New encyption scheme

.chezmoi.toml.tmpl

@@ -1,5 +1,4 @@
-encryption = "gpg"
-[gpg]
-    symmetric = true
-    args = ["--batch", "--no-symkey-cache"]
-
+encryption = "age"
+[age]
+    identity = "~/.config/chezmoi/key.txt"
+    recipient = "age1c4y054wg5yqde4nvsfvx20tj9k3a5adwxc48zye0udsxe2p7hfws96tnjg"

.chezmoiignore

@@ -0,0 +1 @@
+key.txt.age

dot_config/home-manager/home/common.nix

@@ -52,6 +52,8 @@ in rec {
 
     unstable.nix-output-monitor
 
+    # dotfiles
+    age
     chezmoi
 
     # backup

key.txt.age

@@ -0,0 +1,10 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCA5Sy9KanQrcTczVnAyWVdr
+cXJrWDJBIDE4CmFBaTExUTdBbWdmWTF6b2IvSElCb1FzQ0I5UUZGMUxobmxTMUtQ
+aS93UDgKLS0tIFRxaDRnSnJoWmpJTkRxRlJPTmlTWUJHV25kbFJaeHpaUkFXZ0tS
+bmc1ZGMKX/iyf4oIQmn+X1LT5bwFVBI5TxXdX5rSLodi5LFWkBnG/YsUn/EL0Lun
+E6OdaaEXXIPMoVZO1gjDEf5NVaVkBI92O00+09EeAW8RaEaF3mVIcO7j/GHDaCEk
+iq5g26lPxTp6V/jVRpqKmhxawrlKyc7nHCFMJoWtFq3hjxjV1pzFYAf+askvBzAS
+0z0zwL9keIdpzok3kjO32Rkox1DpfQougE+7JpICW7mGpxovB+3L/MGLYNzXVVYR
+ueQBmEXnLkC9ubAAFIHPE3iHFkgLTNLBGaiv6TeP9DJcQZM=
+-----END AGE ENCRYPTED FILE-----

run_once_before_decrypt-private-key.sh.tmpl

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if [ ! -f "/home/tyler/.config/chezmoi/key.txt" ]; then
+    mkdir -p "/home/tyler/.config/chezmoi"
+    chezmoi age decrypt --output "${HOME}/.config/chezmoi/key.txt" --passphrase "{{ .chezmoi.sourceDir }}/key.txt.age"
+    chmod 600 "/home/tyler/.config/chezmoi/key.txt"
+fi