magic — shared constants & public keys #

magic/ holds small, cross-cutting values that several projects in this monorepo need to agree on, so they live in one place instead of being copy-pasted. Today that's:

• magic/common/constants.nix — home-relative path strings and other Nix constants.
• magic/common/public_keys.json — the single source of truth for reusable public keys.
• magic/home-manager/ — a home-manager wrapper around common/constants.nix.

Public keys: magic/common/public_keys.json #

All reusable public keys live here, keyed by category then by a descriptive camelCase name:

{
  "ssh": {
    "yutoSodium": "ssh-rsa AAAA… yuto@Yutos-MacBook-Pro.local",
    "onePasswordMain": "ssh-ed25519 AAAA…",
    "magnesiumHydroxideForGrandCentral": "ssh-ed25519 AAAA… grand-central yuto.nishida@magnesium-hydroxide",
    "sodiumForGrandCentral": "ssh-ed25519 AAAA… grand-central-tunnel-sodium"
  }
}

Each value is the full key line exactly as it belongs in an authorized_keys file (including any trailing comment field). Never paste a public key literal into another file — add it here once and reference it.

Consume from Nix #

constants.nix re-exports the parsed JSON as publicKeys:

# constants.nix:
publicKeys = builtins.fromJSON (builtins.readFile ./public_keys.json);

In a module that already receives lib (any NixOS / nix-darwin module does), import it and reference a key — e.g. the venus host modules under venus/modules/nixos-darwin/*.nix:

let
  publicKeys = (import ../../../magic/common/constants.nix { inherit lib; }).publicKeys;
in {
  users.users.yuto.openssh.authorizedKeys.keys = [
    publicKeys.ssh.yutoSodium
    publicKeys.ssh.onePasswordMain
  ];
}

If a module doesn't take lib, pass { lib = pkgs.lib; } instead (e.g. sodium.nix, aluminum-nitride.nix). Access is lazy: only publicKeys is forced, not the rest of constants.nix.

Consume from jsonnet (milky-way / Tanka) #

magic/ is symlinked into milky-way's jsonnet library path as milky-way/vendor/magic -> ../../magic (the same mechanism as the existing vendor/exports -> ../../exports). That makes the repo-root magic/… importable by path:

local pubkeys = import 'magic/common/public_keys.json';
// …
authorizedKeys = [
  pubkeys.ssh.yutoSodium,
  pubkeys.ssh.onePasswordMain,
],

import parses JSON natively. If a fresh checkout is missing the symlink, recreate it with ln -s ../../magic milky-way/vendor/magic (it is committed, and jb only manages vendor/github.com/, so it won't be disturbed).

Adding a key #

1. Add the full key line under the right category in public_keys.json with a descriptive name.
2. Reference it via publicKeys.ssh.<name> (Nix) or pubkeys.ssh.<name> (jsonnet).

Scope & deliberate exceptions #

This registry currently holds SSH keys only. Two key kinds are intentionally not sourced from here because their consuming tools cannot import JSON:

• Cachix / nix binary-cache keys in flakes' nixConfig — a flake's nixConfig is evaluated per-flake and can't readFile outside its own directory. They stay as literals in each flake.nix.
• age / sops recipients in .sops.yaml — the sops CLI reads .sops.yaml directly; the per-file headers are auto-generated mirrors of it. They stay in .sops.yaml (already the single place they're authored).

Keys under tilderef/keys/ are also out of scope and are managed there.