unexplrd/nixos-blueprint
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync sops

Browse Source 
Signed-off-by: unexplrd <unexplrd@linerds.us>
This commit is contained in:
unexplrd
2025-03-29 20:51:38 +02:00
parent 0826503309
commit 277ba48671
2 changed files with 29 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
hosts/eldrid/sops.nix
View File

@ -1,5 +1,11 @@
{inputs, ...}: let
secretsPath = builtins.toString inputs.mysecrets;
{
config,
inputs,
...
}: let
s = inputs.mysecrets;
hostname = config.networking.hostName;
sopsFile = "${s}/hosts/${hostname}.yaml";
in {
imports = with inputs; [
sops-nix.nixosModules.sops
@ -11,7 +17,7 @@ in {
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
defaultSopsFile = "${secretsPath}/secrets.yaml";
defaultSopsFile = "${s}/common.yaml";
secrets = {
"user-password-hashed".neededForUsers = true;
"ssh-config" = {
@ -19,12 +25,14 @@ in {
mode = "0400";
owner = "user";
};
"ssh-eldrid-user" = {
"ssh-${hostname}-user" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519";
mode = "0400";
owner = "user";
};
"ssh-eldrid-user.pub" = {
"ssh-${hostname}-user.pub" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519.pub";
mode = "0400";
owner = "user";

23
hosts/sarien/sops.nix
View File

@ -1,8 +1,15 @@
{inputs, ...}: let
secretsPath = builtins.toString inputs.mysecrets;
{
config,
inputs,
...
}: let
s = inputs.mysecrets;
# TODO: stop relying on networking.hostName
hostname = "sarien";
sopsFile = "${s}/hosts/${hostname}.yaml";
in {
imports = [
inputs.sops-nix.nixosModules.sops
imports = with inputs; [
sops-nix.nixosModules.sops
];
sops = {
@ -11,7 +18,7 @@ in {
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
defaultSopsFile = "${secretsPath}/secrets.yaml";
defaultSopsFile = "${s}/common.yaml";
secrets = {
"user-password-hashed".neededForUsers = true;
"ssh-config" = {
@ -19,12 +26,14 @@ in {
mode = "0400";
owner = "user";
};
"ssh-sarien-user" = {
"ssh-${hostname}-user" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519";
mode = "0400";
owner = "user";
};
"ssh-sarien-user.pub" = {
"ssh-${hostname}-user.pub" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519.pub";
mode = "0400";
owner = "user";