sops

hosts/dunamis/configuration.nix

@@ -12,6 +12,7 @@
     ./programs.nix
     ./stylix.nix
     ./users.nix
+    ./sops.nix
   ];
 
   desktop = {

hosts/dunamis/sops.nix

@@ -0,0 +1,24 @@
+{inputs, ...}: let
+  secretsPath = builtins.toString inputs.mysecrets;
+in {
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
+  sops = {
+    age = {
+      sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+    defaultSopsFile = "${secretsPath}/secrets.yaml";
+    secrets = {
+      "user-password-hashed" = {};
+      "ssh-private-dunamis-user" = {
+        path = "/home/user/.ssh/id_ed25519";
+        mode = "0400";
+        owner = "user";
+      };
+    };
+  };
+}

hosts/dunamis/users.nix

@@ -1,10 +1,25 @@
-{pkgs, ...}: {
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}: let
+  sopSec = config.sops.secrets;
+  secrets = inputs.mysecrets;
+in {
   nix.settings.trusted-users = ["user"];
+  users.mutableUsers = false;
   users.users = {
     user = {
+      hashedPasswordFile = sopSec."user-password-hashed".path;
+      # passwordFile = config.sops.secrets.user-password.path;
       isNormalUser = true;
       extraGroups = ["wheel" "video" "libvirtd" "dialout"];
       shell = pkgs.fish;
+      openssh.authorizedKeys.keyFiles = [
+        "${secrets}/ssh/id_ed25519_sarien_user.pub"
+        "${secrets}/ssh/id_ed25519_eldrid_user.pub"
+      ];
     };
     # work = {
     #   isNormalUser = true;

hosts/dunamis/users/user/sops.nix

@@ -0,0 +1,20 @@
+{inputs, ...}: let
+  secretsPath = builtins.toString inputs.mysecrets;
+in {
+  imports = with inputs; [
+    sops-nix.homeManagerModules.sops
+  ];
+
+  sops = {
+    age.keyFile = "/var/lib/sops-nix/key.txt";
+
+    defaultSopsFile = "${secretsPath}/secrets.yaml";
+    validateSopsFiles = false;
+
+    secrets = {
+      "ssh/private/dunamis-user" = {
+        path = "/home/user/.ssh/id_ed25519";
+      };
+    };
+  };
+}