From 464e24d0110b828cb1d9996fb76a1a13ca2809a8 Mon Sep 17 00:00:00 2001
From: "Casper V. Kristensen" <casper@vkristensen.dk>
Date: Thu, 29 Feb 2024 22:28:14 +0100
Subject: [PATCH] rekey secrets to include recovery key

---
 secrets/netdev-51-wg-sigma-p2p-address.age   | Bin 256 -> 354 bytes
 secrets/network-wg-sigma-p2p-address.age     | Bin 290 -> 388 bytes
 secrets/secrets.nix                          |  14 +++++++-------
 secrets/users-hashed-password-file.age       | Bin 604 -> 702 bytes
 secrets/wireguard-preshared-key-file.age     |  15 ++++++++-------
 secrets/wireguard-private-key-file-alpha.age | Bin 257 -> 355 bytes
 secrets/wireguard-private-key-file-omega.age | Bin 257 -> 355 bytes
 7 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/secrets/netdev-51-wg-sigma-p2p-address.age b/secrets/netdev-51-wg-sigma-p2p-address.age
index de07bf8bca4ae71d5bf509bcab3443e3e32bccd9..4155f6c3d4648d78b7d0f226bb606712c1fa56b3 100644
GIT binary patch
delta 319
zcmV-F0l@x%0^$OYEPq-uNOoFHLr_R(S1T`SNMUJeMRa#gbaQ58b7OinZ&WxoFJ?<C
zQgL`zGzv*tIaNb<aA!q$cX(n)WlC^nMpi;^a&R$eb6HJmI7x43RWn&?NMk}ucM2^&
zAXqXrH8D9LWlefCLR3pZNoP@aLRm{@c`-LxZDmz>VN7R5QhzlvOG;TWH7|F0FhzK0
z3Uo9vS2#s&aBD+OQA{vzdTuXoX*YLoGEZ+!MRQFsQaM#pL^oP!IXF>G3N0-yAT(Gu
zb1znHd2%*&YjAi;cXnbzOlDGgG)Gr>W@SxPD@=7sQg$^?Sz={b3P&Oj%(>hHjCxhd
zbl~hb@`II@-#DYJS%-Hf_6RJuIuX(uO$qI2|5T(w;#y{e?o0^)^^Lt*m1(8B67OiJ
Rmsi4(1L8Ve5U^Zr<nS`KbqW9g

delta 220
zcmV<203-k60)PULEPqQ#b24{uZ)H|eO;S%pZB9@%VOUjKcTjnHYAa?iZbW)>D^YoI
zab!(HI0{ihbWSyTX+t=8RyJ04HaA6dLu4~gdP#9`ZAfuXFmh^1b7gmDG+I?FFbXX#
zEg&*_W==9#aydyeNL4FJX<AEjMKv!<WH@e3V_8UeVQ*@1FjZ4eMOJuYLrn@@qi<D%
zynW&VBJH#gZi!@z;Km}SrcI!G|Kz9!@bw}6Dia<_0-c_Viqf;y6NYh(_;hWHN&Et;
WN6S3FW9)A}ap+KCZsy6_Z2F&;7FUJ<

diff --git a/secrets/network-wg-sigma-p2p-address.age b/secrets/network-wg-sigma-p2p-address.age
index c755ed9f3ec4c07b933bc3fb652a0cf2bf2b9e5d..a61407db379d1fb469829444a5bf8df2424e32c0 100644
GIT binary patch
delta 353
zcmV-n0iOP%0)zvQEPrS)Wluz5H9|9QR5(X-c}r_$RC8=>FfUS6L|1KOab{(9P;p6j
zG%G__GzvLTMR-GOZEIRJcQ;T(cXv}!dQw3(F<LNfb4Nl_S8Gl~Ol~wbNJesZK?*HC
zAXqXrH8D9LR&Yf|R5@!+a%pi`D|#?9Xj*njPd9LEc}GStFn?7_LsUd~aadY-IZtR&
z3QS5_D``kZMr~~{Rx(XUPkK;RXmm<3S#4}XP)0&XLt{8oD@;gMbva^L3N0-yAarg}
zOIUYHN@h?<HAO;VXLm1YGjcO=RyS01GI2FUFK{$aby-AeS7d5Y3STkl=IWKVlXC$@
z=U}NoL%39d09sSh15F659!EzzTz3-5;X3WqZ;=}58D-HVpXRqIfuu@J%UZc6TFcCg
zEtfAj;$3)@ZegsI&BwlJjK>uQkhTKcd(rVJc~uJhB9EFb_Z&1;@`o(EHos{|O^tzW

