3 files changed, 41 insertions, 0 deletions
diff --git a/system/secrets/default.nix b/system/secrets/default.nix
new file mode 100644
index 0000000..3d92fe8
--- /dev/null
+++ b/system/secrets/default.nix
@@ -0,0 +1,12 @@
+{...}: {
+  age = {
+    secrets = {
+      keycloak = {
+        file = ./keycloak/passwd.tix;
+        mode = "700";
+        owner = "root";
+        group = "root";
+      };
+    };
+  };
+}
diff --git a/system/secrets/keycloak/passwd.tix b/system/secrets/keycloak/passwd.tix
new file mode 100644
index 0000000..b5c36cd
--- /dev/null
+++ b/system/secrets/keycloak/passwd.tix
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGeFZ2Uk10Z1lrNUV6SWtu
+UFZLVFR2dWJsMnNZTkE0Q3loa1c0c3ZwTjJvCjhHcm9XVk1jWENYNG5VNVV2RlZp
+SVZROEFrU2tNV1dDYmNOdmEzanoyd2sKLT4gWDI1NTE5IHFOTEhFUUtGOWMzWjVO
+MGs2a0tsYlZSZGI3NXdBRktKNDgxdzRmQTI1emsKeVJzbHJhR3h5NDVwM2pqcFFW
+UzROY2toa0ZBL1p2elRmeHdUTFNhRm91bwotPiBzc2gtZWQyNTUxOSBPRDhUNGcg
+NG42WHBrcVh0cjJYKzMwR3FkTHN0VTZUY0xyZVQvMjR3azdtZ0V4M0dpRQpxSzlj
+anVRVndxdWhaQldZeHJ0WVFCNzZJMHFnaG5KRDRQa003enoyME1FCi0+ICZ2LjlB
+SS1ncmVhc2Ugfj51dWUyIG5XOExyNmR2IFNVdmkKK3QwSmRRCi0tLSBqb3FPRWtV
+dUdLcWV4R1VnOGZmNGxBY0dVbTRZN094V0dIeWpZTWp1V1QwCpu/WQunSMxbtxwz
+uiFrDcdAa3H3+2gIFHmktFbHZX9XNC2ri99G7nqQ9SoBvnpRFhhAiw0LSWnq2lqr
+rMQeug/z0sooWO6R2H17aLHXwxz82Spm7eUlc3nMz243U0SChz7OnPDgHBgLztqJ
+3zOMub3inn83jR7Pg+GjEuI26tqZUp6107CKzvBWI8ePsa7MW19UdmEVplewxrDq
+fjNsmid3+NNJ0LjC3gGUppHtTJW9ikTvaDMtS5Ysn94JoS6xRzVgE2LBswGBiQBJ
+ZDV+9het3ijDyljk3pjPRDKoWPEctT/cWLczEMK5vHqVt3pr/IAWqJTfXVkebP6Q
+6QdZrUKl/xxKmApVRx9K0wQAhfwlKKTHpW3hFFNivZtSg0hSaF4=
+-----END AGE ENCRYPTED FILE-----
diff --git a/system/secrets/secrets.nix b/system/secrets/secrets.nix
new file mode 100644
index 0000000..cdaf50d
--- /dev/null
+++ b/system/secrets/secrets.nix
@@ -0,0 +1,12 @@
+let
+  soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn";
+  sils = "age1vuhaey7kd9l76y6f9weeqmde3s4kjw38869ju6u3027yece2r3rqssjxst";
+
+  server1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMnqsfIZjelH7rcvFvnLR5zUZuC8thsBupBlvjcMRBUm";
+in {
+  "keycloak/passwd.tix".publicKeys = [
+    soispha
+    sils
+    server1
+  ];
+}