Configure the production grid with a deploy key

morph/grid/production/grid.nix

@@ -13,6 +13,14 @@ let
     privateKeyPath = toString ./. + "/${rawConfig.privateKeyPath}";
   };
 
+  # Configure deployment management authorization for all systems in the grid.
+  deployment = {
+    services.private-storage.deployment = {
+      authorizedKey = builtins.readFile "${config.publicKeyPath}/deploy_key.pub";
+      gridName = "production";
+    };
+  };
+
   payments = {
     imports = [
       gridlib.issuer
@@ -20,6 +28,7 @@ let
       (gridlib.customize-issuer (config // {
         monitoringvpnIPv4 = "172.23.23.11";
       }))
+      deployment
     ];
   };
 
@@ -33,6 +42,7 @@ let
         monitoringvpnIPv4 = "172.23.23.1";
         stateVersion = "19.09";
       })
+      deployment
     ];
   };
 
@@ -58,6 +68,9 @@ let
         monitoringvpnIPv4 = vpnIP;
         inherit stateVersion;
       }))
+
+      # Also configure deployment management authorization
+      deployment
     ];
 
     # And supply configuration for those hardware / network / bootloader

morph/grid/production/public-keys/deploy_key.pub

+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK50RwXncelNB4JAazoXEhCxXbJZ79qWcQMAWeX14H+W exarkun@baryon