nas sops

modules/nixos/traefik/default.nix

@@ -68,14 +68,23 @@ in
     sops = {
       secrets = {
         "jallen-nas/traefik/crowdsec-lapi-key" = {
+          sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
           owner = config.users.users.traefik.name;
           group = config.users.users.traefik.group;
           restartUnits = [ "traefik.service" ];
         };
-        "jallen-nas/traefik/cloudflare-dns-api-token" = { };
+        "jallen-nas/traefik/cloudflare-dns-api-token" = {
-        "jallen-nas/traefik/cloudflare-zone-api-token" = { };
+            sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
-        "jallen-nas/traefik/cloudflare-api-key" = { };
+        };
-        "jallen-nas/traefik/cloudflare-email" = { };
+        "jallen-nas/traefik/cloudflare-zone-api-token" = {
+            sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
+        };
+        "jallen-nas/traefik/cloudflare-api-key" = {
+            sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
+        };
+        "jallen-nas/traefik/cloudflare-email" = {
+            sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
+        };
       };
       templates = {
         "traefik.env" = {

systems/x86_64-linux/nas/sops.nix

@@ -2,7 +2,6 @@
 let
   user = "nix-apps";
   defaultSops = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
-  sharedSops = (lib.snowfall.fs.get-file "secrets/secrets.yaml");
 in
 {
   # Permission modes are in octal representation (same as chmod),
@@ -20,7 +19,6 @@ in
   # Either the group id or group name representation of the secret group
   # It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
   sops = {
-    defaultSopsFile = lib.mkForce defaultSops;
     age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
     # ------------------------------
@@ -28,6 +26,7 @@ in
     # ------------------------------
     secrets = {
       "jallen-nas/admin_password" = {
+        sopsFile = defaultSops;
         neededForUsers = true;
         mode = "0600";
         owner = config.users.users."${user}".name;
@@ -35,20 +34,18 @@ in
       };
 
       "jallen-nas/nas_pool" = {
+        sopsFile = defaultSops;
         mode = "0600";
         owner = config.users.users."${user}".name;
         group = config.users.users."${user}".group;
       };
 
-      "wifi" = {
-        sopsFile = sharedSops;
-      };
-
       # ------------------------------
       # ups
       # ------------------------------
 
       "jallen-nas/ups_password" = {
+        sopsFile = defaultSops;
         mode = "0777";
         restartUnits = [
           "upsdrv.service"
@@ -63,12 +60,10 @@ in
       # ------------------------------
 
       "ssh-keys-public/jallen-nas-root" = {
-        sopsFile = sharedSops;
         path = "/root/.ssh/id_ed25519.pub";
         mode = "0640";
       };
       "ssh-keys-private/jallen-nas-root" = {
-        sopsFile = sharedSops;
         path = "/root/.ssh/id_ed25519";
         mode = "0600";
       };
@@ -78,6 +73,7 @@ in
       # ------------------------------
 
       "jallen-nas/authentik-env" = {
+        sopsFile = defaultSops;
         restartUnits = [ "authentik.service" ];
       };
 
@@ -86,6 +82,7 @@ in
       # ------------------------------
 
       "jallen-nas/collabora" = {
+        sopsFile = defaultSops;
         restartUnits = [ "podman-collabora.service" ];
       };
 
@@ -94,9 +91,11 @@ in
       # ------------------------------
 
       "jallen-nas/mariadb/db_pass" = {
+        sopsFile = defaultSops;
         restartUnits = [ "podman-mariadb.service" ];
       };
       "jallen-nas/mariadb/root_pass" = {
+        sopsFile = defaultSops;
         restartUnits = [ "podman-mariadb.service" ];
       };
 
@@ -105,18 +104,21 @@ in
       # ------------------------------
 
       "jallen-nas/nextcloud/dbpassword" = {
+        sopsFile = defaultSops;
         mode = "0650";
         owner = config.users.users."${user}".name;
         group = config.users.users."${user}".group;
         restartUnits = [ "container@nextcloud.service" ];
       };
       "jallen-nas/nextcloud/adminpassword" = {
+        sopsFile = defaultSops;
         mode = "0650";
         owner = config.users.users."${user}".name;
         group = config.users.users."${user}".group;
         restartUnits = [ "container@nextcloud.service" ];
       };
       "jallen-nas/nextcloud/smtp_settings" = {
+        sopsFile = defaultSops;
         mode = "0650";
         owner = config.users.users."${user}".name;
         group = config.users.users."${user}".group;
@@ -128,6 +130,7 @@ in
       # ------------------------------
 
