1let
  2  #vincent-yubikey5a = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFT5Rx+4Wuvd8lMBkcHxb4oHdRhm/OTg+p5tvPzoIN9enSmgRw5Inm/SlS8ZzV87G1NESTgzDRi6hREvqDlKvxs=";
  3  vincent-yubikey5c1 = "age1yubikey1q0g72w5n3zgt4qv64fkymcttqlpct0yh0rf29079h3696d6wkruakkst877"; # does this work ? Otherwise the ssh one.
  4  # vincent-yubikey5c1 = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBFzxC16VqwTgWDQfw2YCiOw2JzpH3z9XgHtKoHhBdHi2i9m9XUc7fIUeEIIf7P8ARRNd8q5bjvl8JY7LtPkNCU=";
  5  vincent-yubikey5c2 = "age1yubikey1qdj6ld6dlcumxq59xy2xrdl22yu6pc46zyu3mvxe6s9h6kesdm5kcm320qe";
  6  users = [
  7    vincent-yubikey5c1
  8    vincent-yubikey5c2
  9  ];
 10
 11  rhea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFH3Lk4bRgNyFRK/Hzg1PvVbL/dpyI1SmLJFkb6VQDw"; # ssh-keyscan -q -t ed25519 rhea.sbr.pm
 12  sakhalin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN/PMBThi4DhgZR8VywbRDzzMVh2Qp3T6NJAcPubfXz6"; # ssh-keyscan -q -t ed25519 sakhalin.sbr.pm
 13  shikoku = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH18c6kcorVbK2TwCgdewL6nQf29Cd5BVTeq8nRYUigm"; # ssh-keyscan -q -t ed25519 shikoku.sbr.pm
 14  # wakasu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrAh07USjRnAdS3mMNGdKee1KumjYDLzgXaiZ5LYi2D"; # ssh-keyscan -q -t ed25519 wakasu.sbr.pm
 15  # kyushu: decommissioned from NixOS, now Fedora CSB (2026-07-28)
 16  aion = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXDNi2KtoRU83y/V5OWnMbFWmxwBknPmrNWV4RChE7R"; # ssh-keyscan -q -t ed25519 aion.sbr.pm
 17  aix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEoUicDySCGETPAgmI0P3UrgZEXXw3zNsyCIylUP0bML"; # ssh-keyscan -q -t ed25519 aix.sbr.pm
 18  nagoya = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfep1SkMsAPHggXFLfEJNzZb7eoihtkqDeQruG+TbhF";
 19  okinawa = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM8vCZ0h6geJZt6i5k6chEDZBggoyq91Z+oNSjvVeSfW"; # From globals.nix
 20  carthage = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHDurbEy1PiidOirbiPXz84ySdv3rwosPTAlCqacc73a"; # ssh-keyscan -q -t ed25519 carthage.sbr.pm
 21  desktops = [
 22    okinawa
 23  ];
 24  servers = [
 25    aion
 26    aix
 27    carthage
 28    nagoya
 29    rhea
 30    sakhalin
 31    shikoku
 32  ];
 33  systems = servers ++ desktops;
 34in
 35{
 36  # ATProto PDS secrets
 37  "secrets/carthage/pds.env.age".publicKeys = users ++ [ carthage ];
 38  # Restic backup password for carthage
 39  "secrets/carthage/restic-aix-password.age".publicKeys = users ++ [ carthage ];
 40
 41  # Mail passwords
 42  "secrets/mails/icloud-vdemeester.age".publicKeys = users ++ [
 43    sakhalin
 44  ];
 45
 46  # Red Hat
 47  "secrets/redhat/krb5.conf.age".publicKeys = users ++ [
 48    okinawa
 49  ];
 50  "secrets/redhat/RHVPN.ovpn.age".publicKeys = users ++ [
 51    okinawa
 52  ];
 53  "secrets/redhat/AMS2.ovpn.age".publicKeys = users ++ [
 54    okinawa
 55  ];
 56  "secrets/redhat/RDU2.ovpn.age".publicKeys = users ++ [
 57    okinawa
 58  ];
 59  "secrets/redhat/BBRQ.ovpn.age".publicKeys = users ++ [
 60    okinawa
 61  ];
 62  "secrets/redhat/ipa.crt.age".publicKeys = users ++ [
 63    okinawa
 64  ];
 65  "secrets/redhat/2022-RH-IT-Root-CA.pem.age".publicKeys = users ++ [
 66    okinawa
 67  ];
 68  "secrets/redhat/Eng-CA.crt.age".publicKeys = users ++ [
 69    okinawa
 70  ];
 71  "secrets/redhat/newca.crt.age".publicKeys = users ++ [
 72    okinawa
 73  ];
 74  "secrets/redhat/oracle_ebs.crt.age".publicKeys = users ++ [
