From 14008a4bc941e9b9b6f50ae9bfa24477a9f6b591 Mon Sep 17 00:00:00 2001
From: m3tam3re <p@m3ta.dev>
Date: Sat, 20 Jun 2026 09:32:19 +0200
Subject: [PATCH] fix: encrypt backup sync ssh key correctly

---
 hosts/AZ-CLD-1/services/var-backup-sync.nix |   5 +++++
 hosts/AZ-PRM-1/services/backup-ingest.nix   |   2 +-
 secrets/cld-var-backup-sync-ssh-key.age     | Bin 322 -> 766 bytes
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/hosts/AZ-CLD-1/services/var-backup-sync.nix b/hosts/AZ-CLD-1/services/var-backup-sync.nix
index 13e2a1a..d0204da 100644
--- a/hosts/AZ-CLD-1/services/var-backup-sync.nix
+++ b/hosts/AZ-CLD-1/services/var-backup-sync.nix
@@ -48,6 +48,11 @@ in {
 
       lock_file="/run/${serviceName}/${serviceName}.lock"
 
+      if ! ssh-keygen -y -f ${sshKey} >/dev/null; then
+        echo "Invalid SSH private key secret at ${sshKey}" >&2
+        exit 1
+      fi
+
       flock -n "$lock_file" \
         rsync \
           -aH \
diff --git a/hosts/AZ-PRM-1/services/backup-ingest.nix b/hosts/AZ-PRM-1/services/backup-ingest.nix
index 0f1d387..b16f4aa 100644
--- a/hosts/AZ-PRM-1/services/backup-ingest.nix
+++ b/hosts/AZ-PRM-1/services/backup-ingest.nix
@@ -13,7 +13,7 @@ in {
     createHome = false;
     shell = pkgs.bashInteractive;
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6FhMvJqh7m+AfC5yeHUIxhEvalSoA5OzqtDVstuAX1 cld-var-backup-sync@AZ-CLD-1-to-AZ-PRM-1"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBAbgaMFD8U+NrhA4P7BzVOsAbuu82ebkAOfQA09u12v cld-var-backup-sync@AZ-CLD-1-to-AZ-PRM-1"
     ];
   };
 
diff --git a/secrets/cld-var-backup-sync-ssh-key.age b/secrets/cld-var-backup-sync-ssh-key.age
index 800bddcdf898941ac50c64824edf1e33a9954e44..20b5dc9c90830636a58f8c275cf708a9440dd348 100644
GIT binary patch
delta 734
zcmX@a^pACdPJL-gaD-`QrgKJww@Fr{kynwWV`*BlMQCbvahi*Jd2v!fc376Xg{e_y
zAeU3Bp;?w|lwnC!QdVNBSC(aJNI|K8wo!zqUqxuSdstYWmql@LgkPj<AeXM4LUD11
zZfc5=si~o*f^)EMWk$M!p;tsiWOjN~fN!pUR%Tj`TYXMerlDb3VzHBZkWp?$My``~
zRJl`-yKzP~S5SFQU{Fv+MN)uKN|aeakWqxGzgMVxpmR}Zfmua`c2>HVTXtE7xwDT6
zm#(g^f|p;oeq>O#d1g_0x@CZ0X{J$_zOzADqM@sSo2RRPdPJGGSGr-Ag>!H|m!;ho
z)*msiZqy%r6w<M%@R9T?_DSy_Zxz^ZXJ(Jck1&Iv8xuU`m~KQkntb2<X(xyO#{e0Y
zxht&L7==H7J~3lP_VKmT`A;Ot_*?M(Q?BSQQqwTy=TpsBvv?sk<>W3a?g-;QPRp5p
zm@q9l;oZZ};#jsU`0Ay~%PW>FxisUe7?1id<!#3``it20>bw8Qt(&`V<J;n*%zx_V
zzuCT!tdf{-q^=v&x3T2=`n>&?z1O`ipL8mkpL05BS<@YUr^M-I;t$Inyt$DcDgWv0
zpU(??a)Zj2RX*Ozw|~k^o1N!2?k&|jen;{B#4_FkxBIvpkIvnYKcUMju8rxUf2>IU
zW;3TJpWZ!F_-_|;yJqX;`jh;xo3H#UTamKI)Z263%zq_2xw3A!1Qqn$@!pnq>y7=&
zXQqnDe97O$8NO`XP`S0mIos1!x3j4$R@g9Z7MI=yC*u<9&-V?4re84KH9<vny|R#;
z!q3;sxz9g(ldoy~(~DnMGi0X1EtQY#e|pyCC=@Th=Vie8_?Y><{=}!tPBnxpA3Vw_
zFMIOM9l`GZwO;wNv_HIh^P;FfKi{^=(tm@drWcQf+V{zt%3D_+{JCz?U9n5wqs~5D
o*Dm}r<v?cV+lYS^DT~i7aXQ=J+`4a>VNB<r$%~E%?mgWJ0Mm6u4FCWD

delta 287
zcmeyzdWdO)PQ6>0QCL)dWn{3nZ)jC%PNs)@MVWVbNTydra8XJ|YLb75VNha~Pq4mY
zAXlodwn11yid#fjx@U+<d3uVwQAAOpW3g#aa#(PsyP02BT3T|Rd4_+9FPE;JLUD11
zZfc5=si~o*f^)EMWk$L}d7)2nRc2_FuVGejYE_h1RlS*;hp|VIzq5gNxN~B-cBG|a
zMtO2}prw;5SB^`7lYelqu}^8TOOkJ)dxlwAp^s--p;>Nfns17iuYX!py1BV=O0iKo
zm#(g^LUL7rQ@C@vx2I*LzG0c6r@pUgkYli4q+emAae#M8N@_()W=KGgNpf*E*S@3;
jLZTlkQzSUOnHxNw*i_v(azrVQWy3l_hcg1AyIPU}2#;X%