delta 254
zcmV<a00IAm1EK<uEPpmeSTIFRMlwohO>bmEGj2gzLP2P4RWdI^ac@>fY)fHrK}uzA
zIA%jIZwfdxN=;Bka7TDbZ&XNSD|${Zb9z}~T6I=KbY*aQc4}ofNi<<@a78vZNeV43
zEg*JCYEw8iIAu6XXnI6;D{e$Ma4#!VWjIVwYj$ExV@*X*b$3fMHdtnEXKM<Qesguh
zOi{!(bhHP`m-{q*;4zoquNCr!1~l0ct$%nk6MG0Rw4aI*!3O#w&WSZIvJU=YQxeEC
z+>2{+(O-5TFmi62HHz{LgG$E7-m9C)@-NKv%5AeVqSN#dS*w3i<h6BbGNLs|WVD4K
E2|sOPo&W#<

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index da46156..22f3ca4 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -19,18 +19,18 @@ let
 
   all = [ alpha omega tor recovery ];
 in
-{
-  "users-hashed-password-file.age".publicKeys = all;
+builtins.mapAttrs (name: value: { publicKeys = value ++ [ recovery ]; }) {
+  "users-hashed-password-file.age" = all;
 
   # Secret network addresses
-  "netdev-51-wg-sigma-p2p-address.age".publicKeys = [ alpha ];
-  "network-wg-sigma-p2p-address.age".publicKeys = [ omega ];
+  "netdev-51-wg-sigma-p2p-address.age" = [ alpha ];
+  "network-wg-sigma-p2p-address.age" = [ omega ];
 
   ## Wireguard
   # The preshared key adds an additional layer of symmetric-key crypto to be
   # mixed into the already existing public-key crypto, for post-quantum
   # resistance. Public-keys are generated using `wireguard-vanity-address`.
-  "wireguard-preshared-key-file.age".publicKeys = [ alpha omega ];
-  "wireguard-private-key-file-alpha.age".publicKeys = [ alpha ];
-  "wireguard-private-key-file-omega.age".publicKeys = [ omega ];
+  "wireguard-preshared-key-file.age" = [ alpha omega ];
+  "wireguard-private-key-file-alpha.age" = [ alpha ];
+  "wireguard-private-key-file-omega.age" = [ omega ];
 }
diff --git a/secrets/users-hashed-password-file.age b/secrets/users-hashed-password-file.age
index e3dec96491f5e597906487d0265903890e54f59c..3a24e9ffbe1692b25d10b6305c0e1708fa927dce 100644
GIT binary patch
literal 702
zcmZ9|JBZV80LO7fa0nct;vhFz9b9TnleT#X9$b>X@@Si+Y4Y!6)1=8IZT@YNCQZOa
zbT|Ybhfa!utCOG(-llFM4uXp~iHqQH;2^m8oNoM0AHKhlW0&k;9A@))3kK(5=%5LP
zlr{=c<d$p;uhlTRAb82FE*Glo#AN6yQxgoqtZ{=pQNfU%O)VJUO=H{xnJ^(cOA#$=
zh-j4o73XQYQy0)pKT7+RZl7p0&=IP&hk`kE@l1rqSX<WjYZFj3G^Zd}>HbJWlfbTI
zY=0UC3Q)?4S?8LJ1d1%Hd-Nd5HOBQFBqU+vT3*g&v{oj~CG@)PxJsnDiIGj%Ym|Fo
zK9w!Lg~I(>FrP)0v@mk0)qo)<?WiY@R`#Y9lU-xVan-rB$RZl+2lKqOGPIa!BaV>J
zo02M9E=5pN--~Du)i6U*w`8oM`cPghhElWE#pS<k#=jFMtym3QjwG8S9I$K!YZir>
zOec9g1(sjT780reK44TGAdmr$xPom6`B?(_KnZo9M{Q~ul{rGARG*Y%qt;cJ9Q^6|
zFQE29lge($r=F2)(O74w59=_LdTy)X@gU18z9!AP3Z}?N6JK}(dzpo^j%gb9GE@@M
z!3U<`{hsaGIF5WTjYWSp(2!E8RB$C*C0dSAQGiS6oF!#C-)D(c16pisTDl;aAgp?L
z)RB?5pMIeCcBmUa-(YL!J|Dk(^4a&Bhx{uCzaF{p@@j;|XZcgxufDBaIvkx@zkFKo
zjxNQW4FbJIq>6k%u&;l-_U;4IxV?w0Cr`88`-XVu*q3eUMg2YfSa=w|zNkLRPjsF<
IZ|pw!1tkgYLjV8(

