add pgp keys, wkd

1 files changed, 24 insertions, 0 deletions

diff --git a/pgp/default.nix b/pgp/default.nix
new file mode 100644
index 0000000..3fd5961
--- /dev/null
+++ b/pgp/default.nix
@@ -0,0 +1,24 @@
+{ pkgs, ... }:
+let
+  domain = "kassouni.net";
+  # gpg --with-wkd-hash -k alex@kassouni.net
+  hash = "cddpr77ezsy7h967hgjydxhhmnt76n8w";
+  pubkey = pkgs.runCommandLocal "wkd-key-${domain}" { nativeBuildInputs = [ pkgs.gnupg ]; } ''
+    gpg --dearmor < ${./pubkey.asc} > $out
+  '';
+in
+{
+  services.nginx.virtualHosts.${domain}.locations = {
+    "= /.well-known/openpgpkey/hu/${hash}" = {
+      alias = "${pubkey}";
+      extraConfig = ''
+        default_type application/octet-stream;
+        add_header Access-Control-Allow-Origin "*" always;
+      '';
+    };
+
+    "= /.well-known/openpgpkey/policy".alias = "${pkgs.emptyFile}";
+
+    "= /pubkey.asc".alias = "${./pubkey.asc}";
+  };
+}