From bffbe851b5c812635d45f6c79432fe56cd95d317 Mon Sep 17 00:00:00 2001
From: Frank LoTurco <floturcocantsee@protonmail.com>
Date: Wed, 21 Oct 2026 16:41:49 -0400
Subject: [PATCH] sops: convert hardcoded paths for remotebuilds to sops
 compliant ones

---
 features/sops.nix                | 16 ++++++++++++++++
 flake.nix                        |  1 +
 hosts/nero/configuration.nix     |  3 ++-
 hosts/vergil/configuration.nix   |  5 +++--
 hosts/vergil/remotebuild.pub     |  1 -
 secrets/remotebuild-ssh-key.yaml | 17 +++++++++++++++++
 6 files changed, 39 insertions(+), 4 deletions(-)
 delete mode 100644 hosts/vergil/remotebuild.pub
 create mode 100644 secrets/remotebuild-ssh-key.yaml

diff --git a/features/sops.nix b/features/sops.nix
index a0c6895..9adc570 100644
--- a/features/sops.nix
+++ b/features/sops.nix
@@ -48,6 +48,22 @@
         group = config.users.users.frank.group;
         mode = "0644";
       };
+
+      "remotebuild_ssh_key_rsa" = {
+        sopsFile = ../secrets/remotebuild-ssh-key.yaml;
+        key = "remote_build_ssh_key";
+        owner = "root";
+        group = "root";
+        mode = "0400";
+      };
+
+      "remotebuild_ssh_key_rsa.pub" = {
+        sopsFile = ../secrets/work-ssh-key.yaml;
+        key = "work_ssh_key_rsa_pub";
+        owner = "root";
+        group = "root";
+        mode = "0644";
+      };
     };
   };
 
diff --git a/flake.nix b/flake.nix
index 978c72c..d89d18e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -48,6 +48,7 @@
 
     nix-flatpak = {
       url = "github:gmodena/nix-flatpak/?ref=latest";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     appimage-manager = {
diff --git a/hosts/nero/configuration.nix b/hosts/nero/configuration.nix
index 029b669..03cf090 100644
--- a/hosts/nero/configuration.nix
+++ b/hosts/nero/configuration.nix
@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   inputs,
   ...
@@ -87,7 +88,7 @@
       {
         hostName = "vergil.cfl.rr.com";
         sshUser = "remotebuild";
-        sshKey = "/root/.ssh/id_rsa";
+        sshKey = config.sops.secrets."remotebuild_ssh_key_rsa".path;
         system = pkgs.stdenv.hostPlatform.system;
         protocol = "ssh-ng";
         maxJobs = 24;
diff --git a/hosts/vergil/configuration.nix b/hosts/vergil/configuration.nix
index f96161c..1e0bcca 100644
--- a/hosts/vergil/configuration.nix
+++ b/hosts/vergil/configuration.nix
@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   ...
 }:
@@ -35,8 +36,8 @@
     "remotebuild" = {
       isSystemUser = true;
       group = "remotebuild";
-      useDefaultShell = true;
-      openssh.authorizedKeys.keyFiles = [ ./remotebuild.pub ];
+      shell = pkgs.writeScript "nologin" "#!/bin/sh\necho 'Remote builds only.'";
+      openssh.authorizedKeys.keyFiles = [ config.sops.secrets."remotebuild_ssh_key_rsa.pub".path ];
     };
   };
 
