From d5ee0b16999ac74e1adf5d08733792f586994d67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= Date: Wed, 11 Nov 2026 13:51:24 +0800 Subject: [PATCH] feat(secrets): stop deploying the retired OpenPGP key (#526) * feat(secrets): stop deploying the retired OpenPGP key * chore(flake): bump mysecrets past the move to legacy/ Assisted-by: DeepSeek Harness (claude-opus-5-5) --- docs/security-keys.md | 7 +++---- flake.lock | 6 +++--- home/base/tui/gpg/default.nix | 6 +----- scripts/gpg_canokey.py | 4 ++-- secrets/darwin.nix | 15 --------------- secrets/nixos.nix | 19 ------------------- 6 files changed, 9 insertions(+), 48 deletions(-) diff --git a/docs/security-keys.md b/docs/security-keys.md index 591c5c2f..06cb5915 100644 --- a/docs/security-keys.md +++ b/docs/security-keys.md @@ -312,10 +312,9 @@ is then retired. **Switch**, in one sitting: -1. `python3 scripts/gpg_canokey.py pass --backup /gpg-.tar.age`. It decrypts - every entry with the old key from `/etc/agenix/ryan4yin-gpg-subkeys.priv.age` before changing - anything, re-encrypts with `pass init`, then checks that every entry opens with the new key alone - and kept its content. +1. `python3 scripts/gpg_canokey.py pass --backup /gpg-.tar.age --old-backup `. + It decrypts every entry with the old key before changing anything, re-encrypts with `pass init`, + then checks that every entry opens with the new key alone and kept its content. 2. Deploy the configuration change to every host that uses pass. Until a host is deployed it cannot read the store, and `pass insert` there still encrypts to the old key. 3. On each host, with a CanoKey plugged in, point the daily keyring's stubs at it: diff --git a/flake.lock b/flake.lock index 73f76daf..c97886b2 100644 --- a/flake.lock +++ b/flake.lock @@ -493,10 +493,10 @@ "mysecrets": { "flake": false, "locked": { - "lastModified": 1794375216, - "narHash": "sha256-AFc1wbFkjMDE8M5MOoTN+LtjTCeO9eKbEji+l+iPBMQ=", + "lastModified": 1794376126, + "narHash": "sha256-lDoa+rGdXjwd4czCYy26ye094LMv0eXY4pIpeDcWK7k=", "ref": "refs/heads/main", - "rev": "77c8376104042b2052ce345a7151c645e4684a51", + "rev": "6ab2a713e5938e1bb8ef2d33acab632ba0bd5331", "shallow": true, "type": "git", "url": "ssh://git@github.com/ryan4yin/nix-secrets.git" diff --git a/home/base/tui/gpg/default.nix b/home/base/tui/gpg/default.nix index fd569cde..42395ff9 100644 --- a/home/base/tui/gpg/default.nix +++ b/home/base/tui/gpg/default.nix @@ -20,14 +20,10 @@ mutableKeys = false; publicKeys = [ # https://www.gnupg.org/gph/en/manual/x334.html - { - source = "${mysecrets}/public/ryan4yin-gpg-keys-2014-01-27.pub"; - trust = 5; - } # ultimate trust, my own keys. { source = "${mysecrets}/public/ryan4yin-gpg-keys-2026-11-11.pub"; trust = 5; - } + } # ultimate trust, my own key. ]; # This configuration is based on the tutorial below, it allows for a robust setup diff --git a/scripts/gpg_canokey.py b/scripts/gpg_canokey.py index 79b35b5a..758125d5 100755 --- a/scripts/gpg_canokey.py +++ b/scripts/gpg_canokey.py @@ -564,8 +564,8 @@ def build_parser() -> argparse.ArgumentParser: store.add_argument("--backup", required=True, help="backup written by `generate`") store.add_argument( "--old-backup", - default="/etc/agenix/ryan4yin-gpg-subkeys.priv.age", - help="the retired key's subkeys", + required=True, + help="the retired key's age-encrypted secret subkeys", ) store.add_argument( "--store", diff --git a/secrets/darwin.nix b/secrets/darwin.nix index f9230460..63e3b211 100644 --- a/secrets/darwin.nix +++ b/secrets/darwin.nix @@ -28,10 +28,6 @@ age.secrets = let - noaccess = { - mode = "0000"; - owner = "root"; - }; high_security = { mode = "0500"; owner = "root"; @@ -42,17 +38,6 @@ }; in { - # --------------------------------------------- - # No discretionary access; privileged root can still bypass file modes. - # --------------------------------------------- - - # .age means the decrypted file is still encrypted by age(via a passphrase) - "ryan4yin-gpg-subkeys.priv.age" = { - file = "${mysecrets}/desktop/ryan4yin-gpg-subkeys-2024-01-27.priv.age.age"; - path = "/etc/agenix/ryan4yin-gpg-subkeys.priv.age"; - } - // noaccess; - # --------------------------------------------- # only root can read this file. # --------------------------------------------- diff --git a/secrets/nixos.nix b/secrets/nixos.nix index c45743c7..b3328855 100644 --- a/secrets/nixos.nix +++ b/secrets/nixos.nix @@ -19,10 +19,6 @@ let || cfg.server.webserver.enable || cfg.server.storage.enable; - noaccess = { - mode = "0000"; - owner = "root"; - }; high_security = { mode = "0500"; owner = "root"; @@ -89,16 +85,6 @@ in (mkIf cfg.desktop.enable { age.secrets = { - # --------------------------------------------- - # No discretionary access; privileged root can still bypass file modes. - # --------------------------------------------- - - # .age means the decrypted file is still encrypted by age(via a passphrase) - "ryan4yin-gpg-subkeys.priv.age" = { - file = "${mysecrets}/desktop/ryan4yin-gpg-subkeys-2024-01-27.priv.age.age"; - } - // noaccess; - # Used only by NixOS Modules "rclone.conf" = { @@ -134,11 +120,6 @@ in user = myvars.username; }; - "agenix/ryan4yin-gpg-subkeys.priv.age" = { - source = config.age.secrets."ryan4yin-gpg-subkeys.priv.age".path; - mode = "0000"; - }; - # Used by a home-manager module, so it must be readable by the user. # Setting `mode` makes environment.etc copy the file instead of # symlinking the runtime secret, so the owner must be set as well —