colin
/
nix-files
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

secrets: split desko.yaml into one-secret-per-file

This commit is contained in:
Colin 2023-05-14 02:29:30 +00:00
parent 88bce722d5
commit 318efe09e2
10 changed files with 110 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.sops.yaml
View File

@ -26,7 +26,7 @@ creation_rules:
- *user_lappy_colin
- *user_servo_colin
- *host_servo
- path_regex: secrets/desko.yaml$
- path_regex: secrets/desko*
key_groups:
- age:
- *user_desko_colin

25
hosts/by-name/desko/default.nix
View File

@ -4,13 +4,27 @@
./fs.nix
];
sops.secrets.colin-passwd = {
sopsFile = ../../../secrets/desko/colin-passwd.bin;
format = "binary";
neededForUsers = true;
};
sops.secrets.duplicity_passphrase = {
sopsFile = ../../../secrets/desko/duplicity_passphrase.env.bin;
format = "binary";
};
sops.secrets.nix_serve_privkey = {
sopsFile = ../../../secrets/desko/nix_serve_privkey.bin;
format = "binary";
};
sane.roles.build-machine.enable = true;
sane.roles.client = true;
sane.roles.dev-machine = true;
sane.services.wg-home.enable = true;
sane.services.wg-home.ip = config.sane.hosts.by-name."desko".wg-home.ip;
sane.services.duplicity.enable = true;
sane.services.nixserve.sopsFile = ../../../secrets/desko.yaml;
sane.services.nixserve.secretKeyFile = config.sops.secrets.nix_serve_privkey.path;
sane.gui.sway.enable = true;
sane.programs.iphoneUtils.enableFor.user.colin = true;
@ -23,11 +37,6 @@
# needed to use libimobiledevice/ifuse, for iphone sync
services.usbmuxd.enable = true;
sops.secrets.colin-passwd = {
sopsFile = ../../../secrets/desko.yaml;
neededForUsers = true;
};
# don't enable wifi by default: it messes with connectivity.
systemd.services.iwd.enable = false;
@ -45,10 +54,6 @@
'';
};
sops.secrets.duplicity_passphrase = {
sopsFile = ../../../secrets/desko.yaml;
};
programs.steam = {
enable = true;
# not sure if needed: stole this whole snippet from the wiki

4
hosts/by-name/servo/secrets.nix
View File

@ -32,6 +32,10 @@
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."nix_serve_privkey" = {
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."pleroma_secrets" = {
sopsFile = ../../../secrets/servo.yaml;
};

2
hosts/by-name/servo/services/nixserve.nix
View File

@ -17,5 +17,5 @@
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."nixcache" = "native";
sane.services.nixserve.enable = true;
sane.services.nixserve.sopsFile = ../../../../secrets/servo.yaml;
sane.services.nixserve.secretKeyPath = config.sops.secrets.nix_serve_privkey.path;
}

10
modules/services/nixserve.nix
View File

@ -13,21 +13,17 @@ in
default = false;
type = types.bool;
};
sane.services.nixserve.sopsFile = mkOption {
sane.services.nixserve.secretKeyFile = mkOption {
type = types.path;
description = "path to file that contains the nix_serv_privkey secret (can be in VCS)";
description = "path to file that contains the nix_serv_privkey secret (should not be in the store)";
};
};
config = mkIf cfg.enable {
services.nix-serve = {
enable = true;
secretKeyFile = config.sops.secrets.nix_serve_privkey.path;
inherit (cfg) secretKeyFile;
openFirewall = true; # not needed for servo; only desko
};
sops.secrets.nix_serve_privkey = {
sopsFile = cfg.sopsFile;
};
};
}

