mjallen/nix-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

teml

Browse Source
This commit is contained in:
mjallen18
2025-07-23 09:50:11 -05:00
parent f8e80bd44c
commit 1bc7856d93
14 changed files with 105 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
systems/x86_64-linux/desktop/sops.nix
View File

@@ -1,6 +1,8 @@
{ config, ... }:
{ config, lib, ... }:
let
user = "matt";
desktopSopsFile = (lib.snowfall.fs.get-file "secrets/desktop-secrets.yaml");
commonSopsFile = (lib.snowfall.fs.get-file "secrets/secrets.yaml");
in
{
# Permission modes are in octal representation (same as chmod),
@@ -18,7 +20,7 @@ in
# Either the group id or group name representation of the secret group
# It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
sops = {
defaultSopsFile = ../../../secrets/desktop-secrets.yaml;
defaultSopsFile = desktopSopsFile;
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# ------------------------------
@@ -44,34 +46,34 @@ in
mode = "0600";
};
"wifi" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
};
# ------------------------------
# SSH keys
# ------------------------------
"ssh-keys-public/desktop-nixos" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
mode = "0644";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
restartUnits = [ "sshd.service" ];
};
"ssh-keys-private/desktop-nixos" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
mode = "0600";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
restartUnits = [ "sshd.service" ];
};
"ssh-keys-public/desktop-nixos-root" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
path = "/root/.ssh/id_ed25519.pub";
mode = "0600";
restartUnits = [ "sshd.service" ];
};
"ssh-keys-private/desktop-nixos-root" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
path = "/root/.ssh/id_ed25519";
mode = "0600";
restartUnits = [ "sshd.service" ];
@@ -81,37 +83,37 @@ in
# Secureboot keys
# ------------------------------
"secureboot/GUID" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
path = "/etc/secureboot/GUID";
mode = "0600";
};
"secureboot/keys/db-key" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
path = "/etc/secureboot/keys/db/db.key";
mode = "0600";
};
"secureboot/keys/db-pem" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
path = "/etc/secureboot/keys/db/db.pem";
mode = "0600";
};
"secureboot/keys/KEK-key" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
path = "/etc/secureboot/keys/KEK/KEK.key";
mode = "0600";
};
"secureboot/keys/KEK-pem" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
path = "/etc/secureboot/keys/KEK/KEK.pem";
mode = "0600";
};
"secureboot/keys/PK-key" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
path = "/etc/secureboot/keys/PK/PK.key";
mode = "0600";
};
"secureboot/keys/PK-pem" = {
sopsFile = ../../../secrets/secrets.yaml;
sopsFile = commonSopsFile;
path = "/etc/secureboot/keys/PK/PK.pem";
mode = "0600";
};