flakes

README.md

@@ -12,18 +12,28 @@ Upcoming flakes:
 
     $ nix build .#deploy.nodes.hel1-a.profiles.system.path
 
-Managing secrets
-----------------
+VM:
+
+    $ nix build .#nixosConfigurations.vm.config.system.build.vm
+
+Encoding host-only secrets
+--------------------------
 
 Encode a secret on host:
 
-    rage -e -r $(ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub) -o secret.age /etc/plaintext
+    rage -e -r "$(cat /etc/ssh/ssh_host_ed25519_key.pub)" -o secret.age /path/to/plaintext
 
 Decode a secret on host (to test things out):
 
-    age -d -i <(sudo ssh-to-age -private-key -i /etc/ssh/ssh_host_ed25519_key) secret.age
+    rage -d -i /etc/ssh/ssh_host_ed25519_key secret.age
 
-If/when [str4d/rage#379](https://github.com/str4d/rage/issues/379) is fixed, we
-can replace the above command to `rage`.
+Bootstrapping
+-------------
+
+Prereqs:
+
+    mkdir -p /etc/secrets/initrd
+    ssh-keygen -t ed25519 -f /etc/secrets/initrd/ssh_host_ed25519
 
 [1]: https://cgit.krebsco.de/krops/about/
+