guixsd-config

GuixSD configs for my systems
Log | Files | Refs
commit 1fcb6b5914a5f974a097c919c00e6d25a434f144
parent c779bf0d96acf0d093ea77d96e1b347f0ca16c80
Author: Vineet Kumar <git@vineetk.net>
Date:   Sat, 24 Jan 2026 15:29:20 -0500

add rekeying script

Diffstat:

Mepistemia/secrets/email_13f0.age | 0


Mepistemia/secrets/email_vinbiz.age | 0


Mepistemia/secrets/email_vineetk.age | 16++++++++--------


Aepistemia/secrets/rekey.scm | 53+++++++++++++++++++++++++++++++++++++++++++++++++++++


Mepistemia/secrets/wg0_demiurge.age | 0


Mepistemia/secrets/wg0_hastur.age | 15+++++++--------


Mepistemia/secrets/wg1_demiurge.age | 14+++++++-------


Mepistemia/secrets/wg1_hastur.age | 14+++++++-------


Aepistemia/secrets/wg1_saklas.age | 8++++++++


Mepistemia/secrets/wpa_supplicant.age | 0


10 files changed, 90 insertions(+), 30 deletions(-)

diff --git a/epistemia/secrets/email_13f0.age b/epistemia/secrets/email_13f0.age
Binary files differ.
diff --git a/epistemia/secrets/email_vinbiz.age b/epistemia/secrets/email_vinbiz.age
Binary files differ.
diff --git a/epistemia/secrets/email_vineetk.age b/epistemia/secrets/email_vineetk.age
@@ -1,8 +1,8 @@
 age-encryption.org/v1
--> ssh-ed25519 AaF/mQ 2xJ/ZWD3jNmtJnuNvS2SfeQ7mmKbsWhuOf8j4ljEM2U
-hbcKsAKF1C6S5h87mNPc/aHEhuC4EfBUCAIHvfiCblc
--> ssh-ed25519 hc2ELA Ij2xOrkpLrvTIRYbtx4IGGiM4DPq4R6Ifq/zMLRtFCg
-tW4O99+trWf7/qBtacY8KjxA+mW6ejr2jYlT/MBg1NU
---- gnqtU6MxJ/pjCHJIQQ057NzTaryvZT8KGU+P6uUeH2c
-2>A9Dk
-T'c(n'Up&.H:][W8ъ	o^n#OXf*"z
-\ No newline at end of file
+-> ssh-ed25519 KXd7pg F6THC4nRUrKF+iQ6bXJeEEyMdGNAeGD9IaZ+azvw/Cw
+qZRNG1rzzjsvakLWrS7eMLfrzAvzSAnMSE1VzC883yc
+-> ssh-ed25519 AaF/mQ zaQ28gNSLPQs47L9IAZknEBvOBJ4gDe5m4sCzBYsBmE
+nFG4PCR9LAwSSbWRFnkR9lJ4dzwUGY75sWriSFkKEIQ
+--- 3yncGGyfSGUQMWp49cdgU/KF6AVZdUzEXa7RSepyO2c
+h0?
+IJt>=VNfPU穟wM][~J	'CuCk}=n'u<pQ[ѹ&Gy¢
+\ No newline at end of file
diff --git a/epistemia/secrets/rekey.scm b/epistemia/secrets/rekey.scm
@@ -0,0 +1,53 @@
+#!/run/current-system/profile/bin/guile --no-auto-compile
+!#
+
+(use-modules (ice-9 format)
+             (ice-9 match))
+
+(define age-id  "/data/ssh/id_ed25519")
+(define age-pub "/data/ssh/id_ed25519.pub")
+
+;; use ssh-keyscan to get these, or ~/.ssh/known_hosts
+(define saklas   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILisyUFXdEQHKE42FavKbHHJQJpQAuzbfkmjHrBqZtW2")
