feat(agenix): configure SSH key sync from galactica to kyber #412
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,14 +1,23 @@ | ||
| let | ||
| # Galactica's SSH public key | ||
| galactica = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEKze2jlpV7SyTKA2ezqbumpCiDn+5Sj4z5SxrqfzesX shunkakinoki@gmail.com"; | ||
| # Kyber's SSH public key | ||
| kyber = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO0IZtP3KSzY6GVSZ+R+VQYYfu3sEOVaQGDblQxAtwNM ubuntu@kyber"; | ||
| # All machines that can decrypt shared secrets | ||
| allMachines = [ | ||
| galactica | ||
| kyber | ||
| ]; | ||
| in | ||
| { | ||
| # Shared SSH key for GitHub authentication (accessible on all machines) | ||
| "keys/id_ed25519.age" = { | ||
| file = ./keys/id_ed25519.age; | ||
| publicKeys = allMachines; | ||
| }; | ||
| # GPG key (galactica only) | ||
| "keys/gpg.age" = { | ||
| file = ./keys/gpg.age; | ||
| publicKeys = [ galactica ]; | ||
| }; | ||
| } | ||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,38 @@ | ||||||
| #!/usr/bin/env bash | ||||||
| # Remotely rekey galactica secrets to include kyber's public key | ||||||
| # This script should be run from kyber to trigger the rekey on galactica | ||||||
|
|
||||||
| set -e | ||||||
|
There was a problem hiding this comment. The script uses 'set -e' but should use 'set -euo pipefail' for more robust error handling. This ensures that:
The reference script at scripts/update-gitalias.sh uses 'set -euo pipefail', which should be the standard for bash scripts in this codebase.
Suggested change
|
||||||
|
|
||||||
| echo "🔑 Rekeying galactica secrets to include kyber..." | ||||||
| echo "" | ||||||
| echo "This will:" | ||||||
| echo "1. Connect to galactica via Tailscale SSH" | ||||||
| echo "2. Run the rekey command to re-encrypt secrets with both keys" | ||||||
| echo "3. Commit and push the changes" | ||||||
| echo "" | ||||||
|
|
||||||
| # Try Tailscale SSH first | ||||||
| if tailscale ssh shunkakinoki@galactica "cd ~/dotfiles && make rekey-galactica" 2>/dev/null; then | ||||||
|
Contributor
There was a problem hiding this comment. P1: The success path is missing git commit and push operations on galactica. After Prompt for AI agents
There was a problem hiding this comment. The stderr redirection to /dev/null can hide important error messages. If the Tailscale SSH connection fails, the user won't see the actual error message that could help diagnose the issue. Consider either:
The fallback error handling already provides instructions, but seeing the actual Tailscale error would be more helpful for debugging.
Suggested change
|
||||||
| echo "✅ Rekey completed via Tailscale SSH" | ||||||
| else | ||||||
| echo "❌ Tailscale SSH failed. Please run this manually on galactica:" | ||||||
| echo "" | ||||||
| echo " cd ~/dotfiles" | ||||||
| echo " git pull" | ||||||
| echo " make rekey-galactica" | ||||||
| echo " git add named-hosts/galactica/keys/" | ||||||
| echo " git commit -m 'chore(agenix): rekey secrets for kyber access'" | ||||||
| echo " git push" | ||||||
| echo "" | ||||||
| exit 1 | ||||||
| fi | ||||||
|
|
||||||
| # Pull the changes | ||||||
| echo "" | ||||||
| echo "📥 Pulling re-encrypted secrets..." | ||||||
| cd ~/dotfiles | ||||||
| git pull | ||||||
|
|
||||||
| echo "" | ||||||
| echo "✅ Done! Now run: make switch" | ||||||
|
Comment on lines
+1
to
+38
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: git ls-files | grep -E "rekey-galactica|Makefile"Repository: shunkakinoki/dotfiles Length of output: 110 🏁 Script executed: cat -n named-hosts/kyber/rekey-galactica.shRepository: shunkakinoki/dotfiles Length of output: 1378 🏁 Script executed: grep -A 20 "rekey-galactica" MakefileRepository: shunkakinoki/dotfiles Length of output: 975 🏁 Script executed: grep -B 5 -A 15 "^rekey:" MakefileRepository: shunkakinoki/dotfiles Length of output: 743 Script safety and workflow mismatch: banner claims commit/push but remote command only re-encrypts The banner (line 12) states the script will "Commit and push the changes", but the remote command (line 16) only runs Additionally, follow shellcheck-style safety defaults: use -#!/usr/bin/env bash
+#!/usr/bin/env bash
# Remotely rekey galactica secrets to include kyber's public key
# This script should be run from kyber to trigger the rekey on galactica
-set -e
+set -euo pipefail
+
+command -v tailscale >/dev/null || { echo "tailscale is required"; exit 1; }
+command -v git >/dev/null || { echo "git is required"; exit 1; }
echo "🔑 Rekeying galactica secrets to include kyber..."
echo ""
echo "This will:"
echo "1. Connect to galactica via Tailscale SSH"
echo "2. Run the rekey command to re-encrypt secrets with both keys"
-echo "3. Commit and push the changes"
+echo "3. (If needed) commit and push the changes from galactica"
echo ""
# Try Tailscale SSH first
-if tailscale ssh shunkakinoki@galactica "cd ~/dotfiles && make rekey-galactica" 2>/dev/null; then
+if tailscale ssh shunkakinoki@galactica "cd ~/dotfiles && make rekey-galactica"; then
echo "✅ Rekey completed via Tailscale SSH"
else
echo "❌ Tailscale SSH failed. Please run this manually on galactica:"🤖 Prompt for AI Agents |
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This
letblock defining public keys is also present innamed-hosts/kyber/secrets.nix. To improve maintainability and avoid having to update keys in multiple places, consider moving the public key definitions to a shared file (e.g.,named-hosts/public-keys.nix) and importing it where needed.