 75    okinawa
 76  ];
 77  "secrets/redhat/pki-ca-chain.crt.age".publicKeys = users ++ [
 78    okinawa
 79  ];
 80  "secrets/redhat/RH_ITW.crt.age".publicKeys = users ++ [
 81    okinawa
 82  ];
 83  "secrets/redhat/win-intermediate-ca.cer.age".publicKeys = users ++ [
 84    okinawa
 85  ];
 86  "secrets/redhat/redhat.pem.age".publicKeys = users ++ systems;
 87  # Others
 88  "secrets/minica.pem.age".publicKeys = users ++ systems;
 89  "secrets/shikoku/aria2rpcsecret.age".publicKeys = users ++ [ shikoku ];
 90  "secrets/rhea/gandi.env.age".publicKeys = users ++ [
 91    rhea
 92    aion # For XMPP ACME DNS-01 challenge
 93  ];
 94  "secrets/rhea/exportarr-sonarr-apikey.age".publicKeys = users ++ [
 95    rhea
 96    aion
 97  ];
 98  "secrets/rhea/exportarr-radarr-apikey.age".publicKeys = users ++ [
 99    rhea
100    aion
101  ];
102  "secrets/rhea/exportarr-lidarr-apikey.age".publicKeys = users ++ [
103    rhea
104    aion
105  ];
106  "secrets/rhea/exportarr-prowlarr-apikey.age".publicKeys = users ++ [
107    rhea
108    aion
109  ];
110  "secrets/rhea/exportarr-readarr-apikey.age".publicKeys = users ++ [
111    rhea
112    aion
113  ];
114  "secrets/rhea/exportarr-bazarr-apikey.age".publicKeys = users ++ [
115    rhea
116    aion
117  ];
118  "secrets/rhea/jellyfin-auto-collections-api-key.age".publicKeys = users ++ [ rhea ];
119  "secrets/rhea/jellyfin-auto-collections-jellyseerr-password.age".publicKeys = users ++ [ rhea ];
120  "secrets/rhea/jellyfin-favorites-sync-api-key.age".publicKeys = users ++ [ rhea ];
121  "secrets/rhea/jellyfin-favorites-sync-ssh-key.age".publicKeys = users ++ [ rhea ];
122  "secrets/rhea/webdav-password.age".publicKeys = users ++ [ rhea ];
123  "secrets/sakhalin/grafana-admin-password.age".publicKeys = users ++ [ sakhalin ];
124  "secrets/sakhalin/grafana-secret-key.age".publicKeys = users ++ [ sakhalin ];
125  "secrets/sakhalin/ntfy-token.age".publicKeys = users ++ [
126    sakhalin
127    aion
128    okinawa
129    rhea
130    carthage
131  ];
132  "secrets/sakhalin/homeassistant-prometheus-token.age".publicKeys = users ++ [ sakhalin ];
133  "secrets/aion/restic-aix-password.age".publicKeys = users ++ [ aion ];
134  # Wallabag + Miniflux on aion
135  "secrets/aion/miniflux-admin-credentials.age".publicKeys = users ++ [ aion ];
136  "secrets/aion/wallabag-secret-key.age".publicKeys = users ++ [ aion ];
137  # OpenCode web on okinawa
138  "secrets/okinawa/opencode-password.age".publicKeys = users ++ [ okinawa ];
139  "secrets/okinawa/groq-api-key.age".publicKeys = users ++ [ okinawa ];
140  "secrets/okinawa/openrouter-api-key.age".publicKeys = users ++ [ okinawa ];
141  "secrets/okinawa/gemini-api-key.age".publicKeys = users ++ [ okinawa ];
142  # Daneel XMPP bot on okinawa
143  "secrets/okinawa/xmpp-research-bot-password.age".publicKeys = users ++ [ okinawa ];
144  "secrets/rhea/restic-aix-password.age".publicKeys = users ++ [ rhea ];
145
146  # Harmonia binary cache signing keys
147  "secrets/harmonia/aion-signing-key.age".publicKeys = users ++ [ aion ];
148  "secrets/harmonia/okinawa-signing-key.age".publicKeys = users ++ [ okinawa ];
149
150  # SearXNG on sakhalin
151  "secrets/sakhalin/searxng-secret-key.age".publicKeys = users ++ [ sakhalin ];
152
153  # Flux website generator on carthage
154  "secrets/carthage/flux-github-token.age".publicKeys = users ++ [ carthage ];
155}