From 2286ab880c94e17a29ad99561f87b2e357d4a780 Mon Sep 17 00:00:00 2001
From: Alexander Kassouni <alex@kassouni.net>
Date: Thu, 12 Nov 2026 00:48:40 -0800
Subject: add pgp keys, wkd

---
 pgp/default.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 pgp/default.nix

(limited to 'pgp/default.nix')

diff --git a/pgp/default.nix b/pgp/default.nix
new file mode 100644
index 0000000..3fd5961
--- /dev/null
+++ b/pgp/default.nix
@@ -0,0 +1,24 @@
+{ pkgs, ... }:
+let
+  domain = "kassouni.net";
+  # gpg --with-wkd-hash -k alex@kassouni.net
+  hash = "cddpr77ezsy7h967hgjydxhhmnt76n8w";
+  pubkey = pkgs.runCommandLocal "wkd-key-${domain}" { nativeBuildInputs = [ pkgs.gnupg ]; } ''
+    gpg --dearmor < ${./pubkey.asc} > $out
+  '';
+in
+{
+  services.nginx.virtualHosts.${domain}.locations = {
+    "= /.well-known/openpgpkey/hu/${hash}" = {
+      alias = "${pubkey}";
+      extraConfig = ''
+        default_type application/octet-stream;
+        add_header Access-Control-Allow-Origin "*" always;
+      '';
+    };
+
+    "= /.well-known/openpgpkey/policy".alias = "${pkgs.emptyFile}";
+
+    "= /pubkey.asc".alias = "${./pubkey.asc}";
+  };
+}
-- 
cgit v1.3.1