age headers and the old kyber recipient is gone.

• Replaced the kyber ed25519 public key in named-hosts/pubkeys.nix.
• Re-encrypted named-hosts/galactica/keys/id_ed25519.age and named-hosts/galactica/keys/gpg.age under the new recipient set.

Issues

No issues found.

CI Checks

Waiting for CI checks...

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[mesa-dot-dev]

You do not have enough credits to review this pull request. Please purchase more credits to continue.

[mesa-dot-dev]

Mesa Description

TL;DR

Rotates Kyber's host age identity and re-encrypts shared SSH/GPG secrets for Galactica, Kyber, and Matic, fixing an issue where GPG keys could not be decrypted/imported and signed commits failed.

What changed?

• Host Identities: Replaced Kyber's missing age recipient with a newly generated host identity
• Secrets Encryption: Re-encrypted shared GitHub SSH and GPG secrets for Galactica, Kyber, and Matic using the updated recipient key

^{Description generated by Mesa. Update settings}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}