rain
07dbe83f52
The previous approach (private_dot_omp/agent/zai.key.age + manual re-encryption) didn't work because: 1. The 'private_' prefix is for files NOT to push to remote, not for encrypted files. The 'encrypted_' prefix is what chezmoi recognizes as an encryption marker. 2. The encrypted file needs to be at dot_<path>/encrypted_<name>.age so chezmoi can both decrypt on apply AND strip the .age suffix to write the destination file as <name> (without .age). Also fix chezmoi age config to actually decrypt non-interactively: - Add useBuiltinAge: false to force external age binary - Add age.command: /usr/bin/age (absolute path) so PATH issues don't matter in non-interactive SSH contexts The encrypted file is at dot_omp/agent/encrypted_zai.key.age, decrypts to ~/.omp/agent/zai.key on apply. Encrypted to all 6 recipients (recovery + miche + byte + kaiser + rye + crouton). Tested on miche: - chezmoi apply: rc=0 - live zai.key: 50 bytes (correct content) - decrypts with miche per-machine key - would decrypt on other boxes with their respective keys
63 lines
No EOL
3 KiB
Cheetah
63 lines
No EOL
3 KiB
Cheetah
{{- $osFamily := "unknown" -}}
|
|
{{- $idLike := "" -}}
|
|
{{- if hasKey .chezmoi.osRelease "idLike" -}}
|
|
{{- $idLike = .chezmoi.osRelease.idLike -}}
|
|
{{- end -}}
|
|
{{- if or (eq .chezmoi.osRelease.id "arch") (contains "arch" $idLike) -}}
|
|
{{- $osFamily = "arch" -}}
|
|
{{- else if or (eq .chezmoi.osRelease.id "debian") (contains "debian" $idLike) -}}
|
|
{{- $osFamily = "debian" -}}
|
|
{{- end -}}
|
|
encryption: "age"
|
|
# chezmoi's builtin age implementation requires a TTY for passphrase-style
|
|
# decryption prompts and doesn't support all features. Force the external
|
|
# age binary instead. If chezmoi can't find `age` on PATH at apply time,
|
|
# the absolute path is used as a fallback.
|
|
useBuiltinAge: false
|
|
sourceDir: {{ .chezmoi.sourceDir | quote }}
|
|
|
|
# age config — see https://www.chezmoi.io/user-guide/encryption/age/
|
|
#
|
|
# To bootstrap age on a new box:
|
|
# 1. Generate a recovery key (offline, store secret in password manager):
|
|
# age-keygen -o ~/.config/chezmoi/keys/recovery.key
|
|
# Add the printed public key below as a recipient.
|
|
# 2. Generate a per-machine key on each box:
|
|
# age-keygen -o ~/.config/chezmoi/key.txt
|
|
# Add its public key below, then `chezmoi age rekey` to rewrite *.age files.
|
|
#
|
|
# To encrypt a new secret:
|
|
# echo 'secret' | chezmoi encrypt --output private_dot_.../<name>.age
|
|
#
|
|
# To decrypt (auto, on apply):
|
|
# chezmoi uses ~/.config/chezmoi/key.txt (per-machine) by default.
|
|
|
|
age:
|
|
# Absolute path to age binary. Most distros install to /usr/bin/age;
|
|
# Arch's pacman and Debian's apt both put it there. Using the absolute
|
|
# path means chezmoi can find age even if PATH isn't set correctly
|
|
# (which happens in some non-interactive SSH contexts).
|
|
command: "/usr/bin/age"
|
|
identity: "~/.config/chezmoi/key.txt"
|
|
|
|
# Multiple recipients: every listed recipient can decrypt every *.age file.
|
|
# Add a new recipient by pasting their public key below, then
|
|
# `chezmoi age rekey` to rewrite existing files with the new recipient.
|
|
recipients:
|
|
# Recovery key — secret stored offline (password manager, USB stick).
|
|
# Don't lose this: it's the only way to recover secrets if every
|
|
# machine key is lost.
|
|
- age1yyq42ctqwp5s5yd64week3aav9getk3p8aeyr5n5454d0v59a4dsjljsgs
|
|
|
|
# Per-machine keys — one per box. Generate on the box itself with
|
|
# `age-keygen -o ~/.config/chezmoi/key.txt`, paste its public key
|
|
# here, then `chezmoi age rekey`.
|
|
- age1eja7trs8mmsgf0qga0h5fsdltaryxgk4ksumshar5xxtdx0exy3q0a5hc5 # miche (Strix Halo GPU host)
|
|
- age1tzmsrw59zkvh47pwz66gly3s4hdcru76569s8cgv0syfrpmutdxsnlke30 # byte (CachyOS laptop)
|
|
- age16pl6ad3r44hf3q70xra7fadmllhmnnpmksetr3hr6a0q55kd3f9slvpsdg # kaiser (services host)
|
|
- age14yfcz6k3m4q99nuvd22ka8zgtgj6q5jmt0sz3cz0004uhcgddfpq49kxw7 # rye (Debian Pi)
|
|
- age19d0dqm6nzmhlhuns2qa3z64rua294xvf6l2uy5we5dlrq6z4yvwq6g4y4e # crouton (Debian Pi)
|
|
|
|
data:
|
|
os_family: {{ $osFamily | quote }}
|
|
os_id: {{ .chezmoi.osRelease.id | quote }} |