Add Android release signing secrets

AGENTS.md

@@ -554,6 +554,9 @@ Estado atual:
 - `secrets/openai_api_key.age`
 - `secrets/openclaw_gateway_token.age`
 - `secrets/forgejo_api_token.age`
+- `secrets/android_release_keystore.age`
+- `secrets/android_release_store_password.age`
+- `secrets/android_release_key_password.age`
 - `secrets/minecraft_rcon_password.age`
 - `secrets/wireguard_private_key.age`
 
@@ -572,6 +575,14 @@ Estado atual:
 - `/etc/profile.d/openai.sh`, `/etc/profile.d/openclaw.sh` e `/etc/profile.d/forgejo.sh` fazem o mesmo para shells de login.
 - O token do Home Assistant do Waybar AC NAO esta sob agenix neste repo; ele e lido diretamente de `~/.config/secrets/ha_token`.
 
+### Android signing
+
+- A chave de assinatura Android para distribuicao fora da Play Store fica em `secrets/android_release_keystore.age`.
+- As senhas ficam em `secrets/android_release_store_password.age` e `secrets/android_release_key_password.age`.
+- O alias padrao da chave e `release`.
+- O helper `android-signing-env` exporta `ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_TYPE`, `ANDROID_KEY_ALIAS`, `ANDROID_KEYSTORE_PASSWORD` e `ANDROID_KEY_PASSWORD` apenas para o comando filho.
+- Use `android-signing-env ./gradlew assembleRelease` ou `android-signing-env ./gradlew bundleRelease`; nao exporte essas senhas globalmente.
+
 ## Dependencias implicitas e pontos de atencao
 
 Itens que um agente deve verificar antes de mexer:

hosts/Nixos/configuration.nix

@@ -9,6 +9,35 @@ let
   repoDir = "${homeDir}/Projetos/Sistemas/nixos-config";
   codexStatusPath = "/var/lib/hass/codex_status.json";
   claudeUsagePath = "/var/lib/hass/claude_usage.json";
+  androidSigningEnv = pkgs.writeShellScriptBin "android-signing-env" ''
+    set -eu
+
+    secret_dir=/run/agenix
+    for secret in \
+      android_release_keystore \
+      android_release_store_password \
+      android_release_key_password
+    do
+      if [ ! -r "$secret_dir/$secret" ]; then
+        echo "Missing readable Android signing secret: $secret_dir/$secret" >&2
+        exit 1
+      fi
+    done
+
+    export ANDROID_KEYSTORE_PATH="$secret_dir/android_release_keystore"
+    export ANDROID_KEYSTORE_TYPE=PKCS12
+    export ANDROID_KEY_ALIAS=release
+    export ANDROID_KEYSTORE_PASSWORD="$(${pkgs.coreutils}/bin/cat "$secret_dir/android_release_store_password")"
+    export ANDROID_KEY_PASSWORD="$(${pkgs.coreutils}/bin/cat "$secret_dir/android_release_key_password")"
+
+    if [ "$#" -eq 0 ]; then
+      echo "Android signing environment is ready."
+      echo "Run: android-signing-env ./gradlew assembleRelease"
+      exit 0
+    fi
+
+    exec "$@"
+  '';
   haAirConditioner = "climate.ar";
   haLaundryDryingToggle = "input_boolean.secar_roupas";
   haClimateAction = action: data: {
@@ -181,6 +210,30 @@ in {
           mode = "0400";
         };
       } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/android_release_keystore.age) {
+        android_release_keystore = {
+          file = ../../secrets/android_release_keystore.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/android_release_store_password.age) {
+        android_release_store_password = {
+          file = ../../secrets/android_release_store_password.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/android_release_key_password.age) {
+        android_release_key_password = {
+          file = ../../secrets/android_release_key_password.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
       (builtins.pathExists ../../secrets/minecraft_rcon_password.age) {
         minecraft_rcon_password.file =
           ../../secrets/minecraft_rcon_password.age;
@@ -1381,6 +1434,7 @@ in {
     nodePackages.prettier
     nodePackages.pnpm
     fishPlugins.z
+    androidSigningEnv
   ];
 
   # environment.loginShellInit = ''

secrets/android_release_store_password.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 PLsDCw gBKNuM+9I8jE0FR2MQBQIqkLvwb3zq0LKf0bwB8yIXk
+spy1+Ok6fFoEGsVrnPHrWeNL49cpyBc+RxDjfmk3r6E
+-> ssh-ed25519 PLsDCw b982WTJWcZfyQ0yu1NFYzOsE761V3AbciXYN4TngL3U
+b3hXtIY24EPP4mcCGn4BPtsHk46YLGQr7ZOheghyS6w
+--- viMGGTPm8ItU7jb1OK7045U0o1BM2SbDwVJ7qXVp9E4
+b‡.q`•ºio9ó~öŽ•öý+78-×!	Á@LEWf§öÀ¯âèîY­ðƒ<C3B0>wx(`zÕ8pµ£°ÐK~3•æ¨<04>¡ÙOtKX{úcÈWàЉY}š4Pdz¬dÕÛf!,²²죫W•™

secrets/secrets.nix

@@ -10,6 +10,9 @@ in {
   "secrets/openai_api_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/openclaw_gateway_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/forgejo_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/android_release_keystore.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/android_release_store_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/android_release_key_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];