#!/usr/bin/env bash set -o errexit set -o nounset set -o pipefail if [[ "$#" -ne 2 ]]; then echo "Usage: $0 " exit 1 fi HOST="$1" mkdir -p "./hosts/${HOST}/secrets" ssh-keygen -t ed25519 -f "./hosts/${HOST}/secrets/ssh_host_ed25519_key" -N "" AGE_KEY=$(nix shell nixpkgs#ssh-to-age --command bash -c "cat './hosts/${HOST}/secrets/ssh_host_ed25519_key.pub' | ssh-to-age") find . -type f -name "sops.yaml" | while IFS= read -r SOPS_FILE; do sed -i "/- hosts:/a\ - &${HOST} ${AGE_KEY}" "${SOPS_FILE}" sed -i "/- age:/a\ - *${HOST}" "${SOPS_FILE}" done sed -i "/knownHosts = {/a\ ${HOST}.publicKeyFile = ../../../../${HOST}/secrets/ssh_host_ed25519_key.pub;" ./hosts/common/configs/system/ssh/default.nix sed -i "/userKnownHostsFile = lib.strings.concatStringsSep \" \" \[/a\ ../../../../../${HOST}/secrets/ssh_host_ed25519_key.pub" ./hosts/common/configs/user/console/ssh/default.nix "$(dirname "$0")/update-keys.sh" "$2" echo "Host ${HOST} has been successfully added." echo "You can generate SSH key pairs for any users that need to connect to user@host using the following command:" echo "ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_${HOST}_"