alexion
61ce9cc1be
The host's SSH identity was generated by the daemon, so reimaging the laptop would invalidate it and break `known_hosts` for every client that had ever connected. Add `secrets/neogaia.yaml`, the first per-host secrets file, encrypted to the admin identity and `neogaia` alone so a compromised machine cannot decrypt another's material. It holds both host private keys; the public halves are committed in plaintext. Clear `services.openssh.hostKeys` to stop generation and point `HostKey` at the decrypted paths. These are ordinary secrets rather than the pre-user ones the password uses, exercising the second decryption path.
27 lines
951 B
YAML
27 lines
951 B
YAML
# Recipients for the encrypted files under secrets/.
|
|
keys:
|
|
# A recipient of every file.
|
|
# One readable only by machines becomes unrecoverable once they are wiped.
|
|
# Adding a recipient requires decrypting first.
|
|
# No private half here, only in the operator's password manager.
|
|
- &admin age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
|
|
# Generated on the machine it names.
|
|
- &neogaia age14a04vphzjq74epfrz9a09wjw8lzchtru84awzuq2n45d8f42ychqjs89qe
|
|
|
|
creation_rules:
|
|
# Material belonging to one machine.
|
|
# No machine other than the one named is a recipient, so a host that is
|
|
# compromised cannot decrypt another's material.
|
|
- path_regex: secrets/neogaia\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *neogaia
|
|
|
|
# Material common to every machine, so it is stored once rather than per host.
|
|
- path_regex: secrets/shared\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *neogaia
|