yq commands to update .sops.yaml working

nixos/.sops.yaml

@@ -1,8 +1,10 @@
 keys:
   hosts:
-  - &laptop age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
+    - &laptop age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
+    - &nixos-homelab-00 age1kc49egwnslqjjy7yknlv9spxa2xvrq4l6alxumu54ez8vwvf3e2q5ff63k
 creation_rules:
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
-    - age:
-      - *laptop
+      - age:
+          - *laptop
+          - *nixos-homelab-00

nixos/script.sh

@@ -26,9 +26,10 @@ function sops_update_age_key() {
 # Update key groups to have new host's sops key
 function sops_add_host_to_key_groups() {
 	h="\"$1\""                    # quoted hostname for yaml
-
-  yq -i ".creation_rules.key_groups[].age += [ $h ]" "$SOPS_FILE"
-  yq -i ".creation_rules.key_groups[].age[-1] alias = $h" "$SOPS_FILE"
+  
+  echo "Adding key to key group"
+  yq -i ".creation_rules[].key_groups[].age += [ $h ]" "$SOPS_FILE"
+  yq -i ".creation_rules[].key_groups[].age[-1] alias = $h" "$SOPS_FILE"
 }
 
 # Use generated ssh key generate age key, and update sops
@@ -38,7 +39,6 @@ function sops_generate_host_age_key() {
 
 	# Get the SSH key
 	target_key="$1"
-  echo "$target_key"
 	host_age_key=$(echo "$target_key" | ssh-to-age)
 
 	if grep -qv '^age1' <<<"$host_age_key"; then
@@ -51,6 +51,7 @@ function sops_generate_host_age_key() {
 	echo "Updating nix-secrets/.sops.yaml"
 	sops_update_age_key "$target_hostname" "$host_age_key"
   sops_add_host_to_key_groups "$target_hostname"
+  sops updatekeys secrets/*
 }
 
 # ---HELPER FUNCTIONS END---
@@ -134,7 +135,6 @@ chmod 600 "$temp/persist/etc/ssh/ssh_host_ed25519_key"
 
 # update sops with new host ssh key | age key
 target_key=$(cut -f1- -d" " "$temp/persist/etc/ssh/ssh_host_ed25519_key.pub")
-echo "$target_key"
 sops_generate_host_age_key "$target_key"
 
 # Install NixOS to the host system with our secrets

nixos/secrets/build.json

@@ -8,11 +8,11 @@
 		"age": [
 			{
 				"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJeFpEeWxyY3hVK0pOMFlV\ndXRhRzRjUUtmK2VpdjZNMDJ2NURDRFZ6WjBFClc3MXR2R3pPVERvUWV4OUpXM2hy\nVm9GTkxMSzRSZW1Lb0Fnbkx5YmFqNTAKLS0tIDBJZFgwQjNXaU5UeFUrWUlhWkRO\nK3QwdlBUSUpiVTVBTnkyM1RNMER6ekkKlzYHGPU9b3tY/37nEOiNgQpJFr5KwnU0\n13VRnL5IPlZuSSHaxDXZYjRas0lMT1LujrI0GSjqB8+Pj3m0nELFBg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1djlMZEdwVEpjVjlEVXpp\nYlplWUF4eE9QRnc1aW5JNFI4cjhEUlExSHo0CjgvYTJmOTBmb0p0UXRSQVR0dWg3\neGlTRnBJWk1VYlhudXZuSXMrTVVuZ0UKLS0tIGxoenJNakZlTjg2WmZaSVZLZXhO\nVzFWUmw1b1pROWFyY0ovQ3pET09mdmcK/OL7Tur/4eW7tfbVyaj+gtsEh5wcJs9k\nB5ji+pHH9jD/2pZSlztAuIzxyPK3XuD93B+o/KITTyPb9nILOesq2g==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFY1hRWGowRUExd2VLa2Jh\nY2ZEc053b0lGaGlhSG8zalkwdmZaV1p4NVJFCjdxWGdaVVNrakRGZS92OVdGcndI\nZjNMWG56UURwUm4xZk5Ud2ErWGVxYzQKLS0tIFBTa0szR2pvczFwdGpncXhicTBQ\ndk9nL3ROUk1ROFNRYmlDZytRbkJzSlUKI5dp4LoM/aBz2A+mHCmUy7PoHP3CXFOU\nU4ciuyCV4HFHkDB7NMOsrO3D+7U/xG3gBzglEaws/hrCW7iZNjItUw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1kc49egwnslqjjy7yknlv9spxa2xvrq4l6alxumu54ez8vwvf3e2q5ff63k",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWU56cExTL05UTUE4RHJ3\nSEllZW5rRDZ4enBpMW5EaTlyT0g1L3lBV0FBClJqRVRBTFU1ZVpaODM2dEJjQW8x\naW5EQklMSTRNQkE3SXZnZTUzSWdET2MKLS0tIEJBQkVUMDBkcjIrSzVBSHozdm90\nelRQK1NDZ2p0SmtVT0ZJbHg4NjVBK3MKK/mwd4UVGpjDF3Eij+BZdGCfeGCs4/zD\naAkLXbyErbZyVAIwkVYcKlerxz/YCYumOHxRrSR5FxY1NGHydgBx6w==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-04-17T15:26:55Z",

