me like nix
1# Public keys that can decrypt secrets
2let
3 # User keys (for editing secrets) - Yubikey-backed
4 sean = "age1yubikey1qw64ag5lzvn9ekrflu5ruj4a6ucycscl6ctk39fjzf76jptsay39z442pxv";
5
6 # Host keys (for decrypting at boot)
7 # Shared key for all Pi devices
8 pi = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIACsAOLqT+aePFhKDQNXa4m+fikA+Aaig26YUa+WZFNz";
9 mira = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKOL+utPku8c0/QAuyIDZ75cvMI8NGi/g+Qc2wvO2px5";
10
11 allUsers = [ sean ];
12 allPis = [ pi ];
13in
14{
15 "secrets/wifi.age".publicKeys = allUsers ++ allPis;
16 "secrets/wireguard.age".publicKeys = allUsers ++ [ mira ];
17}