feat(secrets/keys/comfy-gh): add github ssh key

home/comfy/packages/misc/git/git.nix

@@ -11,15 +11,9 @@ in
   programs.git = mkIf cfg.enable {
     enable = true;
     inherit (cfg) package;
-    userName = "comfy";
+    userName = "comfysage";
     userEmail = "[email protected]";
 
-    # git commit signing
-    signing = {
-      key = cfg.signingKey;
-      signByDefault = true;
-    };
-
     extraConfig = {
       core.editor = osConfig.garden.programs.defaults.editor;
 
@@ -35,7 +29,7 @@ in
       };
       commit.gpgsign = true;
       gpg.format = "ssh";
-      user.signingkey = "~/.ssh/id_rsa.pub";
+      user.signingkey = osConfig.age.secrets.keys-comfy-gh.path;
       # personal preference
       init.defaultBranch = "main";
       # prevent data corruption

home/comfy/system/ssh.nix

@@ -1,3 +1,7 @@
+{ osConfig, ... }:
+let
+  inherit (osConfig.age) secrets;
+in
 {
   programs.ssh = {
     enable = true;
@@ -9,6 +13,7 @@
       "github.com" = {
         user = "git";
         hostname = "github.com";
+        identityFile = secrets.keys-comfy-gh.path;
       };
 
       "gitlab.com" = {

modules/base/secrets.nix

@@ -50,6 +50,16 @@ in
         owner = mainUser;
         group = userGroup;
       };
+      keys-comfy-gh = mkSecret {
+        file = "keys/comfy-gh";
+        owner = mainUser;
+        group = userGroup;
+      };
+      keys-comfy-gh-pub = mkSecret {
+        file = "keys/comfy-gh-pub";
+        owner = mainUser;
+        group = userGroup;
+      };
       keys-aur = mkSecret {
         file = "keys/aur";
         owner = mainUser;

secrets/secrets.nix

@@ -132,4 +132,6 @@ in
 
   # comfys keys
   "keys/comfy.age" = defAccessComfy (types.workstations ++ types.servers);
+  "keys/comfy-gh.age" = defAccessComfy (types.workstations ++ types.servers);
+  "keys/comfy-gh-pub.age" = defAccessComfy (types.workstations ++ types.servers);
 }