42
secrets/desko.yaml
View File

@ -1,42 +0,0 @@
duplicity_passphrase: ENC[AES256_GCM,data:+UXXMiMNR3r3xvIzQVctDnFpVElx9xYOQBQsWHSZKlCDZs/Jlte48IPp3bc1u+bx1U9y5Frm5QiZYo/gAksRCjFcOTE6pc/bIREyAqB59psp5Ijhg59ToVBl3cm0II55rIDqDcBbHV2UUIvbbKn4/FBnY9y8uW8X383cHvpDPqxiPOTa,iv:eDkE+NmM2kKG4wr9sLM5IXlmlkNUaHNyE3r9rY/uayI=,tag:n9QmRFvmKv8H3gi8OAQdcw==,type:str]
#ENC[AES256_GCM,data:yU9cr6MXjS4m69BeIUjUw477wt4c1djYof3Qlfr4Dytv8hWqCuqThDwQTMY5jfHdv5ipS0aEjf7GWu2M2t9W88fYdxnTN2m8IfYZp76YcjxO4fup5BXiLGIjnm+qI0g=,iv:nPo8FyGiyLRQozE4kZ6Rei6CObvbVynOs3jdMvdkpZw=,tag:+4esxPiewSsjwao6ZhAMxA==,type:comment]
nix_serve_privkey: ENC[AES256_GCM,data:/Ph9J00cV7PcfpJw/NWcBpkQR+a0SQyHv1jmF4CkH+Uj8l+cRcXWynAc2APenMSfHdighXMqjsXuwRbGo0S57YuMXQjFbI8jhbXEhhAWlmET1q7uRaaZRSgq34qABw==,iv:LLYgLauPsD+3mx1GTjEUkiXgdWsnqixCJl4UfSdS5Ac=,tag:S7V6GKezS/JsbZVfq9DjjA==,type:str]
colin-passwd: ENC[AES256_GCM,data:/b+l5zTlOhdoiFaMVG5HB98AOGfGZtwkH+IS/mhDgHNZ4J+t3OiEBAFPl/KPctg6ZM55QiAjNnnJ8zAsKL85om6amvrWF/Qz17qC9+pZF+6Ef8xvTQr3VPlFEYq4rGb74jQ7uyvtCjn0Ow==,iv:Z0qUimlPQMu6rsjn5b/Xfw99NzbXGS8B/hNWE+f+GoM=,tag:uGB1DZzHiLCkOtlAA58mmg==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlWnpQbnFFMWtLODFlbU1M
OGswTzhKRCtDZ0lVVTZWK3hmcnh4SlRRSjJvCjkvYmFTbzBQczl2dXpQdGYvWXFJ
MDllOUlkd1hUTDR3SS9KV0N3VDF5VWMKLS0tIFRQQ1hrMStmK0xqejUra1Q1NHBp
a29tdklGaUd2MHAwNDQxQVZsN1VYcVEKtFynEmTqzFnomLB06VfALag0h9ECvMpv
dWr6x2419QlXOMSkLHYLiIPydh7xJUAV0tMWoIEcpKfmsMKDXFYnJQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1Sm45cGp1akl3elBmUEtU
UUhHOVB1U2VHaTZFdGxSMUNINlc1YzN4RzNVCmtDYnE2NWhHVmU2a0YzMGxybWNQ
VDZ0cm9wcXlsV2FZQzBLK2dkc1JiblEKLS0tIFpDUWFTRkZSNXJoR1dZYlVERnJj
YlVrNE9aVHF0RFZ3WDB3VVMwdEt5ZUUK1d2GIJkS+8vSConO3nN+YCvTmc+B/bNF
+A5N4EmivJarrat4WUUzzfvlyCNcb72chvQSvVYK+IyfCCwVjiYhgA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzTWd1YTVVbm9xbUg2QVZH
QXZseXBIdVJISDd2b01VUG5acVRNNjA4RTMwCklWTVhqbVNPcnZHMGhIQk9EU2xP
aFhIbENNamRjbW56UkdmdjVmdndJSlUKLS0tIHI1Q05zV2ZZd1dZK2lVTTBLU3Jr
Si9kT0ZMUnJJWlhUZ3FFakZFaDlPdEEKXtWfh6wdGPin1h/UUs21cdspddpW1YDq
rCKS2DI2KWdgciih9FnmWGAwGUhB3uhimUr6hgho4z+dZfLrpoP1PA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-11-16T03:02:28Z"
mac: ENC[AES256_GCM,data:EFeon4GvDEFVTJh9IR0dd8S/vVeWlMuEe9rUcL6FDYLsfm5qFb5rhsCDY/rQNanNsTcsDLK3oOXoBXP168fzwHotdjoNNyiCYAFDigVqKPt4dk9vnzH91ccyu6NUhlFlKzuDHwXkWbNJA7pNyMD3w4NKt7HbLu+r1YxOAaytWzM=,iv:xrllCUns1WY/gCuHKmZtUr5/piE4OBKHrmiewBbVBH4=,tag:8JWLLZqLFMWcDNgWwJL+Ig==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.7.3

