From 6808ddb6a94b11c28a50be9be5e107dca236148d Mon Sep 17 00:00:00 2001
From: servius <servius@darksailor.dev>
Date: Mon, 27 Apr 2026 13:27:53 +0530
Subject: [PATCH] feat: Added ssh keypair

---
 darwin/shiro/services/gitea-runner.nix | 19 ++++++++++---------
 nixos/tako/configuration.nix           |  1 +
 secrets/id_gitea_runner.pub            |  1 +
 secrets/secrets.yaml                   |  5 +++--
 4 files changed, 15 insertions(+), 11 deletions(-)
 create mode 100644 secrets/id_gitea_runner.pub

diff --git a/darwin/shiro/services/gitea-runner.nix b/darwin/shiro/services/gitea-runner.nix
index 782635c..1ea7543 100644
--- a/darwin/shiro/services/gitea-runner.nix
+++ b/darwin/shiro/services/gitea-runner.nix
@@ -19,10 +19,6 @@
   labelsStr = lib.concatStringsSep "," labels;
   labelsSorted = builtins.concatStringsSep "\n" (builtins.sort builtins.lessThan labels);
 
-  knownHostsFile = pkgs.writeText "gitea-runner-known-hosts" ''
-    tako.darksailor.dev ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBt2bY4G9wfBf/6OsH+sLqA0GaQSTQUO2OCMhjQxwjJZ
-  '';
-
   settingsFormat = pkgs.formats.yaml {};
   configFile = settingsFormat.generate "runner-config.yaml" {};
 
@@ -47,11 +43,6 @@
       mkdir -p "$INSTANCE_DIR"
       cd "$INSTANCE_DIR"
 