+(define demiurge "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINVWXCI58LlxCHZ5tbXOH709jsjvjBs/TUFeKvpplECp")
+(define hastur   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMoHMY2ympq1hYL4KvleCnzZWiAmeMlS1V1TStdeg5Zs")
+
+(define mappings
+  `(("email_13f0"     . ,saklas)
+    ("email_vinbiz"   . ,saklas)
+    ("email_vineetk"  . ,saklas)
+    ("wg1_saklas"     . ,saklas)
+    ("wg0_demiurge"   . ,demiurge)
+    ("wg1_demiurge"   . ,demiurge)
+    ("wg0_hastur"     . ,hastur)
+    ("wg1_hastur"     . ,hastur)
+    ("wpa_supplicant" . ,hastur)))
+
+(define (run fmt . args)
+  (zero? (system (apply format #f fmt args))))
+
+(for-each
+ (match-lambda
+   ((base . key)
+    (let ((enc (string-append base ".age"))
+          (tmp (string-append base ".age.tmp")))
+      (cond
+       ;; rekey existing encrypted file
+       ((file-exists? enc)
+        (format #t "rekeying ~a...~%" enc)
+        (if (run "age -d -i ~a ~a | age -e -R ~a -r '~a' -o ~a"
+                 age-id enc age-pub key tmp)
+            (rename-file tmp enc)
+            (format (current-error-port) "failed to rekey ~a~%" base)))
+
+       ;; otherwise encrypt fresh plaintext
+       ((file-exists? base)
+        (format #t "encrypting ~a...~%" base)
+        (if (run "age -e -R ~a -r '~a' -o ~a ~a"
+                 age-pub key enc base)
+            (delete-file base)
+            (format (current-error-port) "failed to encrypt ~a~%" base)))
+
+       (else
+        (format (current-error-port) "file not found: ~a~%" base))))))
+ mappings)
diff --git a/epistemia/secrets/wg0_demiurge.age b/epistemia/secrets/wg0_demiurge.age
Binary files differ.
diff --git a/epistemia/secrets/wg0_hastur.age b/epistemia/secrets/wg0_hastur.age
@@ -1,8 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 AaF/mQ xnUEcreMyBcCyEqbwLr/yJfX+IQfRzCBPvxFYbJ1nWg
-o44T000ofF01fDitVpy+SfOUvqzGJOdjwwp4Hhrqwrg
--> ssh-ed25519 CQpZUw +fiyOqZ5Qnu76R9inUu043rWhubP6wNKR2cHzX0TxhE
-UCnoHDBG7AhWXow09lZttpY1cPY5UmbgCjiweUZ27KA
---- rJWSFOletZesgfzN20Fq2/uMZ1KUBnTX5e7zKMQFPxo
-QVBŠ"4FO7c6k]#'}hL;^e2oerjs
-mZD+{o$}
-\ No newline at end of file
+-> ssh-ed25519 u1jj0Q 8ws51zlunLImyYL1zphJh8svqSPJ+z4xD3cIyjwOf2k
+gsaR9ODU8y8rMcNwJMjOdMjNGp+0ACXThcKoe+LqtaM
+-> ssh-ed25519 AaF/mQ Cmg7p/DeNVq5CZFhXf/tCmkJ02IBJ34nSXSlrSrGEnk
