From 923caba7f1ff179aff1dd762193e38ff490395ba Mon Sep 17 00:00:00 2001 From: ltadeu6 Date: Mon, 25 May 2026 16:25:34 -0300 Subject: [PATCH] Add matrix Android project secrets --- AGENTS.md | 9 +++ hosts/Nixos/configuration.nix | 63 ++++++++++++++++++ .../matrix_android_commander_credentials.age | Bin 0 -> 531 bytes ...atrix_android_firebase_service_account.age | Bin 0 -> 2698 bytes secrets/matrix_android_google_services.age | Bin 0 -> 992 bytes secrets/secrets.nix | 3 + 6 files changed, 75 insertions(+) create mode 100644 secrets/matrix_android_commander_credentials.age create mode 100644 secrets/matrix_android_firebase_service_account.age create mode 100644 secrets/matrix_android_google_services.age diff --git a/AGENTS.md b/AGENTS.md index 303a1b5..8986675 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -557,6 +557,9 @@ Estado atual: - `secrets/android_release_keystore.age` - `secrets/android_release_store_password.age` - `secrets/android_release_key_password.age` +- `secrets/matrix_android_firebase_service_account.age` +- `secrets/matrix_android_google_services.age` +- `secrets/matrix_android_commander_credentials.age` - `secrets/minecraft_rcon_password.age` - `secrets/wireguard_private_key.age` @@ -582,6 +585,12 @@ Estado atual: - O alias padrao da chave e `release`. - O helper `android-signing-env` exporta `ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_TYPE`, `ANDROID_KEY_ALIAS`, `ANDROID_KEYSTORE_PASSWORD` e `ANDROID_KEY_PASSWORD` apenas para o comando filho. - Use `android-signing-env ./gradlew assembleRelease` ou `android-signing-env ./gradlew bundleRelease`; nao exporte essas senhas globalmente. +- Secrets locais do projeto `matrix-android` tambem ficam sob agenix: + - `matrix_android_firebase_service_account` materializa `.secrets/firebase-service-account.json`. + - `matrix_android_google_services` materializa `app/google-services.json`. + - `matrix_android_commander_credentials` materializa `.mc/credentials.json`. +- O helper `matrix-android-secrets [project-dir]` cria symlinks desses tres arquivos para `/run/agenix`; por default usa o diretorio atual. +- Nao migre `local.properties`, debug keystores, `.gradle`, `.wrangler` ou caches locais do `matrix-android` para este repo sem um motivo explicito. ## Dependencias implicitas e pontos de atencao diff --git a/hosts/Nixos/configuration.nix b/hosts/Nixos/configuration.nix index e4a141a..33e1c42 100644 --- a/hosts/Nixos/configuration.nix +++ b/hosts/Nixos/configuration.nix @@ -38,6 +38,44 @@ let exec "$@" ''; + matrixAndroidSecrets = pkgs.writeShellScriptBin "matrix-android-secrets" '' + set -eu + + project_dir=''${1:-"$PWD"} + if [ ! -f "$project_dir/app/build.gradle.kts" ]; then + echo "Usage: matrix-android-secrets [matrix-android-project-dir]" >&2 + echo "Could not find app/build.gradle.kts in: $project_dir" >&2 + exit 1 + fi + + link_secret() { + source_path=$1 + target_path=$2 + + if [ ! -r "$source_path" ]; then + echo "Missing readable secret: $source_path" >&2 + exit 1 + fi + + target_dir=$(${pkgs.coreutils}/bin/dirname "$target_path") + ${pkgs.coreutils}/bin/mkdir -p "$target_dir" + + if [ -e "$target_path" ] || [ -L "$target_path" ]; then + current_target=$(${pkgs.coreutils}/bin/readlink "$target_path" || true) + if [ "$current_target" = "$source_path" ]; then + return + fi + echo "Refusing to replace existing file: $target_path" >&2 + exit 1 + fi + + ${pkgs.coreutils}/bin/ln -s "$source_path" "$target_path" + } + + link_secret /run/agenix/matrix_android_firebase_service_account "$project_dir/.secrets/firebase-service-account.json" + link_secret /run/agenix/matrix_android_google_services "$project_dir/app/google-services.json" + link_secret /run/agenix/matrix_android_commander_credentials "$project_dir/.mc/credentials.json" + ''; haAirConditioner = "climate.ar"; haLaundryDryingToggle = "input_boolean.secar_roupas"; haClimateAction = action: data: { @@ -234,6 +272,30 @@ in { mode = "0400"; }; } // lib.optionalAttrs + (builtins.pathExists ../../secrets/matrix_android_firebase_service_account.age) { + matrix_android_firebase_service_account = { + file = ../../secrets/matrix_android_firebase_service_account.age; + owner = username; + group = "users"; + mode = "0400"; + }; + } // lib.optionalAttrs + (builtins.pathExists ../../secrets/matrix_android_google_services.age) { + matrix_android_google_services = { + file = ../../secrets/matrix_android_google_services.age; + owner = username; + group = "users"; + mode = "0400"; + }; + } // lib.optionalAttrs + (builtins.pathExists ../../secrets/matrix_android_commander_credentials.age) { + matrix_android_commander_credentials = { + file = ../../secrets/matrix_android_commander_credentials.age; + owner = username; + group = "users"; + mode = "0400"; + }; + } // lib.optionalAttrs (builtins.pathExists ../../secrets/minecraft_rcon_password.age) { minecraft_rcon_password.file = ../../secrets/minecraft_rcon_password.age; @@ -1435,6 +1497,7 @@ in { nodePackages.pnpm fishPlugins.z androidSigningEnv + matrixAndroidSecrets ]; # environment.loginShellInit = '' diff --git a/secrets/matrix_android_commander_credentials.age b/secrets/matrix_android_commander_credentials.age new file mode 100644 index 0000000000000000000000000000000000000000..bd35b1cc65230fef02ab65d9e7649993a37d1cde GIT binary patch literal 531 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E>{Rh%{59Z zGDr*7caO;QHFxzj$&Jj+EBEkrHL3^?Ps?@7s0b|y*3NScG2rqnF|Zerd8uxFAv6o9;RB%OJs85AkP-$AIw`I9U zh_OdOv2(DAv1_75m3AnXuCA_vzGaA`PnvH|n45`9XppyWak-ygp@~PSXSipYPk>=m zp1Dg&XtsMDVs&juIP4lsYe0tCtkI0-QuS3 z*LLQzm{;Ccm>4!LvNE$?ICniGSII1;c?HRC%zr#P|K%E9X|P(c{8s&<#b3>>14TB+ zo^7binUJ}aMd40jlvnNVjf&iQHb0pk2d#dv_=xMKhC}Hw#r^8}`;8pUbuR9y&pZ@# J*5#!rCjf2r&inuX literal 0 HcmV?d00001 diff --git a/secrets/matrix_android_firebase_service_account.age b/secrets/matrix_android_firebase_service_account.age new file mode 100644 index 0000000000000000000000000000000000000000..a6c811da9f6cc5665126379357cc29d1a6af2fd6 GIT binary patch literal 2698 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E>|$N%rZ-M zsYG7kxHFO1Afbqe*3%J5DN%}%uNObQAu%@3#yaxpckEaob;^eD~`wv0#*&Z}~* zEDb0wGD$U$Di1434>K@GHOa9EF)p{XsMIcVx4>arU_p?3l6$ggNUBk;hi_H6zoUV- zQ+lYsb4gM_ly7Nph_`vZV`V^)L1r;mzHhQ+k%zC5k5_8=#rlW_Yae0A%no~)sYmR<$ zcDjo}ut$MoPNWG}?~6#ok3x*@AU>{;zx6rxhj5Sj!P}@WhdY ze_Ts1JE`?@Fus#5E_bPLSu$<*!r9N*m<$gWM$SL!GR^UA&jPEnr`mfw>T7ER56xMU zzU1xuyx$T6YKd=E^42-+i@5mrqy1E|me=RvKkRvY>?