feat(skein): add the weave and selvage role passwords

hosts/skein/configuration.nix

@@ -5,9 +5,15 @@
 # by modules/ad-join. Keep its lnx-skein-* groups and its computer object; the
 # new join resets the computer password. Before the install: remove skein from
 # the Ansible linux.yml run, so Ansible does not configure it too.
-{ config, ... }:
+{ config, lib, ... }:
 let
   schema = (import ../central-db-schema.nix).central;
+
+  # secrets/central-prod-<app>.age for each app that has one. An app without a
+  # file gets a role that cannot log in yet (modules/central-db).
+  passwordFiles = lib.filterAttrs (_: builtins.pathExists) (
+    lib.mapAttrs (app: _: ../../secrets/central-prod-${app}.age) schema.apps
+  );
 in
 {
   imports = [
@@ -31,8 +37,20 @@ in
     firewallInterfaces = [ "tailscale0" ];
   };
 
-  # One secret per app: secrets/central-prod-<app>.age, the password only.
-  # age.secrets = lib.genAttrs ... is added when the host key exists.
+  # Each password lands at <passwordDir>/<app>, where central-db-setup reads it
+  # as postgres. skein's host key must be a recipient (secrets/secrets.nix).
+  age.secrets = lib.mapAttrs' (
+    app: file:
+    lib.nameValuePair "central-prod-${app}" {
+      inherit file;
+      path = "${config.patchwork.centralDb.passwordDir}/${app}";
+      owner = "postgres";
+      mode = "400";
+    }
+  ) passwordFiles;
+
+  # Set the password again when its secret changes.
+  systemd.services.central-db-setup.restartTriggers = builtins.attrValues passwordFiles;
 
   system.stateVersion = "26.05";
 }

secrets/central-prod-weave.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 1uIO/w 1TIXWRjI/j556osdufZKRjZLn7d1gXVUm8IFpvLioAY
+pSHPuBsld/RzJBwcHOJjjPHnFNE+iHza4y1kO++YIdo
+-> ssh-ed25519 5jO4Pg Lrtk61WvFcs5vXi2atvQ7EbG8Rt3ExjOMpoqwPWfpnY
+T4crb6REqKGEPBx8iA0IDmV7i1N78NdGBs9n3OBu2e4
+--- sdm8+CNnC4xBNCN+a8RLRMAzwNmmHJAjACvg4nUrJiI
+Pâñ̺Ι<Œ²]mßN8¤‘£AðY¦ Û–þÚA³)8ÜS&—%$Zwñg¸€4~WmC%YÇ ‚yÕrõmîB—r
¾]HDZ¹6+j¯+í÷›[s¬ìã<:®«Kx

secrets/secrets.nix

@@ -97,6 +97,18 @@ in
     alastor
   ];
 
+  # App role passwords in patchwork_central (skein). Password only. Add the
+  # host that runs the app as a recipient when the app connects, and put the
+  # same password in that app's env file.
+  "central-prod-weave.age".publicKeys = [
+    jsp
+    skein
+  ];
+  "central-prod-selvage.age".publicKeys = [
+    jsp
+    skein
+  ];
+
   # Quilt's role password in patchwork_central_restricted (seam). Password
   # only. alastor does not get this file: the same password is in
   # quilt-env.age.