nix-files/.sops.yaml

keys:
  - &user_desko_colin age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x
  - &user_lappy_colin age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g
  - &user_servo_colin age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu
  - &user_moby_colin age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9
  - &host_desko age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v
  - &host_lappy age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn
  - &host_servo age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf
  - &host_moby age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt
creation_rules:
  - path_regex: secrets/common*
    key_groups:
    - age:
      - *user_desko_colin
      - *user_lappy_colin
      - *user_servo_colin
      - *user_moby_colin
      - *host_desko
      - *host_lappy
      - *host_servo
      - *host_moby
  - path_regex: secrets/servo*
    key_groups:
    - age:
      - *user_desko_colin
      - *user_lappy_colin
      - *user_servo_colin
      - *host_servo
  - path_regex: secrets/desko*
    key_groups:
    - age:
      - *user_desko_colin
      - *user_lappy_colin
      - *host_desko
  - path_regex: secrets/lappy*
    key_groups:
    - age:
      - *user_lappy_colin
      - *user_desko_colin
      - *host_lappy
  - path_regex: secrets/moby*
    key_groups:
    - age:
      - *user_desko_colin
      - *user_lappy_colin
      - *user_moby_colin
      - *host_moby
secrets: add an example sops secret 2022-06-06 23:36:22 +00:00			`keys:`
			`- &user_desko_colin age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x`
update lappy key 2022-06-20 23:03:52 +00:00			`- &user_lappy_colin age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g`
rename 'uninsane' machine -> 'servo' 2022-06-12 22:11:41 +00:00			`- &user_servo_colin age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu`
secrets: update `moby` keys 2022-09-01 00:01:41 +00:00			`- &user_moby_colin age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9`
rotate sops key for desko 2022-06-10 07:32:19 +00:00			`- &host_desko age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v`
secrets: add lappy host key to access list 2022-06-07 01:07:28 +00:00			`- &host_lappy age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn`
rename 'uninsane' machine -> 'servo' 2022-06-12 22:11:41 +00:00			`- &host_servo age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf`
secrets: update `moby` keys 2022-09-01 00:01:41 +00:00			`- &host_moby age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt`
secrets: add an example sops secret 2022-06-06 23:36:22 +00:00			`creation_rules:`
sops: fix key map after universal -> common rename 2023-05-15 10:06:02 +00:00			`- path_regex: secrets/common*`
secrets: add an example sops secret 2022-06-06 23:36:22 +00:00			`key_groups:`
			`- age:`
			`- *user_desko_colin`
sops: add moby and lappy pubkeys 2022-06-06 23:54:05 +00:00			`- *user_lappy_colin`
rename 'uninsane' machine -> 'servo' 2022-06-12 22:11:41 +00:00			`- *user_servo_colin`
sops: add moby and lappy pubkeys 2022-06-06 23:54:05 +00:00			`- *user_moby_colin`
secrets: add an example sops secret 2022-06-06 23:36:22 +00:00			`- *host_desko`
secrets: add lappy host key to access list 2022-06-07 01:07:28 +00:00			`- *host_lappy`
rename 'uninsane' machine -> 'servo' 2022-06-12 22:11:41 +00:00			`- *host_servo`
secrets: add moby host to the access list 2022-06-07 01:05:28 +00:00			`- *host_moby`
servo: matrix-appservice-discord: hide keys in sops, and enable. 2022-10-06 05:38:20 +00:00			`- path_regex: secrets/servo*`
migrate duplicity PASSPHRASE to sops 2022-06-07 02:06:53 +00:00			`key_groups:`
			`- age:`
			`- *user_desko_colin`
secrets/servo: grant access to lappy 2022-10-24 13:56:16 +00:00			`- *user_lappy_colin`
rename 'uninsane' machine -> 'servo' 2022-06-12 22:11:41 +00:00			`- *user_servo_colin`
			`- *host_servo`
secrets: split desko.yaml into one-secret-per-file 2023-05-14 02:29:30 +00:00			`- path_regex: secrets/desko*`
desko: enable duplicity backups 2022-06-10 08:43:48 +00:00			`key_groups:`
			`- age:`
			`- *user_desko_colin`
			`- *user_lappy_colin`
			`- *host_desko`
secrets: split lappy.yaml into per-secret files 2023-05-14 02:33:21 +00:00			`- path_regex: secrets/lappy*`
lappy: store the hashed user passwd in git and decrypt it into /etc/passwd on boot this approach lets me persist the password. persisting /etc/shadow directly wasn't so feasible. populating /etc/shadow at activation time is something nix already does and is easy to plug into. so we store the passwd hash in this repo, but encrypt it to the destination machine's ssh pubkey to add enough entropy that it's not brute-forceable through the public git repo. 2022-10-23 13:48:39 +00:00			`key_groups:`
			`- age:`
			`- *user_lappy_colin`
			`- *user_desko_colin`
			`- *host_lappy`
secrets: split moby.yaml into file-per-secret 2023-05-14 02:42:07 +00:00			`- path_regex: secrets/moby*`
moby: enable a statically-assigned but encrypted password 2022-10-24 14:39:50 +00:00			`key_groups:`
			`- age:`
			`- *user_desko_colin`
			`- *user_lappy_colin`
			`- *user_moby_colin`
			`- *host_moby`