-      # Add tako to known hosts
-      mkdir -p "$HOME/.ssh"
-      cp ${knownHostsFile} "$HOME/.ssh/known_hosts"
-      chmod 644 "$HOME/.ssh/known_hosts"
-
       TOKEN_FILE="${config.sops.templates."GITEA_RUNNER_TOKEN.env".path}"
       while [ ! -f "$TOKEN_FILE" ]; do
         echo "Waiting for SOPS secrets..."
@@ -82,6 +73,10 @@
     '';
   };
 in {
+  environment.etc."ssh/ssh_known_hosts".text = ''
+    tako.darksailor.dev ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBt2bY4G9wfBf/6OsH+sLqA0GaQSTQUO2OCMhjQxwjJZ
+  '';
+
   users.users.${runnerUser} = {
     description = "Gitea Actions Runner";
     uid = runnerUid;
@@ -96,6 +91,12 @@ in {
       owner = null;
       uid = runnerUid;
     };
+    secrets."gitea/runner_ssh_key" = {
+      owner = null;
+      uid = runnerUid;
+      mode = "0600";
+      path = "${runnerHome}/.ssh/id_ed25519";
+    };
     templates."GITEA_RUNNER_TOKEN.env" = {
       owner = null;
       uid = runnerUid;
diff --git a/nixos/tako/configuration.nix b/nixos/tako/configuration.nix
index cc1d018..8cdfd89 100644
--- a/nixos/tako/configuration.nix
+++ b/nixos/tako/configuration.nix
@@ -66,6 +66,7 @@
     openssh.authorizedKeys.keyFiles = [
       ../../secrets/id_ed25519.pub
       ../../secrets/id_ios.pub
+      ../../secrets/id_gitea_runner.pub
     ];
   };
   users.users.remotebuilder = {
diff --git a/secrets/id_gitea_runner.pub b/secrets/id_gitea_runner.pub
new file mode 100644
index 0000000..6b9dd19
--- /dev/null
+++ b/secrets/id_gitea_runner.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAizlWI4LWkqxaqHncFBiEPE6FqB3gUFlf2EJQLRF95Z gitea-runner
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index b6df8b0..191c257 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -12,6 +12,7 @@ accounts:
 gitea:
     registration: ENC[AES256_GCM,data:1FVvZF6e4AQK09Qd/hTqCvAEsnKyNztcQ6gFWHprMSNHkodNoyAyZg==,iv:ftnk06e9XV8+ZFupnV4I4a4he1ne9jAzmihli5Vt6h8=,tag:5+Tqzh/dSSWB221h01ftyQ==,type:str]
     migration_token: ENC[AES256_GCM,data:k9/GjCCT2P6NRiTAYXOM64X/G7t8j+A6Wzz7VAtk84otudQdmlV/yw==,iv:f39PnG1z/tstDSaZhiv2xrQHt14VCxfQdDccCo3AGl8=,tag:JXzXKACZLWLpA1eE/o4AAA==,type:str]
+    runner_ssh_key: ENC[AES256_GCM,data:KwrqkSDOkHQxuCyoI+ufF3lusIonKBWczCLkSj8sfdGPziRAqgYmJDd6lihp8K2oS09S7l4CRBdPuhtcqkSQ634m1YLkbX7ilGo6DtrHQ9Pr9KzS/Kff2lPdWEej3j2WaPxbl5hwIOSWHk2l9g6hitCkn2w4SiWt2/lZ0I0mHGBfXka7rVnm3aRZ0i+Uuzsqnh10VPWs+Re/T9fS+/ggvmyrEHI6zkQV8EILXUCxmNky7Gf81tRD419VKHuWMYT9Pe69Umwy6hUV4GpkmFdgAop7N09QtMq+8cStbb7vEegQ89b3pmymNKOnXbP0g7UgQtxVCdXvX2e5HQDCywrf/jeWRGbBJKEhex22qaGg/3/UFcgngqDWN+9foZV9wcQaNlTQ7BM3fBeyeHlmC3iJMfWgmoga5KiYeu6I5CBoVhI7bdE/WklOjrwHmUuKZ4NqTsJRyQfTapPOOujQULhwwMtwseBxWrbjKi0VJpHZRh04teasC4BkJRgEb+om+pcjNqG2kq+d6Rv+oDDwCWVl,iv:8x1mKMjlcbilDRO6qEMSi12Gu5L430JrFJG3vxYss3w=,tag:WSUm5O9PdsGmuLPgieagQw==,type:str]
 llama:
     user: ENC[AES256_GCM,data:qWbhnc/XLotWzqbEa6ekuMe5kD/GwC9SW8omXvgWqCG1BPPCOI3DtlS4YqKxsIhYmw8MQw+4DPnaWHqjrbIsVSrQ79M=,iv:VeqkKb1N9NSKfuilG6dzYdha8cO4JqJ+YUzmkjrPU+0=,tag:SYwR1oU6VWzNoCBPsMg0uQ==,type:str]
     api_key: ENC[AES256_GCM,data:wib+xbb25sTY2K9pacc1mU5eVSyQRurHiCMZyDVSqCAmG4yjkzEykvBevpThNbTZlsk6GZuK4hH0SYJM,iv:GTU6CQ83chXHAuuL0bFMf4L+UWqlcVfXnEE0/SxLzj4=,tag:0LkOSQsuuQd6TK3KHE95TA==,type:str]
@@ -144,7 +145,7 @@ sops:
             VGZKdHpVeFRpQUxtSEkyaEhLMlBJcGsKLb0DvPNZosPBUuiX6qz1s5IO5INQh8CK
             ZtXTVClwMSmaUYhdSB2gKFrKVZHXTJZ4oAL5t/BpC0pOHyr+o96T3Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-26T15:33:01Z"
-    mac: ENC[AES256_GCM,data:gBvWt30I1PWZpSoRuHNI3z5AQRth5pCeXRX6S6qwdmchmntXB/W0wMhURV/pAzZkYucFOUL4kRoxlAdO9o1sUuXVkge0NpNuBoXEhTSttGc+DIimb7OxyO7Yt/pr2h+IAvSHuSgjlFwhl92n0JmV/6dHNQ7BomHryBfVoHdcsCs=,iv:H2k5sGA+0sGxuJMFg8ZzyhIwDk6IdktRQjzx8aBWm7g=,tag:6t8vh50fLT43oIihS91k3Q==,type:str]
+    lastmodified: "2026-04-27T07:54:46Z"
+    mac: ENC[AES256_GCM,data:hSuqSBBze35dF5xu1Im9P2Out/xnNjm+G6m9a2wdq4mhSsoAFU01zSoXLddQhpNe7Tl5vnl+oqwwZYHDBXLCSUX//lcF0epV03q6OKPBl+rCCQ4m0v/nnRumlzJIoSOuZxlkzZqtrEHfwijNWiXeAI+tODEef7Chy/oIZn0JcQk=,iv:GzpcdtSfBF6aC0BDpiq78Wi9LfKHmBcVWHpHWQ7pTto=,tag:QtV2kz13nEsQE/XVe3B0LQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2
-- 
2.51.2