diff --git a/hosts/vergil/remotebuild.pub b/hosts/vergil/remotebuild.pub
deleted file mode 100644
index 37ff497..0000000
--- a/hosts/vergil/remotebuild.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTEO/x11KsI4qm30RE9gBNGU8dwFxSCLEMkYyCcmNKbk/59XLV/XnJt3v/485J2lFVhHUqh6K7wWsXcYty5ndd/T2qjUinRokUaNTHz8RV0NM70X0afbObGK+D/zjrKd6Cd5jjlBb7bsEaYzG41Nex4O/6GYdgHK1iVzn3yBfZEzQK1jNfF5tB/ZJnwzf74P+zVKjwh/u7yJNqQHISOA1q3qVK497pp9mTx/x1+WIIb4ovkdvHG1haN0JsQaCa78ih0d5y/3p58p2JVRUzYz0volVBZn8KGuvx6G0Y5dnJmWsJa6rmCvpGmRQNZoPkvbdluT4zJsZWYc7m5EFobfvWQj5PYWwURXA1fwpaprCZAOEnxmc0DEyMSdaelvEYVlo3c0jLGClrl5m3Zi7eW4Tqn/srLUR4AN+gGze3MKUtGFVYimxoO+bQmwBAl9mstvwJkQTJQGxTlibHPE7tODuY7O1aDcgGDUejbwP8RFIBPzt6AgfsdnwkjzEE8Opnr9U= frank@nero
diff --git a/secrets/remotebuild-ssh-key.yaml b/secrets/remotebuild-ssh-key.yaml
new file mode 100644
index 0000000..7e9b454
--- /dev/null
+++ b/secrets/remotebuild-ssh-key.yaml
@@ -0,0 +1,17 @@
+remotebuild_ssh_key_rsa: ENC[AES256_GCM,data:xUGDEVbj3vJUBbBg1CAPUChC,iv:piW5bMCrSIpjiN8H5+Ae7BsBcQfwiS+GdeAgHv4ndt8=,tag:NxY91CcSHpVrrEnTsd8L5w==,type:str]
+remotebuild_ssh_key_rsa_pub: ENC[AES256_GCM,data:HAbKREwLpXptlDsZyPqtQrwBjl/kBKW5ySTIuTyyQKyMxOlO8Vy8veh6O5On6stEbZi5K/1A19Xy2dLUFm13ZUTA9Z2UtQ/BS5+FlRf8W0pvCTjS0TzoThN7r6GpSIZ7Xe/PF3G/lYM5oto/NKGIYxh26fqAdShx87neFvpkP7pUC9lEAVH2Gik2Jei9KmNeGibXl+v2oMvmBUuxVHxBFMeKOY6JP9eQDOfhULeoQtE648Hol61bVibLT4F62f93owKru1CREXcVMm/Ewiow7WxUw4UB4UTRig7vDqc5YXilC4pKIhqj5ABJUUUzmDtyizmA3tLE7/q7z4Af/Tn8nMOvZNRMiz9mKVW9XKJktqEFRB1nnmvunos8CrfNk2vNaLHWAvM0ojCGaaaIKg2wMhzz+a39flyrg7oGZMZ0/4Ghm8lUDKEv+FMOJIfhdR3yfefIzxZ4vT4dQ4GEVZ2FkoNkNQ0nE4FgwOb2aNxkBi0YK0osMY7Nm5Qv5BvKma/wcrkD6l/fv0l6A/kSmKvE9/K7VOQ4wroJ+UUMWW1TKHjbbDaspGjbmfgsBO3G563Knb1dGc0/zxjsAMb3ezSCNiRti8hpnfo3NZ8UX2pV1BsXRu9EO8QBNJOjTfZfK2ouZHj1hvRU5512wFXj5smA1/1fEcpp9/hoiqItAbOatk9eOWxJkFtXzi5sH2ePVpGZTpT36mQTbvXh3jtUs7nrtlRMvRk0Vywwd5cueD8z98Dyfro=,iv:ls3PLfXEfF7vVBSpba8gijZTbWBmvd2XU2b/4W5JeQ0=,tag:Obkg9QAV7BIelKsD20jMcg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhRy9UaGJCRXVwcG53Sk95
+            RFhOT2lPRWdoc0preFVnUVlHWWRNeTc1cEIwClZxYUR3Y2RhRi9HSUZpLzNyQ0hU
+            eHpCUHJlZS9NQUJsRjlpNTJ4Nk1paTgKLS0tIGJjMnYzOGdma3ZGak1aZFB2elpl
+            dGlxdDNJK3M1elRoU1hMa05VSUwvbEkK4Q7ml9+aeT6ViOqvs/OaYcZifnSmm31n
+            oHhzwqWUfgkjZrdV041YX61UEnjeOwei8stMwxsOsXnJzDyrhXyHmA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
+    lastmodified: "2026-10-21T20:28:41Z"
+    mac: ENC[AES256_GCM,data:yTcIvVHG/3a/hCh8S2RKdFrztCB9rH5fd59JnmEH30WUpWXaTtjt2A0aByfbLxCff3vIfmPifmk9lcE+y8X5cpFTKuALNWmzs7OjNLVmr3X4/4rDjOgd6Q0fDtBrCtAyB8Jz4ABJ/0Efot3Qs+ovpFdUdHCgNO2M5hNJWhhI5Tg=,iv:XCRl22bl7UhTd74ek4osjSNbuXtEtIlhK92M/cBxvEM=,tag:LrclsN9X9bDGJwJIBH5KJQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3