refactor(secrets): follow the reorganized nix-secrets layout (#344)

secrets/Justfile

@@ -0,0 +1,21 @@
+# just is a command runner; Justfile is like Makefile but simpler.
+# The agenix operations run against the private secrets repository at ~/codes/nix-secrets.
+# Uses nushell:  nix shell nixpkgs#just nixpkgs#nushell
+set shell := ["nu", "-c"]
+set working-directory := "../../codes/nix-secrets"
+
+identity := "/etc/ssh/ssh_host_ed25519_key"
+
+# List all recipes
+default:
+    @just --list --justfile {{justfile()}}
+
+# Edit or create a secret (interactive); pipe the plaintext to write non-interactively
+edit file:
+    sudo -E agenix -i {{identity}} -e {{quote(file)}}
+
+# Re-encrypt every secret after adding or changing a recipient key
+[confirm("Re-encrypt every secret in ~/codes/nix-secrets?")]
+rekey:
+    sudo -E agenix -r -i {{identity}}
+    sudo chown -R ryan:ryan *

secrets/README.md

@@ -107,16 +107,11 @@ in
 }
 ```
 
-3. Create and edit the secret file `xxx.age` interactively using the following command:
+3. Create and edit the secret file `xxx.age` with the [`Justfile`](./Justfile) `edit` recipe
+   (interactive, from the repository root); pipe the plaintext to write it non-interactively:
 
 ```shell
-sudo agenix -e ./xxx.age -i /etc/ssh/ssh_host_ed25519_key
-```
-
-Alternatively, you can encrypt an existing file to `xxx.age` using the following command:
-
-```shell
-cat xxx | sudo agenix  -e ./xxx.age -i /etc/ssh/ssh_host_ed25519_key
+just -f secrets/Justfile edit ./xxx.age
 ```
 
 `agenix` will encrypt the file with all the public keys we defined in `secrets.nix`, so all the
@@ -214,8 +209,8 @@ the `age.secrets.<name>.path` argument, which defaults to `/run/agenix/<name>`.
 1. `cat` the system-level public key(`/etc/ssh/ssh_host_ed25519_key.pub`) of the new host, and send
    it to an old host which has already been configured.
 2. On the old host:
-   1. Add the public key to `secrets.nix`, and rekey all the secrets via
-      `sudo agenix -r -i /etc/ssh/ssh_host_ed25519_key`.
+   1. Add the public key to `secrets.nix`, then rekey all the secrets:
+      `just -f secrets/Justfile rekey`.
    2. Commit and push the changes to `nix-secrets`.
 3. On the new host:
    1. Clone this repo and run `nixos-rebuild switch` to deploy it, all the secrets will be decrypted

secrets/darwin.nix

@@ -49,7 +49,7 @@
 
       # .age means the decrypted file is still encrypted by age(via a passphrase)
       "ryan4yin-gpg-subkeys.priv.age" = {
-        file = "${mysecrets}/ryan4yin-gpg-subkeys-2024-01-27.priv.age.age";
+        file = "${mysecrets}/desktop/ryan4yin-gpg-subkeys-2024-01-27.priv.age.age";
       }
       // noaccess;
 
@@ -58,12 +58,12 @@
       # ---------------------------------------------
 
       "rclone.conf" = {
-        file = "${mysecrets}/rclone.conf.age";
+        file = "${mysecrets}/desktop/rclone.conf.age";
       }
       // high_security;
 
       "nix-access-tokens" = {
-        file = "${mysecrets}/nix-access-tokens.age";
+        file = "${mysecrets}/server/nix-access-tokens.age";
       }
       # access-token needs to be readable by the user running the `nix` command
       // user_readable;
@@ -73,13 +73,13 @@
       # ---------------------------------------------
 
       "ssh-key-romantic" = {
-        file = "${mysecrets}/ssh-key-romantic.age";
+        file = "${mysecrets}/desktop/ssh-key-romantic.age";
       }
       // user_readable;
 
       # decrypted secret: AI agents must not read it, only reference the path
       "nushell-secrets.nu" = {
-        file = "${mysecrets}/nushell-secrets.nu.age";
+        file = "${mysecrets}/desktop/nushell-secrets.nu.age";
       }
       // user_readable;
     };

secrets/nixos.nix

@@ -72,7 +72,7 @@ in
       # secrets that are used by all nixos hosts
       age.secrets = {
         "nix-access-tokens" = {
-          file = "${mysecrets}/nix-access-tokens.age";
+          file = "${mysecrets}/server/nix-access-tokens.age";
         }
         # access-token needs to be readable by the user running the `nix` command
         // user_readable;
@@ -95,14 +95,14 @@ in
 
         # .age means the decrypted file is still encrypted by age(via a passphrase)
         "ryan4yin-gpg-subkeys.priv.age" = {
-          file = "${mysecrets}/ryan4yin-gpg-subkeys-2024-01-27.priv.age.age";
+          file = "${mysecrets}/desktop/ryan4yin-gpg-subkeys-2024-01-27.priv.age.age";
         }
         // noaccess;
 
         # Used only by NixOS Modules
 
         "rclone.conf" = {
-          file = "${mysecrets}/rclone.conf.age";
+          file = "${mysecrets}/desktop/rclone.conf.age";
         }
         // high_security;
 
@@ -111,13 +111,13 @@ in
         # ---------------------------------------------
 
         "ssh-key-romantic" = {
-          file = "${mysecrets}/ssh-key-romantic.age";
+          file = "${mysecrets}/desktop/ssh-key-romantic.age";
         }
         // user_readable;
 
         # decrypted secret: AI agents must not read it, only reference the path
         "nushell-secrets.nu" = {
-          file = "${mysecrets}/nushell-secrets.nu.age";
+          file = "${mysecrets}/desktop/nushell-secrets.nu.age";
         }
         // user_readable;
       };
@@ -232,13 +232,13 @@ in
       # the backup server holds the homelab one, so a shared password would let
       # that server decrypt desktop data.
       age.secrets."restic-password" = {
-        file = "${mysecrets}/restic-password-desktop.age";
+        file = "${mysecrets}/desktop/restic-password-desktop.age";
         mode = "0400";
         owner = "root";
       };
       # credentials for the restic REST server that receives this backup
       age.secrets."restic-rest-credentials" = {
-        file = "${mysecrets}/restic-rest-credentials.age";
+        file = "${mysecrets}/desktop/restic-rest-credentials.age";
         mode = "0400";
         owner = "root";
       };
@@ -248,14 +248,14 @@ in
       # the homelab's restic repository password, shared by the homelab hosts
       # (this host holds it, so it can copy/verify homelab repositories)
       age.secrets."restic-password" = {
-        file = "${mysecrets}/restic-password-homelab.age";
+        file = "${mysecrets}/server/restic-password-homelab.age";
         mode = "0400";
         owner = "root";
       };
       # htpasswd for the restic REST server this host runs; the service runs as
       # the unprivileged `restic` user, which must be able to read it
       age.secrets."restic-rest-htpasswd" = {
-        file = "${mysecrets}/restic-rest-htpasswd.age";
+        file = "${mysecrets}/server/restic-rest-htpasswd.age";
         mode = "0400";
         owner = "restic";
       };
@@ -264,7 +264,7 @@ in
     (mkIf cfg.server.storage.enable {
       age.secrets = {
         "hdd-luks-crypt-key" = {
-          file = "${mysecrets}/hdd-luks-crypt-key.age";
+          file = "${mysecrets}/server/hdd-luks-crypt-key.age";
           mode = "0400";
           owner = "root";
         };