delta 551
zcmXBPzmL*T007{`cuNx#oxJFR!<m@UD+OALQDX~7>7xaKM}IAb(xa4D3bd5cE_XMY
zICzV3(l~jpnwaPr9n?uT<6<<rdYmS@7^8!Ue*eMuY~{nz8|kf~Q-hfZ@GfYw)0v^k
zd8E})(hhCLgUAwVp0hEoaArA@vA)9y3GPoIi<_)f&kT|YCDFL5DV8n^J-lqIWVUV^
zV?K`&mr_A6AU3TmO;g2GU&pnMooZ+yFXVty7Al<<noU|2c9dvQgN;Sat!HX8V1u?r
zBeTfsSR)KT%*lZ*7;S@3#H{PfWVcWXBfmiUO)<!qP*ygf>v6l^Pj1ES%D7UBt@;GE
zpeh$Y6R%HYRHhd+<%9|%Jqt&g)QQUhHm5YkAvYAYHn!)m2)Nj{J-yR|OwMOqK4XbM
zo+L)!&;6Td{}TqFM5DOq;#raJXd}k=s2YNjNf||DvPHIGC^RFA@0zq~V;*qw5{%_)
zA}#z4P0!i76p=|)nu4)CDoMfuO&dMBIt*EiAczz@3{^wIWyNt}q=b&&$a|%>)ta*a
z$5~G=^^GeW%31U#hn?S79=zUDm+RktKkDJ|;gch7OIiDP_2sF>xwY^U@$Sr<v$Orj
zJ12g)2g}Q^t{uDZ;`!>IXzkwM^!w{$VS8njdz;?YzdSv@hYmj<F!B2Ooz1T|@5B7v
U+e(?+y||OU6%>}aUxlB40T61#?EnA(

diff --git a/secrets/wireguard-preshared-key-file.age b/secrets/wireguard-preshared-key-file.age
index 136d53a..8a41ed6 100644
--- a/secrets/wireguard-preshared-key-file.age
+++ b/secrets/wireguard-preshared-key-file.age
@@ -1,8 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 KjvmEQ u+aOAxwH7BgSou88oBlAFTsLZ+Wmbr5ld99nEeBfoic
-TiJ7uXPXDcZ6GZCErXk+VbTSlX0ECDtYg0175DX4+LI
--> ssh-ed25519 fY+XUg KKDaoOcbkTSgsYQ7KEkP507tjoAin2jgoQ7bJDD7lh8
-QTkdXdVK5PN36YglJ2nJKTh5S1Fwy3Myd8kURBPZIcY
---- vcBtZKjPxYnScGb2tizt/USndbXTQcOLorikniOUVbA
-���@���=�)���"xj�P
-���+7)Y��
|�
������~��i��g"��ilE����U���y�{��Ba)
\ No newline at end of file
+-> ssh-ed25519 KjvmEQ QVI3KB2XSIhimn+3nTkS0Hr/DPKtCOcfHFSp7/QLAXk
+tD1fdY3ii08ZqTDEPvYzydFqiok5y4zrnp+GQekz5wg
+-> ssh-ed25519 fY+XUg hJmzN3gINK23Rw1qCd3KJjwPvVvfRZx9VEfDTPRWn2o
+H3rEhjp11wPEQFgg1hXFZwl2ZfecIIx4yxQ/w90YpdA
+-> X25519 hjuZ3YjV9Gf7LHwjzKXRyXC1YGJVZMw3ochzecB9Smw
+oDpsj16YtEoXa+63jVYc3ZyhGFvSebZ/a/YbGLAig80
+--- uZOOPTTyS3p61t7R89nzO/hy4mrHTOoEaM/A0Nmz030
+��t�K����4w���7�Q�'�U��ߒ��4N^c��To��\xIy�xt)��O}$L�*h$�U������q���P
\ No newline at end of file
diff --git a/secrets/wireguard-private-key-file-alpha.age b/secrets/wireguard-private-key-file-alpha.age
index ff2955d0532177b1a2c584e9779dae507f2e2b03..c4b6e61295205716613ccffdd80de619061517c3 100644
GIT binary patch
delta 320
zcmV-G0l)r%0^<UZEPruOHc)p}N_2TaVMb#yR5mMQFGFl-S8gjZO)Gd#QDkjZGGcjc
zYE(6DcM5VcZ)a0dXiZK{XgFC(LQ7*~X)j`FZe(>vLvu4)T1jh1H%Cx%Sw~rCSqd#a
zAXqXrH8D9LR%Cg0c6mWKZBKPsGjL~VaYIf<N_b;+bYe4dbAKy(VKZn^RYGZbK}JDA
z3R6RGX?aa+X+l_1cWQGpFL-fmYG_z<WO!OjSz1weP(fsBL`^R_STQq63N0-yAWA_w
zW@<K2HEc?EcxP2sI7@D5Pb+d%H#TfVIdE1vYIQ{`SvOHmD?(N{3b*!K87~^00jO%l
zmz6YEG5`i*%{esXx_FKra9Xj;)^R(<J)$dS1d$mi{{lZ+f0QiycvvGni3x#*l^@Rq
ShI{TM-Wy3#qS$Cb$mW0(ad4{u