2
secrets/desko/README.md Normal file
View File

@ -0,0 +1,2 @@
- nix_serve_privkey.bin:
- generate with `nix-store --generate-binary-cache-key desko cache-priv-key.pem cache-pub-key.pem`

28
secrets/desko/colin-passwd.bin Normal file
View File

@ -0,0 +1,28 @@
{
"data": "ENC[AES256_GCM,data:+QAXA6sZw9EtpVmi6XscLQi/O8N3XNdouPASq6WR8T7vKhqB8t1+h3U/GFAPz11n6I6cicaukgmydpx+gK7OgzxL/Zq5nOK7YzN9su+A4EpyIrcpN0PTgme3cjE72DIpgvo3EsypaUUQV28=,iv:B79gv4t0pHUrkVQY+Pdei2Y9h5BCrbJn3OlmCyTYVzM=,tag:mGn3zkkXJysm8gDfH6Hmow==,type:str]",
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
"hc_vault": null,
"age": [
{
"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPZDJpNktnaGtUVVY0cWQz\nV0l5alV2K0ltVEJuV2d5WExTWEN3MXBTR3prCkw3NzhBN1dDUjZvWU1lQ3pBR1k0\nYXYzNHJVeEgyQllmaXVxY0VlYjBvVkEKLS0tIE9yajhWa09xRTgxUkJyVitSOUJm\nWHcwUWdLd2xYUFBuQURUbUtrdDUvV1kKQQBPC9RYnamK0B4H37iyEcVJ0EzKDeoU\nFnHFK6XxUmB3cSxTPCnt8i2dWJU/neaTiPh+1eWUNPtIiw/Ivr+YWg==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwUGp0K2Rub2hTNTh1Zm9o\ncnphNndEWjVERUt6UVlPUkxpdkJLMGowUkQ4CnJONWQ0aUlQaXYvM1c2cWF3L0NJ\nUTZrTGNVN2E5bHR4S0pkVVdsRDVqam8KLS0tIDZPODFkUzl2dWpxVDBxSk16MXVq\nM3EvcTh5R1Eyd2JoT3g0N1QyTk9uL0UKpuJUApHKoeztducyj+IA6qSo68chiDzM\n08yGZl+WCqxh9UvZgJB2FIfpm38ff4f7+t9omM/cY32xo4h7SmdvOw==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHTVRMaGcwVzJBSVlmbGRK\nRE9vN1p5bGhKdmV4bFlmd081TFA4OTNVQjFzCjZxR0JNa3ljN3dJMElTSVFnYXY0\nQzFEcFQ3M2FYdTFZM1M2Q1RIbTdwV2MKLS0tIHBwR2JXZXNWaStIM3g4Ti9JOGxs\nWGJVNWVXZysydHdBcURCbDZES2YvUncKbcKYuIEmSvt9WDO67/K4sd0oz0IK4l4x\npVDB9HT7f3IaKlk3w0/Axi3ZSetM3SYPFzMDAx7H+M8iq08ALSGo9Q==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2023-05-14T02:13:35Z",
"mac": "ENC[AES256_GCM,data:xpLAxQKTYVUnoEKUTao7+/eChZGI8VKF1+rVicIGu60KWPAu86+pjrxbi15WxbI6I2tsZLrYj2G/Pl6Aues59nMVvQiQL00FRqKZweTw55wTOtFThcm6t7cDBcQfdtczLRRKQ7m9A/zSQPZ1z9hxkwN6owNBI0w3CihvDFK9qaY=,iv:Moe/Wgy5FJjt4XuS87je9wGvCDG2XpoJR4DetGMbxNU=,tag:mrmgWeeh2gP9B1W+hyED6A==,type:str]",
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.7.3"
}
}

