diff options
| -rw-r--r-- | .sops.yaml | 12 | ||||
| -rw-r--r-- | flake.nix | 2 | ||||
| -rw-r--r-- | home/root/kaitain.nix | 4 | ||||
| -rw-r--r-- | home/root/richese.nix | 4 | ||||
| -rw-r--r-- | hosts/kaitain/default.nix | 9 | ||||
| -rw-r--r-- | hosts/richese/default.nix | 9 | ||||
| -rw-r--r-- | hosts/secrets/kaitain.yaml | 30 | ||||
| -rw-r--r-- | hosts/secrets/richese.yaml | 30 |
8 files changed, 100 insertions, 0 deletions
@@ -17,7 +17,9 @@ keys: - &arrakis age1mkqxkwse7hrnxtcgqe0wdzhhrxk55syx2wpcngemecz0d7hugsnqupw3de - &darkstar age1z6g6etwcer433v97lwjrruetdh9fswkgjh9w702wzdc2ydvy5q8ssrfy9r - &ginaz age1900zc5caephklavvjxp0g4qqvyqlzg3sux69y9p092g3d3qck3kqz62reh + - &kaitain age1fptscuj4qa39238xfvc7envgxr4cf29z3zaejp2v3q703tq45dasf8vadl - &nipsy age1a9gp70y8576pkvklz2arz6h9ecnrjeue2vvh9mvvk92z4ymqrg4qdqm9va + - &richese age1wv08vfv7mlwkhkn2pkq0gd94a3wz0gc3x3eq0szxem05xg05nfhq2glvv9 creation_rules: - path_regex: ^home/nipsy/secrets/arrakis.yaml$ @@ -48,3 +50,13 @@ creation_rules: - age: - *ginaz - *nipsy + - path_regex: ^hosts/secrets/kaitain.yaml$ + key_groups: + - age: + - *kaitain + - *nipsy + - path_regex: ^hosts/secrets/richese.yaml$ + key_groups: + - age: + - *richese + - *nipsy @@ -119,6 +119,7 @@ home-manager.users.root = import ./home/root/kaitain.nix; home-manager.users.nipsy = import ./home/nipsy/kaitain.nix; } + sops-nix.nixosModules.sops ]; }; @@ -174,6 +175,7 @@ home-manager.users.root = import ./home/root/richese.nix; home-manager.users.nipsy = import ./home/nipsy/richese.nix; } + sops-nix.nixosModules.sops ]; }; diff --git a/home/root/kaitain.nix b/home/root/kaitain.nix index 83c92cd..72dbda0 100644 --- a/home/root/kaitain.nix +++ b/home/root/kaitain.nix @@ -3,4 +3,8 @@ imports = [ common/core ]; + + nix.extraOptions = '' + !include /run/secrets/nix-access-token-github + ''; } diff --git a/home/root/richese.nix b/home/root/richese.nix index 83c92cd..72dbda0 100644 --- a/home/root/richese.nix +++ b/home/root/richese.nix @@ -3,4 +3,8 @@ imports = [ common/core ]; + + nix.extraOptions = '' + !include /run/secrets/nix-access-token-github + ''; } diff --git a/hosts/kaitain/default.nix b/hosts/kaitain/default.nix index defaa13..72aadff 100644 --- a/hosts/kaitain/default.nix +++ b/hosts/kaitain/default.nix @@ -51,6 +51,15 @@ services.openssh.openFirewall = false; services.xserver.videoDrivers = lib.mkForce [ "vmware" "virtualbox" "modesetting" ]; + sops = { + age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + defaultSopsFile = ../secrets/kaitain.yaml; + + secrets = { + "nix-access-token-github" = {}; + }; + }; + system.stateVersion = "23.11"; #systemd.user.services = let diff --git a/hosts/richese/default.nix b/hosts/richese/default.nix index a57e142..b049cde 100644 --- a/hosts/richese/default.nix +++ b/hosts/richese/default.nix @@ -48,6 +48,15 @@ services.openssh.openFirewall = false; services.xserver.videoDrivers = lib.mkForce [ "vmware" "virtualbox" "modesetting" ]; + sops = { + age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + defaultSopsFile = ../secrets/richese.yaml; + + secrets = { + "nix-access-token-github" = {}; + }; + }; + system.stateVersion = "23.11"; #systemd.user.services = let diff --git a/hosts/secrets/kaitain.yaml b/hosts/secrets/kaitain.yaml new file mode 100644 index 