^}Ol_0a|KPz)Z%Q>dlZ)BYI z==UMB#2>HQ-|c#?v16M`^0IF$KB`yCc-)99)UH!zx8vO1&&|H_ zQnzM5_6s;FF<&$3qs-RC`#e6X?~13gAGjs#{WxVZ?_8;0z6w`vs$8*1&HnT*C^#W( z(z7pf%BFm1wbNNH-_TsXB%pOu_`Et9pXwO~A?2Bu@o9|j*+_b^s!mn$8Cfxqc9GR66XZh${yF4?C z)UoFw1!u0h*k35wd}sSZ-6oH~7tK#!R{Qiu{q$R|?Sy-wHSk?0zcrRc+Af%>L_nWahHE{3Zj*2^xEpxW515 zydK8FyXxe(9CMEsc0^@Og@xhS1-GI>N~A>vb%SFOX9r4*%&Quw=pMO zH2<#H%R3tXnpPf9^h;w6|GAHq*F;y&d|TP9r3>fZ)@V=>!>BjezJ7q@&`_%V3CaNg$ZwtBN zI%E1Ifoh?%k0iF*p5>C;Rj_w$heGD!uxpcS%jJ(0eB8byXQkAVSASdh8rbD64_I2X zNb~Y9{Y-D|5<@ zpW34R_Nf(zHZR-dv9_ag#gY%#pRIQdH=3_@)iBAu%%iD;<<~;nwuR>pWoqBvB)n@* zOLuC)ucFUO-2Xq2(ml6PPdlz?R{fqsliby=GN}}L#HPzH+;e2xueb{~3tHNXJIqff zbr)E@i!L=`5Dj!bC49GKcI;~(<$~7M<4?FZ|uy}I9mIW!Ptj|I}+ZN8ba_PzcO^-VdP5dvl z^wP)4it{FZ(U`5DkvMUx1Lv~shHSeSZ=XDHBw*6x#VwK_?@rW<`_uBO?z*J-v~&aQ z=wuUS>(J-=T1Gwsp^K-^TNbVO`q+Q3@7JC!$TYpZTBrQjmsgA${=Pq-{`quI@if!a z_4NsdEkC|sIeO`Z-poZmt|gyuxm0Ix^1vPC{cAgnmOOkH_y3pPrrX6qGSgVj_)F8P%}4l!?9PAc{U#H>ZT3-b?!@Ky zYAqk0>-N8Q+4SmeC+ptdtW_>+0+$9pZeYA?9@f>pk+=2pLat-MZf0-ooOzZhSRcx> zc<|a_N5jc>wSOmd!u6~7${cT;_byiH$F-QyHvVmi7q*9$K5T4T(o)=2U>7zg%4T6# zu+3E|7O7u#dHK`AyrMSci+xpI_F!^Jg~!7smtMY(dbKGcde5_$GTRT|em!yJziW5$ zWo%uv4t{OYN&0v8;-?E%1v~c3M@O*y&G#{@kla)l(f0YMYW&k#SsTiXTAUZ@96~#l`pv!<+4gZV#)H1wMzbPUg*Jt_h%g{)cm!T@zCtaP6Ldj2P=mm%6$%Iuhw z))X@sCd{um#aoy7O~k;HP5+#A#fb@5PHmbmE!w4~{$h!8#-Z<_f}$@hI=oV1F9-;B z*K@sKsQ#G!bK=TJ`G=x(kDu=IeJ}gCZn1oS$d?tD&o0XM>Fm5@saR2^yWFbof_g^c zYx~=KR|tU9SVs`VpYGVE>%y6IT zcKWu?db^w1-?Uuw%iO}dzgxY&*|u?B*ftxXgR3s|Ck8A(c3W(xgzi`WAFatcnc_O) z?5!VO-aPbd(Uj~ZW&2XMaU97=JbLN+Gxi1}!}OhIZ+w%Yi=u4zM@HVXalhO9*ULHY z>joB!9V=@bcVz_?UR|5`D|eUoVZ*Dhnu1R*JvVdxyp*u0jpvMY*1oV{yLfwT^Jlq@ zi#=`YZcnPua(Dl{V*<|&36;$bDjUzQUcOk-w=O;Kkkb|_a5woYq~-t6 z%JY0iD{H8`K@hK&JKL03o{se|m+WidI9fP+_n)atOqJ!9EuFADdRmdu43YUUrz*sA z^Z(0cs;2#tyWSM``&<0?cBSJvTUz~|*sF2fGTr;);M+4EpJ&Av9lz0ivwDhw(eKNi zHPI>0L}pDpe6ZtB^S6NS?{n<_I=aT}Px+Fh!EkBf&afK}igWZ9Ji0D_^5gT}Prs#9 zUZ3iA{Tl@-PWB z^Yig5aZPbIvMevo4D&2?DJ(S(2#NBoF!M;w^N4bCOb*u%DdutyG)gTf3ot7%jMNXy zPcq9l$xYG@jc|@CFbpekbPI5{a5b-R3d;&jj>KVGcu;v>RF-zKZ)!?qWO0>cRG7PA zWNEHPet2M+hlQbWc!XhOepFDtrK}OG*8#X&CA@p>;59%i;lk{1a|A4@&3{#;iz-VqG#7lVQ1k7o03~DzS0kudc*Ef zB`xsM^M>HpC%d=4Pi?v;`E$ypFDg#yDGP7v1m15~zUyCAcSmBck-&l-6|;`Dm5JYa zkZY;!G3oHxtyb%PecGwx@!59`hlgjA*R;YJJFlugC~t{-@bT8^j9t8+#2cGM1(b!Z z>TkVLU}K$|wqRBI?$7O;J$-Gyx;37^B+|7Zx#Q|#ktf~@XRTvi@{h}0z1gbZ#FZ6+ z_V-M+V-&bf+P~vmeeD&ijMjs66WNpp7thz(mll~^F50=xwb-(!N>uu2NW9uEhn3BD zozEv`w;x)ioP5Ie(?+kaUp6Z>)Cq=wkC{7W3S4!a^JOhleOOT$-_yQ-ft?X5-+mm*TxR}UH*BlbQIl^| ekGO2m?#kHKH)XN@(=GioBi=d9c%T@xc?SUEv%>2D literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 245f60b..46781e4 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -13,6 +13,9 @@ in { "secrets/android_release_keystore.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/android_release_store_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/android_release_key_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; + "secrets/matrix_android_firebase_service_account.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; + "secrets/matrix_android_google_services.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; + "secrets/matrix_android_commander_credentials.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];