sops: convert hardcoded paths for remotebuilds to sops compliant ones

hosts/nero/configuration.nix

@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   inputs,
   ...
@@ -87,7 +88,7 @@
       {
         hostName = "vergil.cfl.rr.com";
         sshUser = "remotebuild";
-        sshKey = "/root/.ssh/id_rsa";
+        sshKey = config.sops.secrets."remotebuild_ssh_key_rsa".path;
         system = pkgs.stdenv.hostPlatform.system;
         protocol = "ssh-ng";
         maxJobs = 24;

hosts/vergil/configuration.nix

@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   ...
 }:
@@ -35,8 +36,8 @@
     "remotebuild" = {
       isSystemUser = true;
       group = "remotebuild";
-      useDefaultShell = true;
-      openssh.authorizedKeys.keyFiles = [ ./remotebuild.pub ];
+      shell = pkgs.writeScript "nologin" "#!/bin/sh\necho 'Remote builds only.'";
+      openssh.authorizedKeys.keyFiles = [ config.sops.secrets."remotebuild_ssh_key_rsa.pub".path ];
     };
   };
 

hosts/vergil/remotebuild.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTEO/x11KsI4qm30RE9gBNGU8dwFxSCLEMkYyCcmNKbk/59XLV/XnJt3v/485J2lFVhHUqh6K7wWsXcYty5ndd/T2qjUinRokUaNTHz8RV0NM70X0afbObGK+D/zjrKd6Cd5jjlBb7bsEaYzG41Nex4O/6GYdgHK1iVzn3yBfZEzQK1jNfF5tB/ZJnwzf74P+zVKjwh/u7yJNqQHISOA1q3qVK497pp9mTx/x1+WIIb4ovkdvHG1haN0JsQaCa78ih0d5y/3p58p2JVRUzYz0volVBZn8KGuvx6G0Y5dnJmWsJa6rmCvpGmRQNZoPkvbdluT4zJsZWYc7m5EFobfvWQj5PYWwURXA1fwpaprCZAOEnxmc0DEyMSdaelvEYVlo3c0jLGClrl5m3Zi7eW4Tqn/srLUR4AN+gGze3MKUtGFVYimxoO+bQmwBAl9mstvwJkQTJQGxTlibHPE7tODuY7O1aDcgGDUejbwP8RFIBPzt6AgfsdnwkjzEE8Opnr9U= frank@nero