0000000..255695a --- /dev/null +++ b/hosts/secrets/kaitain.yaml @@ -0,0 +1,30 @@ +nix-access-token-github: ENC[AES256_GCM,data:OcAY30aGdCEHyl6DW6mYOLI166w/bGBeTKQ645EG3lL0k1IHvu/ox/PG28AjlcCj4pZHeYxEVIYut6a9VoPNjRT3ohA=,iv:8kRcGkGm+6hWAQ0/0FwqDeS7i0GE8cyd0YsC9J6kl54=,tag:G1J/5pK9dQ2N29oz5byVuA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1fptscuj4qa39238xfvc7envgxr4cf29z3zaejp2v3q703tq45dasf8vadl + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOQ0hGWkhrVE9jR2Z2NEpn + V1djakYwNzBrTHptZ2Fwc1VBdHNhcWJTRFNVCmpDNEgxaDVwQ2lBMk9hb2srSDEv + UmQ5MWV5eU9RYmMxL3MvZWU1VGpOQlUKLS0tIGJHbktSMzlETWpaOW9ieDJIZkZW + T3RjUlJTTys1MFlLQkZoa3hEVStZSG8KcDg7nsWpi4RReeEchZfEjASqKbvbozoO + PINQc7SBopkVahXFu5qJClGwszHecehRbTm6Z+NZmGW3e6zoST0+Eg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1a9gp70y8576pkvklz2arz6h9ecnrjeue2vvh9mvvk92z4ymqrg4qdqm9va + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXcG9Uem9EV242U2xUQXl0 + TXFtWnluTEh1alJnaElLSEMvN2pKdkY4cmpjCnFhRC9TeHk0SlAvU1VXRHNaOC9R + eHhtVEp1UTh5T0RVdWREbU1ablpnU1EKLS0tIE9Dek1iSkgxTTlnYkpqMjlXUDh5 + RUQzdEkrQTU1cC9OU1B3L1cva0JQTTQKzAuNy/7h5XyOIiQh/8fXfgri90dTW/qt + wn/snTnrukwPaeQXsAHQDvzueYxSEtHqk0WYT8sOAfuzOQP7wGoGFg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-11-18T18:32:59Z" + mac: ENC[AES256_GCM,data:YHZ+rkkVX2CX1XgLKFvSEf1Hg6i6wJwNV2IdMx8kjyWSVjAx2PQjKvy/dLFsqspo1FF4Bo++jyaEn0yxuouVful12Q/6RAhf1HRDXK0TjPTWf/vsCw0Mlv/zcPOKMEPG4ltP6bSDG6WtTtFx3Ck6stQwepF2omoVT2E4kj1KONM=,iv:uHs5N9sMfPn4+ZEaU6BlioESWy/BijUfYHu/5UrA4H8=,tag:b/lwx7ex21Jw0knpuy1TPw==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.9.1 diff --git a/hosts/secrets/richese.yaml b/hosts/secrets/richese.yaml new file mode 100644 index 0000000..45bb5e0 --- /dev/null +++ b/hosts/secrets/richese.yaml @@ -0,0 +1,30 @@ +nix-access-token-github: ENC[AES256_GCM,data:g+9Vi3SOLWFkZGb6KzlYdYmv9JSIoYd4OaOhAYZLrxlJKWqsa66Tc2z5dFWr/wyPbitxRAzQB1xRZI3CUbMWOWb06L8=,iv:kjdbr2KLLWfIsSNTCespLXdQ4BKm4caiRASaCYWKFHA=,tag:DBqjdPHnMCSa6obeSy0WzA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1wv08vfv7mlwkhkn2pkq0gd94a3wz0gc3x3eq0szxem05xg05nfhq2glvv9 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTlJRaW10L2xsYUNLcmNY + K2ltQ1MzdWRzdEovZDN6eS9SNEIzWTJGQzBjCm1aMW00Tlc5OXlrdmlQNXJ0dU0r + SG5XNGRCTGVuTWV2cmpoZ2trZmE4RjgKLS0tIGcyMGpqejVLYVpYOFRaTlNzMXJB + UTVnbHNYNm5SNzVZR1NpNWp0WXhoRkEKcdkvqxMNqWX2S8Yrne6blNgr7T3AbEoH + 2QNqkFinLqhvUWHIpZA+WE2+DF8JQckmmOr/TuS7J/2lYw4ImQEf2A== + -----END AGE ENCRYPTED FILE----- + - recipient: age1a9gp70y8576pkvklz2arz6h9ecnrjeue2vvh9mvvk92z4ymqrg4qdqm9va + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXT01vVUsvUDhJQ0dDcTY5 + eU9FN0hSQ2hLRUd2d1B4SVBIWlphMStHU3hrCmFJeEJJVmRHYmF5VnJjcVVYT1Fy + Qk1kQWcwOWphMlNZcHhpcXNGWEE0WGcKLS0tIERUMlJGaHRQN0QvdGJtYlNXYlhi + MGt6VkNzc3hGU2FDVWxsM1Rqdk9qTkEKA5viW8YGBdqvLVLYEdzLWWggxQ2BrDOa + atzlSR0WjUsK316X4HtVMyllk0FvLy4QdUP40/XLgd5DpxZZds3OiQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-11-18T18:32:48Z" + mac: ENC[AES256_GCM,data:VvcWlUPFgdQ/YAioKnZzK69PYulZanKNQOan3cHLF8BRehkw1VvVFAmPW0cPLY66cMXFma9rFxaP5XAdRojs2J4ViOgzbhrCHYTVCSA3VTcgBZRTPAfTggztwoPKic0EhE2HxfykhQCrPVxqa23Z25x4q1LuWskE+BMbGubPSP0=,iv:bJnO2oE3ogvpXjCUFKd/+5RXO2udL5a2UXdBdb5Wfec=,tag:dbZR0/BQpPAL996Siyta/A==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.9.1 |