nixos/secrets/cloudflare.json

@@ -9,11 +9,11 @@
 		"age": [
 			{
 				"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKY2N5RWIwK21GRjgzVzdQ\nR0V1T3pwTWVCR2hNKzI3UTh2N3phYWFzTGtVCmN2Vlk1eUNCNlFVWWkyNVd2cUta\nYjNPZk4vUkZhSHU1T0cxRTRXVjArelkKLS0tIC9jM2pKSzE4TDJLdGF6OUJDSHZL\nYzdOT255TVZBOE9qYVN0NjZWdFArN0EKMa0cJmuYG4Jo1YqT9J9F6dFzscev+CDA\nzh0JsUbVmlHmjGIwVvrdmj3io/U12CrifnnEYs0oRb+zYMwTvbokFQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnOW8waVFmTVVBYzFVOGh1\nckxZMVdzUkM0R0kyVm5KTDVUeUhNNW4wTGhNCmRsS3MxUE5pMFRIQ3ArTm9RemQ3\nZFJPd3VaQ3g1bjBaTVBESHlmYzRiNXcKLS0tIC9NcWhUclIwcU53ME5vb0xpOTV0\nMFFPa0JRQXU2a2FCSk0xaHIvd1NJbDQKsswLKMmxagSXFnxl2T8RkMszzRoL1tIc\n6NiCiizOOIbK1Gun6v4r5maxSFJkaAp0rMMSKZoE0/fQIStnWvJ0CA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZcjlXYVJRNWNvTCs0ODBW\nblJGbEpjOUR2eDJDY0psbFBJMG5ZTitFRTE4CkZMS0ZhZ0Z3T2xXREZrc1VvUkhJ\nblN5SnMvWG5lVmdaMUVUWVRGTFBIKzgKLS0tIEpneFF2cytwa2FISmpScjdudTg5\nc3BvKzFpalIwQzczOUxCYXZnM0xwME0KksEAZTqf/N/FlgXwvHpzZ6U8Zhq2/Yz3\nDBv4A9SQMDhR3lVRxBP4Vw/+GbZ5ZTmGTsbSPqjvSsvT3wtde34Bkg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1kc49egwnslqjjy7yknlv9spxa2xvrq4l6alxumu54ez8vwvf3e2q5ff63k",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcFlKdDFKWFZ3MUVybG4v\na1lHUTJ2dFJ0SHVvanZvQ0RSbXlsMFlWUUY4CmZnNUZrWkhBY3prQlMwT2s4Wkt1\nbTFEMk96UUUrWXFhTC9Ba2svOFdad00KLS0tIHVyL25YRThBS2VWWFFQS0puTjNt\neWRJQ0prQTYwNmV0YmtDVGNTRGFiR2cKC2JwukOiBxZbMZYhwuvLa0n9ErnWc8HP\nbkOSmGS0/ojig23JKYtb5914UD3v9qbQvqt+iI+qRflYa1vXuew/AQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-04-28T04:15:19Z",