unexplrd/nixos-blueprint
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

flake.lock: update mysecrets

Browse Source 
hosts/dunamis/sops.nix: make it more composable

Signed-off-by: unexplrd <unexplrd@linerds.us>
This commit is contained in:
unexplrd
2025-03-29 20:41:19 +02:00
parent ce52cc55d0
commit 3f602f925f
2 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
flake.lock generated
View File

@ -1003,11 +1003,11 @@
"mysecrets": {
"flake": false,
"locked": {
"lastModified": 1742907009,
"narHash": "sha256-BP5CUVdaXcBdeiPeeF4lQWd/FweyaNTv9Td6doem/O0=",
"lastModified": 1743273192,
"narHash": "sha256-G9VhIc+Fc+w4LDR81xmkj3xxbrvYJUOTM9sM4191ucY=",
"ref": "refs/heads/main",
"rev": "ef50249e9e26737dde7d9095ce528c2c47097494",
"revCount": 12,
"rev": "e8f749354223905785f4510fde10b528bf1b2ba2",
"revCount": 13,
"type": "git",
"url": "ssh://gitea@gitea.linerds.us/unexplrd/nix-secrets"
},

18
hosts/dunamis/sops.nix
View File

@ -1,4 +1,12 @@
{inputs, ...}: {
{
config,
inputs,
...
}: let
s = inputs.mysecrets;
hostname = config.networking.hostName;
sopsFile = "${s}/hosts/${hostname}.yaml";
in {
imports = with inputs; [
sops-nix.nixosModules.sops
];
@ -9,7 +17,7 @@
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
defaultSopsFile = "${toString inputs.mysecrets}/secrets.yaml";
defaultSopsFile = "${s}/common.yaml";
secrets = {
"user-password-hashed".neededForUsers = true;
"ssh-config" = {
@ -17,12 +25,14 @@
mode = "0400";
owner = "user";
};
"ssh-dunamis-user" = {
"ssh-${hostname}-user" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519";
mode = "0400";
owner = "user";
};
"ssh-dunamis-user.pub" = {
"ssh-${hostname}-user.pub" = {
inherit sopsFile;
path = "/home/user/.ssh/id_ed25519.pub";
mode = "0400";
owner = "user";