@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2025 Lubin Bailly <lubin@dgnum.eu>
+#
+# SPDX-License-Identifier: EUPL-1.2
+

@@ -0,0 +7,4 @@
+set -o pipefail
+shopt -s lastpipe
+
+colmena eval -E '{nodes, lib, ...}: let inherit (nodes.iso._module.specialArgs) meta; admins = ['"$(for i; do echo -n " \"$i\" "; done)"']; in lib.filter (node: lib.any (adm: lib.elem adm admins) (meta.organization.groups.root ++ meta.nodes."${node}".admins)) (builtins.attrNames nodes)' | jq -r '.[]' | xargs rekey-machine

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
+# SPDX-FileContributor: Lubin Bailly <lubin@dgnum.eu>
+#
+# SPDX-License-Identifier: EUPL-1.2

@@ -0,0 +8,4 @@
+set -o pipefail
+shopt -s lastpipe
+
+for sdir in $(colmena eval -E '{ nodes, lib, ... }: builtins.map builtins.toString (lib.unique (lib.concatLists (lib.mapAttrsToList (_: { config, ... }: lib.optionals (lib.hasAttr "age-secrets" config) config.age-secrets.sources) (lib.getAttrs ['"$(for i; do echo -n " \"$i\" "; done)"'] nodes))))' | jq -r '.[]'); do

@@ -0,0 +12,4 @@
+  echo ""
+  echo "Rekey all agenix secrets sources of machines managed by ADMINS."
+  echo "This will only rekey secrets ADMINS are currently managing from meta,"
+  echo "it won't detect machines the ADMINS stopped managing."

@@ -0,0 +12,4 @@
+  echo "Usage : $0 HOSTNAMES..."
+  echo ""
+  echo "Rekey all agenix secrets sources for HOSTNAMES,"
+  echo "commonly modules secrets and /machines/CATEGORY/HOSTNAME/secrets."