delta 221
zcmV<303!e60)YaMEPrcSN^N>?D`YrhVM$JBNHk<?bu~mcRBcRXYG`IFGD$H=Xe&=_
zQCV13X9{{ZQ8rb2RWM;sRYqYiFn2;~H!DIlRySu)F?D%!R%v-qNoH$zL`rH;K?*G`
zEg(igRcA<UZ$nK=H$gUOa8fTpLrXSfZ%kTOQ#Nr;Id)PuF;+`NG*&TAFGULKROTpw
z+IC26OF5Ccn{XpB0tS2XOJ#wur|yGapZy^BJD^}!gj-yS)y%n&fw$XO$kCcjdJ(0O
X;=BCX1}M&_SUSM8Gn;RqOO3#8w@6h(

diff --git a/secrets/wireguard-private-key-file-omega.age b/secrets/wireguard-private-key-file-omega.age
index 35b67f21aa493ffd19fa4438581655eacebcde3c..fbf57b6e4d7098ac85a622ad38080dac493a77c0 100644
GIT binary patch
delta 320
zcmV-G0l)r%0^<UZEPrHHRWvp-H+gtzQh8Q&X;d*maaBS@Gf8SMa7$4uZZLLIH9|B_
zHBMGSK?+QBSXfqKVopzOYHL9_RBKXAc0po8L|HjkYglSYWLjZKOi^S^YioE#I0`L3
zAXqXrH8D9LZ*z4^Y<W;acUo3)cyBa9L`5)jNM(68Yj;ajMt^E^Vr)5jN@+PZaBVO}
z3UOy=c}i7nQ%Pe{M|njxPd9HdOjScrW<oe=VlYugb89bCS2A^TX-H}~3N0-yAT?H6
zIcG_0D`jL(ZgxR3YeO_dHFZH)ZgEFJMK?%mFhX%`IAdB&Vr_Y63a+NqPSJ(KnH)f>
z#rEgH=`=i9Iys^(;8C_Z>u;@)N)1{RmDEkay!QqC4xoj8W-<dXb#)JS$<tSWpTu8=
SQdWd?*?$%G8)2fDPymtuhjau0

delta 221
zcmV<303!e60)YaMEPqu<GgnntN<~dmIYd@AbZ2m3FnDfDaWFMQW>#uRN?24-Pf28H
zMssyVV+vR~H)?fxcUCJyPEbR5NpDJ6O;bcjXE<nePirqqX+lhASYcK&b~r&tMG7q~
zEg)}BM^af!a%)3HFkx9uIBR5TQ)4+$N>Va(a5hwWLv&<uYgSBlH+4!dFmDQ|OoRL9
zwSTjz0Iu<DL6zo5S%F@cizHA0qN%eC&$7+x=xWV?@6g!6#1XJYkB(55Vgb}@+y}Eu
XDr>_;<Zl-kWDgriFG_~=Y-~yUoNraG