unexplrd/nixos-blueprint
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

flake.lock: update secrets

Browse Source 
hosts/dunamis/users.nix: update secrets
hosts/sarien/users.nix: update secrets

Signed-off-by: unexplrd <unexplrd@linerds.us>
This commit is contained in:
unexplrd
2025-04-06 13:24:23 +03:00
parent 150c8676d2
commit d5521a468d
3 changed files with 18 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
flake.lock generated
View File

@ -1120,11 +1120,11 @@
"mysecrets": { "mysecrets": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1743273192, "lastModified": 1743935322,
"narHash": "sha256-G9VhIc+Fc+w4LDR81xmkj3xxbrvYJUOTM9sM4191ucY=", "narHash": "sha256-x/yc+PK6q8mE1iWh43GRBfN0CfLL2RH4fDHvmQwcVRo=",
"ref": "refs/heads/main", "ref": "refs/heads/main",
"rev": "e8f749354223905785f4510fde10b528bf1b2ba2", "rev": "44bde2e703b87c91862d9273c57f8122a6b408b3",
"revCount": 13, "revCount": 14,
"type": "git", "type": "git",
"url": "ssh://gitea@gitea.linerds.us/unexplrd/nix-secrets" "url": "ssh://gitea@gitea.linerds.us/unexplrd/nix-secrets"
}, },

13
hosts/dunamis/users.nix
View File

@ -4,20 +4,21 @@
pkgs, pkgs,
... ...
}: let }: let
sopSec = config.sops.secrets; inherit (config.sops) secrets;
s = inputs.mysecrets; inherit (inputs) mysecrets;
in { in {
nix.settings.trusted-users = ["user" "nix-ssh"]; nix.settings.trusted-users = ["user" "nix-ssh"];
users.mutableUsers = false; users.mutableUsers = false;
users.users = { users.users = {
user = { user = {
hashedPasswordFile = sopSec."user-password-hashed".path; hashedPasswordFile = secrets."user-password-hashed".path;
extraGroups = ["wheel" "video" "libvirtd" "dialout"]; extraGroups = ["wheel" "video" "libvirtd" "dialout"];
isNormalUser = true; isNormalUser = true;
shell = pkgs.fish; shell = pkgs.fish;
openssh.authorizedKeys.keyFiles = map (f: s + "/ssh/" + f) [ openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/${f}") [
"id_ed25519_sarien_user.pub" "id_dunamis_ed25519.pub"
"id_ed25519_eldrid_user.pub" "id_eldrid_ed25519.pub"
"id_sarien_ed25519.pub"
]; ];
}; };
}; };

13
hosts/sarien/users.nix
View File

@ -4,20 +4,21 @@
pkgs, pkgs,
... ...
}: let }: let
sopSec = config.sops.secrets; inherit (config.sops) secrets;
secrets = inputs.mysecrets; inherit (inputs) mysecrets;
in { in {
nix.settings.trusted-users = ["user"]; nix.settings.trusted-users = ["user"];
users.mutableUsers = false; users.mutableUsers = false;
users.users = { users.users = {
user = { user = {
hashedPasswordFile = sopSec."user-password-hashed".path; hashedPasswordFile = secrets."user-password-hashed".path;
isNormalUser = true; isNormalUser = true;
extraGroups = ["wheel" "video" "libvirtd" "dialout"]; extraGroups = ["wheel" "video" "libvirtd" "dialout"];
shell = pkgs.fish; shell = pkgs.fish;
openssh.authorizedKeys.keyFiles = [ openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/${f}") [
"${secrets}/ssh/id_ed25519_sarien_user.pub" "id_dunamis_ed25519.pub"
"${secrets}/ssh/id_ed25519_eldrid_user.pub" "id_eldrid_ed25519.pub"
"id_sarien_ed25519.pub"
]; ];
}; };
}; };