mjallen/nix-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

cleanup

Browse Source
This commit is contained in:
mjallen18
2025-08-24 18:56:51 -05:00
parent cfaf900db6
commit 2ea82a643d
22 changed files with 338 additions and 531 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
modules/nixos/sops/default.nix
View File

@@ -1,7 +1,8 @@
{ lib, ... }:
{ config, lib, system, namespace, ... }:
let
# defaultSops = (lib.snowfall.fs.get-file "secrets/pi4-secrets.yaml");
defaultSops = (lib.snowfall.fs.get-file "secrets/secrets.yaml");
isx86 = system == "x86_64-linux";
user = config.${namespace}.user.name;
in
{
# Permission modes are in octal representation (same as chmod),
@@ -28,6 +29,13 @@ in
secrets = {
"wifi" = { };
"matt_password" = {
neededForUsers = true;
mode = "0600";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
};
# ------------------------------
# SSH keys
# ------------------------------
@@ -57,6 +65,38 @@ in
# mode = "0600";
# restartUnits = [ "sshd.service" ];
# };
# ------------------------------
# Secureboot keys
# ------------------------------
"secureboot/GUID" = lib.mkIf isx86 {
path = "/etc/secureboot/GUID";
mode = "0600";
};
"secureboot/keys/db-key" = lib.mkIf isx86 {
path = "/etc/secureboot/keys/db/db.key";
mode = "0600";
};
"secureboot/keys/db-pem" = lib.mkIf isx86 {
path = "/etc/secureboot/keys/db/db.pem";
mode = "0600";
};
"secureboot/keys/KEK-key" = lib.mkIf isx86 {
path = "/etc/secureboot/keys/KEK/KEK.key";
mode = "0600";
};
"secureboot/keys/KEK-pem" = lib.mkIf isx86 {
path = "/etc/secureboot/keys/KEK/KEK.pem";
mode = "0600";
};
"secureboot/keys/PK-key" = lib.mkIf isx86 {
path = "/etc/secureboot/keys/PK/PK.key";
mode = "0600";
};
"secureboot/keys/PK-pem" = lib.mkIf isx86 {
path = "/etc/secureboot/keys/PK/PK.pem";
mode = "0600";
};
};
# ------------------------------