       "jallen-nas/onlyoffice-key" = {
+        sopsFile = defaultSops;
         mode = "0650";
         owner = config.users.users."${user}".name;
         group = config.users.users."${user}".group;
@@ -139,6 +142,7 @@ in
       # ------------------------------
 
       "jallen-nas/manyfold/secretkeybase" = {
+        sopsFile = defaultSops;
         restartUnits = [ "podman-manyfold.service" ];
       };
 
@@ -147,6 +151,7 @@ in
       # ------------------------------
 
       "jallen-nas/immich/db-password" = {
+        sopsFile = defaultSops;
         mode = "0440";
         group = "keys";
         restartUnits = [ "container@immich.service" ];
@@ -157,6 +162,7 @@ in
       # ------------------------------
 
       "jallen-nas/open-webui" = {
+        sopsFile = defaultSops;
         restartUnits = [ "open-webui.service" ];
       };
 
@@ -165,12 +171,15 @@ in
       # ------------------------------
 
       "jallen-nas/paperless/secret" = {
+        sopsFile = defaultSops;
         restartUnits = [ "container@paperless.service" ];
       };
       "jallen-nas/paperless/authentik-client-id" = {
+        sopsFile = defaultSops;
         restartUnits = [ "container@paperless.service" ];
       };
       "jallen-nas/paperless/authentik-client-secret" = {
+        sopsFile = defaultSops;
         restartUnits = [ "container@paperless.service" ];
       };
 
@@ -179,12 +188,14 @@ in
       # ------------------------------
 
       "jallen-nas/gitea/mail-key" = {
+        sopsFile = defaultSops;
         owner = "root";
         group = "keys";
         mode = "0440";
         restartUnits = [ "container@gitea.service" ];
       };
       "jallen-nas/gitea/metrics-key" = {
+        sopsFile = defaultSops;
         owner = "root";
         group = "keys";
         mode = "0440";
@@ -194,55 +205,26 @@ in
       # ------------------------------
       # free-games-claimer
       # ------------------------------
-      "jallen-nas/free-games/eg-email" = { };
+      "jallen-nas/free-games/eg-email" = {
-      "jallen-nas/free-games/eg-pass" = { };
+        sopsFile = defaultSops;
-      "jallen-nas/free-games/eg-otp" = { };
-      "jallen-nas/free-games/pg-email" = { };
-      "jallen-nas/free-games/pg-pass" = { };
-      "jallen-nas/free-games/gog-email" = { };
-      "jallen-nas/free-games/gog-pass" = { };
-
-      # ------------------------------
-      # Secureboot keys
-      # ------------------------------
-
-      "secureboot/GUID" = {
-        sopsFile = sharedSops;
-        path = "/etc/secureboot/GUID";
-        mode = "0640";
       };
-      "secureboot/keys/db-key" = {
+      "jallen-nas/free-games/eg-pass" = {
-        sopsFile = sharedSops;
+        sopsFile = defaultSops;
-        path = "/etc/secureboot/keys/db/db.key";
-        mode = "0640";
       };
-      "secureboot/keys/db-pem" = {
+      "jallen-nas/free-games/eg-otp" = {
-        sopsFile = sharedSops;
+        sopsFile = defaultSops;
-        path = "/etc/secureboot/keys/db/db.pem";
-        mode = "0640";
       };
-      "secureboot/keys/KEK-key" = {
+      "jallen-nas/free-games/pg-email" = {
-        sopsFile = sharedSops;
+        sopsFile = defaultSops;
-        path = "/etc/secureboot/keys/KEK/KEK.key";
-        mode = "0640";
       };
-      "secureboot/keys/KEK-pem" = {
+      "jallen-nas/free-games/pg-pass" = {
-        sopsFile = sharedSops;
+        sopsFile = defaultSops;
-        path = "/etc/secureboot/keys/KEK/KEK.pem";
-        mode = "0640";
       };
-      "secureboot/keys/PK-key" = {
+      "jallen-nas/free-games/gog-email" = {
-        sopsFile = sharedSops;
+        sopsFile = defaultSops;
-        path = "/etc/secureboot/keys/PK/PK.key";
-        mode = "0640";
       };
-      "secureboot/keys/PK-pem" = {
+      "jallen-nas/free-games/gog-pass" = {
-        sopsFile = sharedSops;
+        sopsFile = defaultSops;
-        path = "/etc/secureboot/keys/PK/PK.pem";
-        mode = "0640";
-      };
-      "jallen-nas/attic-key" = {
-        #        owner = "atticd";
       };
     };