102 lines
3.0 KiB
Nix
Executable File
102 lines
3.0 KiB
Nix
Executable File
{ config, ... }:
|
|
let
|
|
user = "deck";
|
|
in
|
|
{
|
|
# Permission modes are in octal representation (same as chmod),
|
|
# the digits represent: user|group|others
|
|
# 7 - full (rwx)
|
|
# 6 - read and write (rw-)
|
|
# 5 - read and execute (r-x)
|
|
# 4 - read only (r--)
|
|
# 3 - write and execute (-wx)
|
|
# 2 - write only (-w-)
|
|
# 1 - execute only (--x)
|
|
# 0 - none (---)
|
|
# Either a user id or group name representation of the secret owner
|
|
# It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
|
|
# Either the group id or group name representation of the secret group
|
|
# It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
|
|
sops = {
|
|
defaultSopsFile = ../../secrets/secrets.yaml;
|
|
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
# ------------------------------
|
|
# Secrets
|
|
# ------------------------------
|
|
secrets = {
|
|
"desktop/matt_password" = {
|
|
neededForUsers = true;
|
|
mode = "0600";
|
|
owner = config.users.users."${user}".name;
|
|
group = config.users.users."${user}".group;
|
|
};
|
|
"wifi" = { };
|
|
|
|
# ------------------------------
|
|
# SSH keys
|
|
# ------------------------------
|
|
# "ssh-keys-public/desktop-nixos" = {
|
|
# mode = "0644";
|
|
# owner = config.users.users."${user}".name;
|
|
# group = config.users.users."${user}".group;
|
|
# restartUnits = [ "sshd.service" ];
|
|
# };
|
|
# "ssh-keys-private/desktop-nixos" = {
|
|
# mode = "0600";
|
|
# owner = config.users.users."${user}".name;
|
|
# group = config.users.users."${user}".group;
|
|
# restartUnits = [ "sshd.service" ];
|
|
# };
|
|
# "ssh-keys-public/desktop-nixos-root" = {
|
|
# path = "/root/.ssh/id_ed25519.pub";
|
|
# mode = "0600";
|
|
# restartUnits = [ "sshd.service" ];
|
|
# };
|
|
# "ssh-keys-private/desktop-nixos-root" = {
|
|
# path = "/root/.ssh/id_ed25519";
|
|
# mode = "0600";
|
|
# restartUnits = [ "sshd.service" ];
|
|
# };
|
|
|
|
# ------------------------------
|
|
# Secureboot keys
|
|
# ------------------------------
|
|
"secureboot/GUID" = {
|
|
# path = "/etc/secureboot/GUID";
|
|
mode = "0600";
|
|
};
|
|
"secureboot/keys/db-key" = {
|
|
# path = "/etc/secureboot/keys/db/db.key";
|
|
mode = "0600";
|
|
};
|
|
"secureboot/keys/db-pem" = {
|
|
# path = "/etc/secureboot/keys/db/db.pem";
|
|
mode = "0600";
|
|
};
|
|
"secureboot/keys/KEK-key" = {
|
|
# path = "/etc/secureboot/keys/KEK/KEK.key";
|
|
mode = "0600";
|
|
};
|
|
"secureboot/keys/KEK-pem" = {
|
|
# path = "/etc/secureboot/keys/KEK/KEK.pem";
|
|
mode = "0600";
|
|
};
|
|
"secureboot/keys/PK-key" = {
|
|
# path = "/etc/secureboot/keys/PK/PK.key";
|
|
mode = "0600";
|
|
};
|
|
"secureboot/keys/PK-pem" = {
|
|
# path = "/etc/secureboot/keys/PK/PK.pem";
|
|
mode = "0600";
|
|
};
|
|
};
|
|
|
|
# ------------------------------
|
|
# Templates
|
|
# ------------------------------
|
|
templates = {
|
|
};
|
|
};
|
|
}
|