Add gpg signing

2026-07-07 20:58:48 +01:00
parent 56efd872ff
commit 27d0ab06e1
7 changed files with 70 additions and 2 deletions
@@ -7,8 +7,21 @@ let
    #!${pkgs.bash}/bin/bash
    set -euo pipefail
    if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
+      install -m 600 /dev/null /run/secrets.env
      ${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age" > /run/secrets.env
    fi
+
+    mkdir -p /run/secrets/gpg
+
+    if [[ -f "${thisDir}/gpg.age" ]]; then
+      ${pkgs.age}/bin/age -d \
+        -i "${config.users.users."me".home}/.ssh/id_ed25519" \
+        "${thisDir}/gpg.age" | \
+        ${pkgs.gnupg}/bin/gpg --homedir /run/secrets/gpg --import
+    fi
+
+    chown -R me:users /run/secrets/gpg
+    chmod -R 700 /run/secrets/gpg
  '';
 in
 {