unexplrd/nixos-blueprint
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync sops and users

Browse Source 
Signed-off-by: unexplrd <unexplrd@linerds.us>
This commit is contained in:
unexplrd
2025-04-06 13:38:15 +03:00
parent d5521a468d
commit 1f0bbc9daf
4 changed files with 60 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
hosts/dunamis/sops.nix
View File

@ -3,9 +3,15 @@
inputs,
...
}: let
s = inputs.mysecrets;
hostname = config.networking.hostName;
sopsFile = "${s}/hosts/${hostname}.yaml";
inherit (inputs) mysecrets;
# TODO: stop relying on networking.hostName
inherit (config.networking) hostName;
sopsFile = mysecrets + "/hosts/${hostName}.yaml";
dotSsh = name: "/home/user/.ssh/" + name;
sshKey = {
mode = "0400";
owner = "user";
};
in {
imports = with inputs; [
sops-nix.nixosModules.sops
@ -17,45 +23,39 @@ in {
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
defaultSopsFile = "${s}/common.yaml";
defaultSopsFile = mysecrets + "/common.yaml";
secrets = {
"user-password-hashed".neededForUsers = true;
"ssh-config" = {
path = "/home/user/.ssh/config";
path = dotSsh "config";
mode = "0400";
owner = "user";
};
"ssh-${hostname}-user" = {
"ssh-${hostName}-user" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_ed25519";
};
"ssh-${hostname}-user.pub" = {
"ssh-${hostName}-user.pub" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519.pub";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_ed25519.pub";
};
"ssh-unexplrd" = {
path = "/home/user/.ssh/id_unexplrd_ed25519";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_unexplrd_ed25519";
};
"ssh-unexplrd.pub" = {
path = "/home/user/.ssh/id_unexplrd_ed25519.pub";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_unexplrd_ed25519.pub";
};
"ssh-uni" = {
path = "/home/user/.ssh/id_uni_ed25519";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_uni_ed25519";
};
"ssh-uni.pub" = {
path = "/home/user/.ssh/id_uni_ed25519.pub";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_uni_ed25519.pub";
};
};
};

53
hosts/eldrid/sops.nix
View File

@ -3,9 +3,15 @@
inputs,
...
}: let
s = inputs.mysecrets;
hostname = config.networking.hostName;
sopsFile = "${s}/hosts/${hostname}.yaml";
inherit (inputs) mysecrets;
# TODO: stop relying on networking.hostName
inherit (config.networking) hostName;
sopsFile = mysecrets + "/hosts/${hostName}.yaml";
dotSsh = name: "/home/user/.ssh/" + name;
sshKey = {
mode = "0400";
owner = "user";
};
in {
imports = with inputs; [
sops-nix.nixosModules.sops
@ -17,45 +23,38 @@ in {
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
defaultSopsFile = "${s}/common.yaml";
defaultSopsFile = mysecrets + "/common.yaml";
secrets = {
"user-password-hashed".neededForUsers = true;
"ssh-config" = {
path = "/home/user/.ssh/config";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "config";
};
"ssh-${hostname}-user" = {
"ssh-${hostName}-user" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_ed25519";
};
"ssh-${hostname}-user.pub" = {
"ssh-${hostName}-user.pub" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519.pub";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_ed25519.pub";
};
"ssh-unexplrd" = {
path = "/home/user/.ssh/id_unexplrd_ed25519";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_unexplrd_ed25519";
};
"ssh-unexplrd.pub" = {
path = "/home/user/.ssh/id_unexplrd_ed25519.pub";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_unexplrd_ed25519.pub";
};
"ssh-uni" = {
path = "/home/user/.ssh/id_uni_ed25519";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_uni_ed25519";
};
"ssh-uni.pub" = {
path = "/home/user/.ssh/id_uni_ed25519.pub";
mode = "0400";
owner = "user";
inherit (sshKey) mode owner;
path = dotSsh "id_uni_ed25519.pub";
};
};
};

21
hosts/eldrid/users.nix
View File

@ -4,27 +4,22 @@
pkgs,
...
}: let
sopSec = config.sops.secrets;
secrets = inputs.mysecrets;
inherit (config.sops) secrets;
inherit (inputs) mysecrets;
in {
nix.settings.trusted-users = ["user"];
users.mutableUsers = false;
users.users = {
user = {
hashedPasswordFile = sopSec."user-password-hashed".path;
# passwordFile = config.sops.secrets.user-password.path;
isNormalUser = true;
hashedPasswordFile = secrets."user-password-hashed".path;
extraGroups = ["wheel" "video" "libvirtd" "dialout"];
isNormalUser = true;
shell = pkgs.fish;
openssh.authorizedKeys.keyFiles = [
"${secrets}/ssh/id_ed25519_sarien_user.pub"
"${secrets}/ssh/id_ed25519_eldrid_user.pub"
openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/${f}") [
"id_dunamis_ed25519.pub"
"id_eldrid_ed25519.pub"
"id_sarien_ed25519.pub"
];
};
# work = {
# isNormalUser = true;
# extraGroups = ["video"];
# shell = pkgs.nushell;
# };
};
}

6
hosts/sarien/sops.nix
View File

@ -1,8 +1,4 @@
{
config,
inputs,
...
}: let
{inputs, ...}: let
inherit (inputs) mysecrets;
# TODO: stop relying on networking.hostName
hostname = "sarien";