28
secrets/desko/duplicity_passphrase.env.bin Normal file
View File

@ -0,0 +1,28 @@
{
"data": "ENC[AES256_GCM,data:dVL/VccL8BhOidlecaQydxKFDYSpt8U+ZczEr5e+a3e+IeOe0+7Ns6QQuM47fg69Kng+7hhTLxaW9wCPCTNFtI0x44OsXvWT70xRXW9z7mGajrGOFjMZ3tJC2OP9R3M+2FDUa1BsHf/jSqwrLyrh0/uNvpJHuTTQ6EhFkjNkPd7nV4S8,iv:mKfrn4xi3lk4Q7L/Y/DqaceZJ2+2JxX6R8m384Q9qfc=,tag:dLFbqCCu8CzDi06xniBX/w==,type:str]",
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
"hc_vault": null,
"age": [
{
"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2V2lTdTJRYnZERW1IbUZW\ncmd5MzNmRWVTRWJLU1dZeHhpZWVSbTAwVjF3Ck40TWVjaEpIUWxPazZQNVR3Ylp1\nM0N2VFNtSS9tOVlJdFVwQjdPVVhyN1UKLS0tIHNOenZCYkV3YWJVT3NTeVpOdVVF\neXkrZ083QzZTV0VHM1ZYR2N5S1ZWRVUKHyCKYFtrLNLFSQBWDs2tPTajM4QS5YcM\n8SsgVEFEExy0b8Zd8nmvntVHBaeazoYr0e2Rt97YoujjaAa+7RdLCg==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPam5iSWc5SUxvbC9MUjZy\nL0RKYjZTYWpWSDhJZjMzbGZacVJ2Wm5kemlZCmxLWkFiMjZOM2JKNWFCczQyc08r\nYnJHZTF4RFV1cFdGUE1sOGFoRDB5U00KLS0tIEVuVGdRUkt4aG1pQWc2VG1QYXpO\nMytJV2RjQXE5Sk80bzM2bjIvalFIQ0UKllABQMTHe0dGOFG4sbFJgjer31QvY0o8\nw0zo3OgUQV/TZZDcQR9w8R/ZKNiaKPP38uhgppZEKqm8Y1Hnuj0Nng==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6R2Z6VE1PMkk2ZlpGR2py\nNkloZHR5NStvVi9XUG41d3pqYjRuMzgwWlF3ClFkQWVYZUN3NDJDYUNmT2srZDFm\nVGJVQnlDbkVYK1hMNXgydmFTTzlJR00KLS0tIHBOS21SSXhaOElzMDYwL0lQbFh1\nenBmQityc1pBR1ZpK3pPbm5NeTdUbkEKSzkUt2RAOzgPEIV4K0KajuMvsS2e5mFR\n93IRYE3nRFH/h26GxfYp9+C2yhfbpDpjc0dH7/fVxOTssOeekpTeXQ==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2023-05-14T02:12:47Z",
"mac": "ENC[AES256_GCM,data:l6d9xLwaVcfrbVMNHtbX921gBAfYWCP6xZhVkc7MtDe8BumdX2+78nHV7+FC0NTMbMBfPTU26dVpf3udVf19H6X1XZ41IBLpuIWwnM4biluNgfSBQU7MSf3+B2DMaJqDqB1sUwPiwiIHPVyTvIXiK0BRxpwfo+PGzaVCc+rPpX8=,iv:mwIRnNdz7a7pabfy8SkdVbWkjCqKQbtMpuBoKYyDKB4=,tag:aWKI0Ax/0YSKAMf0EE+cKQ==,type:str]",
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.7.3"
}
}

