deck sops

hosts/deck/sops.nix

@@ -0,0 +1,101 @@
+{ config, ... }:
+let
+  user = "deck";
+in
+{
+  # Permission modes are in octal representation (same as chmod),
+  # the digits represent: user|group|others
+  # 7 - full (rwx)
+  # 6 - read and write (rw-)
+  # 5 - read and execute (r-x)
+  # 4 - read only (r--)
+  # 3 - write and execute (-wx)
+  # 2 - write only (-w-)
+  # 1 - execute only (--x)
+  # 0 - none (---)
+  # Either a user id or group name representation of the secret owner
+  # It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
+  # Either the group id or group name representation of the secret group
+  # It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
+  sops = {
+    defaultSopsFile = ../../secrets/secrets.yaml;
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+    # ------------------------------
+    # Secrets
+    # ------------------------------
+    secrets = {
+      "desktop/matt_password" = {
+        neededForUsers = true;
+        mode = "0600";
+        owner = config.users.users."${user}".name;
+        group = config.users.users."${user}".group;
+      };
+      "wifi" = { };
+
+      # ------------------------------
+      # SSH keys
+      # ------------------------------
+      "ssh-keys-public/desktop-nixos" = {
+        mode = "0644";
+        owner = config.users.users."${user}".name;
+        group = config.users.users."${user}".group;
+        restartUnits = [ "sshd.service" ];
+      };
+      "ssh-keys-private/desktop-nixos" = {
+        mode = "0600";
+        owner = config.users.users."${user}".name;
+        group = config.users.users."${user}".group;
+        restartUnits = [ "sshd.service" ];
+      };
+      "ssh-keys-public/desktop-nixos-root" = {
+        path = "/root/.ssh/id_ed25519.pub";
+        mode = "0600";
+        restartUnits = [ "sshd.service" ];
+      };
+      "ssh-keys-private/desktop-nixos-root" = {
+        path = "/root/.ssh/id_ed25519";
+        mode = "0600";
+        restartUnits = [ "sshd.service" ];
+      };
+
+      # ------------------------------
+      # Secureboot keys
+      # ------------------------------
+      "secureboot/GUID" = {
+        path = "/etc/secureboot/GUID";
+        mode = "0600";
+      };
+      "secureboot/keys/db-key" = {
+        path = "/etc/secureboot/keys/db/db.key";
+        mode = "0600";
+      };
+      "secureboot/keys/db-pem" = {
+        path = "/etc/secureboot/keys/db/db.pem";
+        mode = "0600";
+      };
+      "secureboot/keys/KEK-key" = {
+        path = "/etc/secureboot/keys/KEK/KEK.key";
+        mode = "0600";
+      };
+      "secureboot/keys/KEK-pem" = {
+        path = "/etc/secureboot/keys/KEK/KEK.pem";
+        mode = "0600";
+      };
+      "secureboot/keys/PK-key" = {
+        path = "/etc/secureboot/keys/PK/PK.key";
+        mode = "0600";
+      };
+      "secureboot/keys/PK-pem" = {
+        path = "/etc/secureboot/keys/PK/PK.pem";
+        mode = "0600";
+      };
+    };
+
+    # ------------------------------
+    # Templates
+    # ------------------------------
+    templates = {
+    };
+  };
+}