Add machines.keys config and reorganize key structure

- Add config.machines.keys for machine-specific keys (private keys live on that machine)
- Move desktop SSH key to machines.keys.desktop.ssh
- Fix extractName to preserve "yubikey" (only strip .key/.pub extensions)
- Rename key files for clarity (android -> graphone, primary -> yubikey)
- Add age yubikey key for encrypted backups
- Add README files to document key purposes
- Update all machine configs to import system config

src/user/config/default.nix

@@ -14,7 +14,7 @@ in
         name = "bryan";
         email = "bryan@ramos.codes";
         shell = bash;
-        keys = import ./keys;
+        keys = import ./keys { inherit lib; };
 
         groups = [ "wheel" "networkmanager" "home-manager" "input" ];
         bookmarks = import ./bookmarks;

src/user/config/keys/age/README.md

@@ -0,0 +1,3 @@
+# Age Keys
+
+yubikey.pub.key - Cold storage backup for age encryption

src/user/config/keys/age/yubikey.pub.key

@@ -0,0 +1 @@
+age1yubikey1qfapxqnnkh92zkgayzzm9n0gtpkwaqcvrzy4d4xa4rxnjua8vjhy72hh9r9

src/user/config/keys/default.nix

@@ -1,13 +1,17 @@
+{ lib }:
+
 with builtins;
 let
-  extractName = string:
+  extractName = filename:
     let
-      metadata = [
-        "pub" "public" "priv" "private"
-        "key" "file" "." "_" "-" "pk"
-      ];
-    in
-      replaceStrings metadata (builtins.map (_: "") metadata) string;
+      # Remove .key extension
+      noKey = lib.removeSuffix ".key" filename;
+      # Remove .pub/.priv/.public/.private markers
+      noMarkers = replaceStrings
+        [ ".pub" ".priv" ".public" ".private" ]
+        [ "" "" "" "" ]
+        noKey;
+    in noMarkers;
 
   constructKeys = dir: (
     listToAttrs (
@@ -17,7 +21,10 @@ let
           map (file: {
             name = extractName file;
             value = readFile "${dir}/${subdir}/${file}";
-          }) (filter (node: (readDir "${dir}/${subdir}").${node} == "regular") (attrNames (readDir "${dir}/${subdir}")))
+          }) (filter (file:
+            (readDir "${dir}/${subdir}").${file} == "regular" &&
+            lib.hasSuffix ".key" file
+          ) (attrNames (readDir "${dir}/${subdir}")))
         );
       }) (filter (node: (readDir dir).${node} == "directory") (attrNames (readDir dir)))
     )

src/user/config/keys/pgp/README.md

@@ -0,0 +1,5 @@
+# PGP Keys
+
+yubikey.pub.key -
+work.pub.key -> bryan.ramos@concurrent-rt.com
+ccur.pub.key -> ?

src/user/config/keys/ssh/README.md

@@ -0,0 +1,5 @@
+# SSH Keys
+
+yubikey.pub.key -> PGP derived from `pgp.yubikey.pub.key`
+work.pub.key - ?
+graphone.pub.key -> For Android `pass`

src/user/config/keys/ssh/desktop.pub.key

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOYXfu4Jc/HtdyhOfAdCXYzhqCubIq3Bz6Kl9NDUov76 bryan@desktop

src/user/modules/security/modules/gpg/default.nix

@@ -18,7 +18,7 @@ in
       };
       publicKeys = [
         {
-          text = "${config.user.keys.pgp.primary}";
+          text = "${config.user.keys.pgp.yubikey}";
           trust = 5;
         }
       ] ++ optionals (osConfig.networking.hostName == "workstation") [