flake.nix

@@ -38,7 +38,6 @@
         group = "event";
         modules = [
           ./users/criese-nethinks
-          ./users/isa
         ];
       };
       backup-4 = { name = "backup-4"; };

hosts/astatine/configuration.nix

@@ -5,6 +5,7 @@
     [
       ./hardware-configuration.nix
 
+      ./isa.nix
       ./users.nix
     ];
 

hosts/astatine/isa.nix

@@ -0,0 +1,11 @@
+{ ... }:
+
+{
+  users.users.isa = {
+    isNormalUser = true;
+    extraGroups = [ "guests" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrvhqC/tZzpLMs/qy+1xNSVi2mfn8LXPIEhh7dcGn9e"
+    ];
+  };
+}

secrets.nix

@@ -16,15 +16,6 @@
 */
 
 let
-  /*
-    Returns an attrset for a given directory,
-    having the name of a subdirectory as its attribute names
-    and the contents of the containing ssh.pub file as their value
-
-      {
-        clerie = "ssh-ed25519 AAAA...";
-      }
-  */
   pubkeysFor = directory: let
     instances = builtins.attrNames (builtins.readDir directory);
     instancesWithPubkey = builtins.filter (i: builtins.pathExists (directory + "/${i}/ssh.pub")) instances;
@@ -34,63 +25,13 @@ let
   users = pubkeysFor ./users;
   hosts = pubkeysFor ./hosts;
 
-  /*
-    Returns secret configuration for a given hostname
-  */
   secretsForHost = hostname: let
-    /*
-      Returns a list of all file names in the secrets directory of the specified host
-    */
     secretsFiles = builtins.attrNames (builtins.readDir (./hosts + "/${hostname}/secrets"));
-
-    /*
-      Returns all file names that end with .age
-    */
-    listOfSecrets = builtins.filter (i:
-      # Make sure the file name is longer than the file extension
-      (builtins.stringLength i) > 4
-      # Take the last four letters of the file name and check if it is .age
-      && builtins.substring ((builtins.stringLength i) - 4) (builtins.stringLength i) i == ".age"
-    ) secretsFiles;
-
+    listOfSecrets = builtins.filter (i: (builtins.stringLength i) > 4 && builtins.substring ((builtins.stringLength i) - 4) (builtins.stringLength i) i == ".age") secretsFiles;
   in
-    if
-      # Make sure the host has a secrets directory
-      builtins.pathExists (./hosts + "/${hostname}/secrets")
-      # Make sure the host has a public ssh key provided
-      && builtins.pathExists (./hosts + "/${hostname}/ssh.pub")
-    then
-      /*
-        This map specifies all public keys for which a given secret file should be encrypted
-        It returns a list of name value pairs
-        The name is the path to the secret file
-        The value is an attribute set containing a list of public keys as a string
-      */
-      map
-        (secret: {
-          name = "hosts/${hostname}/secrets/${secret}";
-          value = {
-            publicKeys = [
-              # Hardcode clerie's public key here
-              users.clerie
-              # No other user should have access to any secrets
-
-              # A host should only have access to their own secrets
-              hosts."${hostname}"
-            ];
-          };
-        })
-        # All file names of already existing secrets plus the magic "new" secret
-        (listOfSecrets ++ [ "new" ])
+    if builtins.pathExists (./hosts + "/${hostname}/secrets") && builtins.pathExists (./hosts + "/${hostname}/ssh.pub") then
+      map (secret: { name = "hosts/${hostname}/secrets/${secret}"; value = { publicKeys = [ users.clerie hosts."${hostname}" ]; }; }) (listOfSecrets ++ [ "new" ])
     else
-      # Answer with an empty list, if no secrets are provided for a host
       [];
 in
-  # We just have a list of name value pairs that need to get transformed into an attribute set
-  builtins.listToAttrs (
-    builtins.concatMap
-      # Provide a list of secrets for a given hostname
-      (hostname: secretsForHost hostname)
-      # Names of all hosts
-      (builtins.attrNames (builtins.readDir ./hosts))
-  )
+  builtins.listToAttrs (builtins.concatMap (hostname: secretsForHost hostname) (builtins.attrNames (builtins.readDir ./hosts)))

users/criese-nethinks/default.nix

@@ -4,7 +4,7 @@
   users.users.criese-nethinks = {
     isNormalUser = true;
     openssh.authorizedKeys.keys = [
-      (builtins.readFile ./ssh.pub)
+      (builtins.readFile ./ssh-criese.pub)
     ];
   };
 }

users/isa/default.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  users.users.isa = {
-    isNormalUser = true;
-    openssh.authorizedKeys.keys = [
-      (builtins.readFile ./ssh.pub)
-    ];
-  };
-}

users/isa/ssh.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrvhqC/tZzpLMs/qy+1xNSVi2mfn8LXPIEhh7dcGn9e