feat: setup agenix for secrets (#19)

common/common.nix

···
       "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
     ];
   };
+  # Secrets
+  age.secrets = {
+    tailscale_key.file = ../secrets/tailscale_key.age;
+  };
   programs.nh = {
     enable = true;
     clean.enable = true;

common/networking/networking.nix

···
 
   # Enable networking
   networking.networkmanager.enable = true;
+
+  services.openssh = {
+    enable = true;
+  };
 }

common/networking/tailscale.nix

···
 with lib; let
   cfg = config.services.tailscale;
 in {
-  options.services.tailscale = {
-    authKey = mkOption {
-      type = types.str;
-    };
-  };
-
   # make the tailscale command usable to users
   config.environment.systemPackages = [pkgs.tailscale];
 
···
       fi
 
       # otherwise authenticate with tailscale
-      ${tailscale}/bin/tailscale up -authkey ${cfg.authKey} --ssh
+      ${tailscale}/bin/tailscale up -authkey $(cat ${config.age.secrets."tailscale_key".path}) --ssh
     '';
   };
 }

flake.lock

···
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": [],
+        "home-manager": [
+          "home-manager"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": [
+          "nix-systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1723293904,
+        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
···
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": [
+          "nix-systems"
+        ]
       },
       "locked": {
         "lastModified": 1726560853,
···
         "type": "github"
       }
     },
+    "nix-systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1725001927,
···
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "disko": "disko",
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
         "flake-utils": "flake-utils",
         "home-manager": "home-manager",
         "nix-serve-ng": "nix-serve-ng",
+        "nix-systems": "nix-systems",
         "nixpkgs": "nixpkgs"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
       }
     }
   },

flake.nix

···
       url = "github:nix-community/home-manager/release-24.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    agenix = {
+      url = "github:ryantm/agenix";
+      # TODO: Enable once darwin is setup
+      inputs.darwin.follows = "";
+      inputs.home-manager.follows = "home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.systems.follows = "nix-systems";
+    };
     disko = {
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
···
     };
     flake-utils = {
       url = "github:numtide/flake-utils";
+      inputs.systems.follows = "nix-systems";
     };
     flake-compat = {
       url = "github:edolstra/flake-compat";
     };
+    nix-systems = {
+      url = "github:nix-systems/default";
+    };
   };
 
   outputs = inputs @ {
     nixpkgs,
     home-manager,
+    agenix,
     disko,
     flake-parts,
     nix-serve-ng,
···
               ./machines/inwin-tower/configuration.nix
               ./common/common.nix
 
+              agenix.nixosModules.default
+              {
+                # TODO: Split this into a flake-part module
+                environment.systemPackages = [agenix.packages."x86_64-linux".default];
+              }
+
               # make home-manager as a module of nixos
               # so that home-manager configuration will be deployed automatically when executing `nixos-rebuild switch`
               home-manager.nixosModules.home-manager
···
               ./machines/nixos-thinkpad/configuration.nix
               ./common/common.nix
 
+              agenix.nixosModules.default
+              {
+                # TODO: Split this into a flake-part module
+                environment.systemPackages = [agenix.packages."x86_64-linux".default];
+              }
+
               # make home-manager as a module of nixos
               # so that home-manager configuration will be deployed automatically when executing `nixos-rebuild switch`
               home-manager.nixosModules.home-manager
···
             modules = [
               ./machines/nixos-usb/configuration.nix
               ./common/common.nix
+
+              agenix.nixosModules.default
+              {
+                # TODO: Split this into a flake-part module
+                environment.systemPackages = [agenix.packages."x86_64-linux".default];
+              }
 
               # make home-manager as a module of nixos
               # so that home-manager configuration will be deployed automatically when executing `nixos-rebuild switch`

machines/inwin-tower/configuration.nix

···
   networking.hostName = "inwin-tower"; # Define your hostname.
   networking.hostId = "89cc1717"; # Generate using `head -c 8 /etc/machine-id`
 
-  services.tailscale.authKey = "tskey-auth-kfMxvmtDkb11CNTRL-zCvVcCMqVt8vAWaYU9qPw8nKJ4wtAn5nE";
   boot.binfmt.emulatedSystems = ["aarch64-linux"];
 
   boot.loader.efi.canTouchEfiVariables = lib.mkForce false;

machines/nixos-thinkpad/configuration.nix

···
   networking.hostName = "nixos-thinkpad"; # Define your hostname.
   networking.hostId = "a0d787a6"; # Generate using `head -c 8 /etc/machine-id`
 
-  services.tailscale.authKey = "tskey-auth-knJSHocuQn11CNTRL-kyer5oNq6ADApVLAVhijCDgEiFYP64nm";
   boot.binfmt.emulatedSystems = ["aarch64-linux"];
 
   boot.zfs.devNodes = "/dev/disk/by-label";

machines/nixos-usb/configuration.nix

···
   ];
   networking.hostName = "nixos-usb"; # Define your hostname.
 
-  services.tailscale.authKey = "tskey-auth-kUpUwT8ne921CNTRL-xHFfTssLnnZgddFsUiLgqZLxKVSoErMFc";
-
   # Overrides for graphical base
   boot.loader.grub.enable = lib.mkForce false;
   networking.wireless.enable = lib.mkForce false;

secrets/secrets.nix

···
+let
+  # Add user keys from ~/.ssh
+  inwin-tower-tghanken = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICh921bOnrGEySjw/eRrUAj1UbV2sf1YIcm5X74r6gTh";
+  nixos-thinkpad-tghanken = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHrxGPx3dgap4sUwWyHbQsMJiv9tSNG05BEMNkNLDZF";
+  tghanken = [inwin-tower-tghanken nixos-thinkpad-tghanken];
+
+  users = tghanken;
+
+  # Add machine keys from /etc/ssh
+  inwin-tower = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/iE8w8saXDau1F/BQ5IktJPQO3MhRT1+1e5UsQt/n0";
+  nixos-thinkpad = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEiccufbIo8bYbn5n7PpR1IAFmup53P6nn8IyYfkJfd0";
+
+  machines = [inwin-tower nixos-thinkpad];
+
+  all = users ++ machines;
+in {
+  "tailscale_key.age".publicKeys = all;
+}