dd19d1488a
All checks were successful
CI / Format Check (push) Successful in 2s
CI / Flake Check (push) Successful in 1m42s
CI / Evaluate Key Configurations (nix-builder) (push) Successful in 14s
CI / Evaluate Key Configurations (nix-desktop1) (push) Successful in 7s
CI / Evaluate Key Configurations (nix-laptop1) (push) Successful in 8s
CI / Evaluate Artifacts (installer-iso-nix-laptop1) (push) Successful in 20s
CI / Evaluate Artifacts (lxc-nix-builder) (push) Successful in 13s
CI / Build and Publish Documentation (push) Successful in 11s
37 lines
1.4 KiB
Bash
Executable File
37 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ============================================================================
|
|
# Update Age Keys from SSH Public Keys
|
|
# ============================================================================
|
|
# This script converts SSH public keys to age format for use with ragenix.
|
|
# Run this after adding new SSH .pub files to create corresponding .age.pub files.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
cd "$SCRIPT_DIR"
|
|
|
|
echo "Converting SSH public keys to age format..."
|
|
|
|
# Find all .pub files that are SSH keys (not already .age.pub)
|
|
find . -name "*.pub" -not -name "*.age.pub" -type f | while read -r pubkey; do
|
|
# Check if it's an SSH key
|
|
if grep -q "^ssh-" "$pubkey" 2>/dev/null || grep -q "^ecdsa-" "$pubkey" 2>/dev/null; then
|
|
age_key=$(nix shell nixpkgs#ssh-to-age -c ssh-to-age < "$pubkey" 2>/dev/null || true)
|
|
|
|
if [ -n "$age_key" ]; then
|
|
# Create .age.pub file with the age key
|
|
age_file="${pubkey%.pub}.age.pub"
|
|
echo "$age_key" > "$age_file"
|
|
echo "✓ Converted: $pubkey -> $age_file"
|
|
else
|
|
echo "⚠ Skipped: $pubkey (conversion failed)"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
echo ""
|
|
echo "Done! Age public keys have been generated."
|
|
echo "You can now use ragenix to manage secrets:"
|
|
echo " ragenix -e secrets/global/my-secret.age"
|
|
echo " ragenix -r # Re-key all secrets with updated keys"
|