+P4Ip7VJ782GwrjGPwXuEhjxKatfUFcPgw99MVr1370k
+--- r0J8aKhBRiw0F9ciOywPnXZRpjrhkOrRN3c8MUjJ9IA
+iOjeƭa99X,3R(H?2ioNyªZiAV8dЅK]3
+\ No newline at end of file
diff --git a/epistemia/secrets/wg1_demiurge.age b/epistemia/secrets/wg1_demiurge.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 AaF/mQ PUyKgjT5LOM7I7ruEIaqBpijJ7oXPozndHTDmcGsO20
-KdTGqtJfZZXwmJ4rAghMmciB0iSjW/PpDocBC5aCTLc
--> ssh-ed25519 qGsXnw Kqk732OSJ+5NGgGNqg9Hhf/lA+SDIXAa9Y8WtfBvWRY
-CD9SMTLbE5gGZYBZb377lUlQ21fq4leg6iRmJvKXHAQ
---- Ix4uk93AYnNTapTLwarg6jJhAfIDDGDM8fP2b+iIwgo
-Zoė5SGmk	C7,[òMf/!qU%(sK+ZN6hCA5ϭPL
-\ No newline at end of file
+-> ssh-ed25519 947m3A qZWbjgcewUxnNs5UlrAFvCyDtvc1Qi5d94ZCu0rS9Es
+hryym8Q2qO8oBJyL6vzJi0k8odYJIAxSmS3QwCMs1ig
+-> ssh-ed25519 AaF/mQ NDiO40r+ku6m+uhb1wVnrP8hNNKSvvJCVDMOyu60cwM
+rS9fJUKGmA119034PgCP+oSkKdnbC7tWO36H5Ezi7P0
+--- lup0FiXS5m3hEtVMg4Rliv+1Wl7XtZ81ZEC0v6iJFrM
+i8oD2wo.<z tږɩ/:jwk30vȬۧ2-;P[(@"
+\ No newline at end of file
diff --git a/epistemia/secrets/wg1_hastur.age b/epistemia/secrets/wg1_hastur.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 AaF/mQ iU2z5WLQLUGvohixa/NWU1TYlAbdMxPKJjn38wbj4Tc
-0ucsuHq/IabIFmyEjGdqon/72/CudK2f6z2gg1ilZEk
--> ssh-ed25519 CQpZUw E5mb2yP6XIONS9Ya7fydSvkJGAkUjLO1kSnodI0OHl0
-Vk3Acxao8HxojFNPktIYxPPLXUFX7NncfG5YtlpW624
---- Mzh+F+VUqrP5I4Tl2QVOE78gO2JIyt1pVG0GmDdc1EE
-)3m3EC>}|O1fLu(Q|&:%ͩ*唞J
-\ No newline at end of file
+-> ssh-ed25519 u1jj0Q GG1zYoBqtGq8Mh8WRPeced8ENz5yTGbN4sIggW7oQCQ
++a0V4AwEU+2HBoGS+EP6W5wiCtsWpR3y29Gs4V644m0
+-> ssh-ed25519 AaF/mQ U7OEUIcvxxvLTASY+WUxWSMu7ZPJeIWeLsfIfsG60xI
+qJPbyqr5ckyMtMrASb6duP09lwLXwC1VtcNRbXPmDGU
+--- m62IN9snZCaJqELA/HvraBOkl8A++2uS1kzg0UQLAj4
+ CVuy/ٝg*p/7;!M]lZwΠ8CA꙰6ŽqR
+\ No newline at end of file
diff --git a/epistemia/secrets/wg1_saklas.age b/epistemia/secrets/wg1_saklas.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 KXd7pg O/+Yy+cAbZJ8yu8/yiv7GpMrCjjzMzjAXTQQ7x0x0E4
+M+edycrAviv7RrFK8nRILT+Vu31qVX+InZN6b7TPQJQ
+-> ssh-ed25519 AaF/mQ ZX6IxVyZJeKBrx7HU8h805/4z6RRlePcd29lQhsp2S8
+NAowTNcyYEmtFWK/2MD3GzS0nXQ4PIVj7owLjaqA07Q
+--- yj9lISe+SzA2XIeD1xGPDQqACLqjPCnzYuQR/+7nTcI
+8P~M<k	"kWhA)l5t+qW>Ktdiix/;k탗AѐzWE
+\ No newline at end of file
diff --git a/epistemia/secrets/wpa_supplicant.age b/epistemia/secrets/wpa_supplicant.age
Binary files differ.