From b3aedc5ead5ff49ca6bd66f1ceb36027525b3e4c Mon Sep 17 00:00:00 2001
From: Roy Dumblauskas <roydumblauskas@gmail.com>
Date: Mon, 5 May 2025 09:38:43 -0500
Subject: [PATCH] check if reference exists in key group before adding, skip if
 it does

---
 nixos/.sops.yaml |  2 --
 nixos/script.sh  | 12 ++++++++----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/nixos/.sops.yaml b/nixos/.sops.yaml
index e7b98bb..6257b05 100644
--- a/nixos/.sops.yaml
+++ b/nixos/.sops.yaml
@@ -1,10 +1,8 @@
 keys:
   hosts:
     - &laptop age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
-    - &nixos-homelab-00 age1kc49egwnslqjjy7yknlv9spxa2xvrq4l6alxumu54ez8vwvf3e2q5ff63k
 creation_rules:
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
       - age:
           - *laptop
-          - *nixos-homelab-00
diff --git a/nixos/script.sh b/nixos/script.sh
index 40cd96e..5c0a86b 100755
--- a/nixos/script.sh
+++ b/nixos/script.sh
@@ -14,7 +14,7 @@ function sops_update_age_key() {
 	keyname="$1"
 	key="$2"
 
-	if [[ -n $(yq ".keys.hosts[] | select(anchor == \"$keyname\")" "${SOPS_FILE}") ]]; then
+  if [[ -n $(yq ".keys.hosts[] | select(anchor == \"$keyname\")" "${SOPS_FILE}") ]]; then
 		echo "Updating existing ${keyname} key"
 		yq -i "(.keys.hosts[] | select(anchor == \"$keyname\")) = \"$key\"" "$SOPS_FILE"
 	else
@@ -27,9 +27,13 @@ function sops_update_age_key() {
 function sops_add_host_to_key_groups() {
 	h="\"$1\""                    # quoted hostname for yaml
   
-  echo "Adding key to key group"
-  yq -i ".creation_rules[].key_groups[].age += [ $h ]" "$SOPS_FILE"
-  yq -i ".creation_rules[].key_groups[].age[-1] alias = $h" "$SOPS_FILE"
+  if [[  -z $(yq "select(.creation_rules[].key_groups[].age[] == $h)" "$SOPS_FILE") ]]; then
+    echo "Adding key to key group"
+    yq -i ".creation_rules[].key_groups[].age += [ $h ]" "$SOPS_FILE"
+    yq -i ".creation_rules[].key_groups[].age[-1] alias = $h" "$SOPS_FILE"
+  else
+    echo "Reference already exists in key group"
+  fi
 }
 
 # Use generated ssh key generate age key, and update sops