sops: convert hardcoded paths for remotebuilds to sops compliant ones

features/sops.nix

@@ -48,6 +48,22 @@
         group = config.users.users.frank.group;
         mode = "0644";
       };
+
+      "remotebuild_ssh_key_rsa" = {
+        sopsFile = ../secrets/remotebuild-ssh-key.yaml;
+        key = "remote_build_ssh_key";
+        owner = "root";
+        group = "root";
+        mode = "0400";
+      };
+
+      "remotebuild_ssh_key_rsa.pub" = {
+        sopsFile = ../secrets/work-ssh-key.yaml;
+        key = "work_ssh_key_rsa_pub";
+        owner = "root";
+        group = "root";
+        mode = "0644";
+      };
     };
   };
 

flake.nix

@@ -48,6 +48,7 @@
 
     nix-flatpak = {
       url = "github:gmodena/nix-flatpak/?ref=latest";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     appimage-manager = {

hosts/nero/configuration.nix

@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   inputs,
   ...
@@ -87,7 +88,7 @@
       {
         hostName = "vergil.cfl.rr.com";
         sshUser = "remotebuild";
-        sshKey = "/root/.ssh/id_rsa";
+        sshKey = config.sops.secrets."remotebuild_ssh_key_rsa".path;
         system = pkgs.stdenv.hostPlatform.system;
         protocol = "ssh-ng";
         maxJobs = 24;

hosts/vergil/configuration.nix

@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   ...
 }:
@@ -35,8 +36,8 @@
     "remotebuild" = {
       isSystemUser = true;
       group = "remotebuild";
-      useDefaultShell = true;
-      openssh.authorizedKeys.keyFiles = [ ./remotebuild.pub ];
+      shell = pkgs.writeScript "nologin" "#!/bin/sh\necho 'Remote builds only.'";
+      openssh.authorizedKeys.keyFiles = [ config.sops.secrets."remotebuild_ssh_key_rsa.pub".path ];
     };
   };
 

hosts/vergil/remotebuild.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTEO/x11KsI4qm30RE9gBNGU8dwFxSCLEMkYyCcmNKbk/59XLV/XnJt3v/485J2lFVhHUqh6K7wWsXcYty5ndd/T2qjUinRokUaNTHz8RV0NM70X0afbObGK+D/zjrKd6Cd5jjlBb7bsEaYzG41Nex4O/6GYdgHK1iVzn3yBfZEzQK1jNfF5tB/ZJnwzf74P+zVKjwh/u7yJNqQHISOA1q3qVK497pp9mTx/x1+WIIb4ovkdvHG1haN0JsQaCa78ih0d5y/3p58p2JVRUzYz0volVBZn8KGuvx6G0Y5dnJmWsJa6rmCvpGmRQNZoPkvbdluT4zJsZWYc7m5EFobfvWQj5PYWwURXA1fwpaprCZAOEnxmc0DEyMSdaelvEYVlo3c0jLGClrl5m3Zi7eW4Tqn/srLUR4AN+gGze3MKUtGFVYimxoO+bQmwBAl9mstvwJkQTJQGxTlibHPE7tODuY7O1aDcgGDUejbwP8RFIBPzt6AgfsdnwkjzEE8Opnr9U= frank@nero

secrets/remotebuild-ssh-key.yaml

@@ -0,0 +1,17 @@
+remotebuild_ssh_key_rsa: ENC[AES256_GCM,data:xUGDEVbj3vJUBbBg1CAPUChC,iv:piW5bMCrSIpjiN8H5+Ae7BsBcQfwiS+GdeAgHv4ndt8=,tag:NxY91CcSHpVrrEnTsd8L5w==,type:str]
+remotebuild_ssh_key_rsa_pub: ENC[AES256_GCM,data:HAbKREwLpXptlDsZyPqtQrwBjl/kBKW5ySTIuTyyQKyMxOlO8Vy8veh6O5On6stEbZi5K/1A19Xy2dLUFm13ZUTA9Z2UtQ/BS5+FlRf8W0pvCTjS0TzoThN7r6GpSIZ7Xe/PF3G/lYM5oto/NKGIYxh26fqAdShx87neFvpkP7pUC9lEAVH2Gik2Jei9KmNeGibXl+v2oMvmBUuxVHxBFMeKOY6JP9eQDOfhULeoQtE648Hol61bVibLT4F62f93owKru1CREXcVMm/Ewiow7WxUw4UB4UTRig7vDqc5YXilC4pKIhqj5ABJUUUzmDtyizmA3tLE7/q7z4Af/Tn8nMOvZNRMiz9mKVW9XKJktqEFRB1nnmvunos8CrfNk2vNaLHWAvM0ojCGaaaIKg2wMhzz+a39flyrg7oGZMZ0/4Ghm8lUDKEv+FMOJIfhdR3yfefIzxZ4vT4dQ4GEVZ2FkoNkNQ0nE4FgwOb2aNxkBi0YK0osMY7Nm5Qv5BvKma/wcrkD6l/fv0l6A/kSmKvE9/K7VOQ4wroJ+UUMWW1TKHjbbDaspGjbmfgsBO3G563Knb1dGc0/zxjsAMb3ezSCNiRti8hpnfo3NZ8UX2pV1BsXRu9EO8QBNJOjTfZfK2ouZHj1hvRU5512wFXj5smA1/1fEcpp9/hoiqItAbOatk9eOWxJkFtXzi5sH2ePVpGZTpT36mQTbvXh3jtUs7nrtlRMvRk0Vywwd5cueD8z98Dyfro=,iv:ls3PLfXEfF7vVBSpba8gijZTbWBmvd2XU2b/4W5JeQ0=,tag:Obkg9QAV7BIelKsD20jMcg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhRy9UaGJCRXVwcG53Sk95
+            RFhOT2lPRWdoc0preFVnUVlHWWRNeTc1cEIwClZxYUR3Y2RhRi9HSUZpLzNyQ0hU
+            eHpCUHJlZS9NQUJsRjlpNTJ4Nk1paTgKLS0tIGJjMnYzOGdma3ZGak1aZFB2elpl
+            dGlxdDNJK3M1elRoU1hMa05VSUwvbEkK4Q7ml9+aeT6ViOqvs/OaYcZifnSmm31n
+            oHhzwqWUfgkjZrdV041YX61UEnjeOwei8stMwxsOsXnJzDyrhXyHmA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
+    lastmodified: "2026-10-21T20:28:41Z"
+    mac: ENC[AES256_GCM,data:yTcIvVHG/3a/hCh8S2RKdFrztCB9rH5fd59JnmEH30WUpWXaTtjt2A0aByfbLxCff3vIfmPifmk9lcE+y8X5cpFTKuALNWmzs7OjNLVmr3X4/4rDjOgd6Q0fDtBrCtAyB8Jz4ABJ/0Efot3Qs+ovpFdUdHCgNO2M5hNJWhhI5Tg=,iv:XCRl22bl7UhTd74ek4osjSNbuXtEtIlhK92M/cBxvEM=,tag:LrclsN9X9bDGJwJIBH5KJQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3