Cannot read ssh key '/etc/ssh/ssh_host_rsa_key'?

[sheeeng]

I have ED25519 host key only.

$ tree -fi /etc/ssh | grep ssh_host_
/etc/ssh/ssh_host_ed25519_key
/etc/ssh/ssh_host_ed25519_key.pub

I'm using the following configuration.

    age = {
      sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
      keyFile = "/etc/sops/age/keys.txt";
    };

But, I have Cannot read ssh key '/etc/ssh/ssh_host_rsa_key' line during darwin-rebuild switch.

Setting up secrets...
Cannot read ssh key '/etc/ssh/ssh_host_rsa_key': open /etc/ssh/ssh_host_rsa_key: no such file or directory
sops-install-secrets: Imported /etc/ssh/ssh_host_ed25519_key as age key with fingerprint age1zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz

How can I suppress or workaround it?

[sedlund]

off the top of my head -- it may be this

sops-nix/modules/nix-darwin/default.nix

Lines 149 to 153 in b80c966

	darwinSSHKeys = [
	{
	type = "rsa";
	path = "/etc/ssh/ssh_host_rsa_key";
	}

if you inspected sshKeyPaths in the repl you'd see that you are adding /etc/ssh/ssh_host_ed25519_key" to the existing list not overwriting it.

so you want to use lib.mkDefault or lib.mkForce like:

sshKeyPaths = lib.mkForce [ "/etc/ssh/ssh_host_ed25519_key" ];

to overwrite the default with only that value instead of the nix default of merging items in lists.

[sheeeng]

off the top of my head -- it may be this

sops-nix/modules/nix-darwin/default.nix

Lines 149 to 153 in b80c966

darwinSSHKeys = [
{
type = "rsa";
path = "/etc/ssh/ssh_host_rsa_key";
}
if you inspected sshKeyPaths in the repl you'd see that you are adding /etc/ssh/ssh_host_ed25519_key" to the existing list not overwriting it.

so you want to use lib.mkDefault or lib.mkForce like:

sshKeyPaths = lib.mkForce [ "/etc/ssh/ssh_host_ed25519_key" ];

to overwrite the default with only that value instead of the nix default of merging items in lists.

Thanks, @sedlund! I was debugging until the same code block too.

I tried the suggested workaround, but to no avail.

-      sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+      sshKeyPaths = lib.mkForce [ "/etc/ssh/ssh_host_ed25519_key" ];

Still having Cannot read ssh key '/etc/ssh/ssh_host_rsa_key': open /etc/ssh/ssh_host_rsa_key: no such file or directory message.

[phonkd]

+1