28
secrets/desko/nix_serve_privkey.bin Normal file
View File

@ -0,0 +1,28 @@
{
"data": "ENC[AES256_GCM,data:H47rSAxO2ktohfFRlmbB4qNEZGECfMg3SJSrhLNFXKSkboYRsqgQXmrnPHy7QphRlD6WnN+ocBGMVw0W9n5UJUOFJQTEG3a9xltRQuKSoLV05OzMkpU3jY2MfKWtIDo=,iv:2sDvuIBVskHhCgo3iAkyjrbBj4IQbOFEAOEekYEsaSI=,tag:veoxWv02bNL0meR1zwyS2Q==,type:str]",
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
"hc_vault": null,
"age": [
{
"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZVVkanlzSmRkdlFIdnJi\nOVZNV05mZWczTDI0T2YraENBNXVqc0s3SHgwCjFHdkpGTnV2N0RySnc5L2VBMGMx\nMFRKQ1ZEV1Ywc3c4aUhkbjlkdktOTWMKLS0tIHg4K1RDMklmcXg5ZWwvbEhZTFZm\nejdHQmFQTklicmRwUkZ2b2J0TnVtZDgKx7/9IMIGA1pVAgJxrjsaWIUmJzrMhWC+\nPQvXgIfr8xIzMPV0EeDbLQGMnGuulfvp6WYO2uCb/DjMtzfO0jHKwg==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTFJnTGJ5NGJRNkdOTEI1\nMDJKUFZsSjVrbmNySWpPU3Q3WGgxV2ZncVVvCmF3T3lrUkVweDB0cVVpNzA3Sk9m\nUXZYQTJnc3V1eldkZ2dHLzlXNFkvWEUKLS0tIFk0VG1ackY0ekFBVkR5V2t4aS9C\nMVA3YmZQR1FBUVpSQlNuM3BiQVBoN0UKugMq88tUmi8iP3qvJsCblL4hX1HUFn3V\nb7JzeSw4mvRxRsys6uao/EuCI2af+AW1ugzxAZDHHGH+B8lzaeeN9g==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2MVc2QjZpQ3Z2SjdQNVlo\nSmkwanVDcU5Sd2JpYkp4Vk5pdTFuUWRrZVZZCnBnaGVZN0xmSnFRdWNwYVVjT2Nu\nMUYrVDdEWm1ETk1hYXBndXJKQkhhK28KLS0tIC9CeXBVKzZyUDd1QnF0MDRMYmtR\nSXMyY3VCTjEvMjZ2UFlSa1dMM0FyTDgKzyHEStZL4AxvGdiCg/hy56ebWCoCHrdL\nhWcmg9YMIBDeC/vER+Den8XS+YTDZLGv8rMUF5mwhpLWXtuQUnljnw==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2023-05-14T02:12:39Z",
"mac": "ENC[AES256_GCM,data:GRu1gxVi2zqgYUJkV0f3rQ6CPTPzxSd/oxWM5tEbTLqki7WflTNTvn2R2U/2bHwq85JuXvKcBoCsC7kGaGR/kVF4j2YA9jGp1EmUUVpooU2+s1noQHObu1OT1DG46jKlUP8QTzIYrZZ4sIKi1zAyqDDFYs5recJEBEY2goEcApU=,iv:/2pvHmiM7hTydB5g//RJiyF521BCRWNEBD5hR4+t1d8=,tag:jrIQN/Xu6VhNZ/uiy5oBHA==,type:str]",
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.7.3"
}
}