diff options
Diffstat (limited to 'infra/modules')
| -rw-r--r-- | infra/modules/base/secrets.nix | 28 | ||||
| -rw-r--r-- | infra/modules/base/secrets.yaml | 19 |
2 files changed, 47 insertions, 0 deletions
diff --git a/infra/modules/base/secrets.nix b/infra/modules/base/secrets.nix new file mode 100644 index 0000000..3f81ea7 --- /dev/null +++ b/infra/modules/base/secrets.nix @@ -0,0 +1,28 @@ +{ inputs, ... }: +{ + flake.modules.nixos.base = + { config, lib, ... }: + { + imports = [ inputs.sops-nix.nixosModules.sops ]; + + sops = { + defaultSopsFile = ./secrets.yaml; + # Cannot use `/etc/host/` directly because then it will not load + # the secrets that are marked `neededForUsers` correctly. + age.sshKeyPaths = [ "${config.infra.persist.dir}/etc/ssh/ssh_host_ed25519_key" ]; + }; + + virtualisation.vmVariant = { + # Use the age key from the host (my development machine) to decrypt + # in the VMs. + # + # TODO: Rework this to use the host SSH key instead. + virtualisation.sharedDirectories.host-age = { + source = "/home/vkcku/.config/sops/age"; + target = "/run/sops/age"; + }; + + sops.age.keyFile = lib.mkForce "/run/sops/age/keys.txt"; + }; + }; +} diff --git a/infra/modules/base/secrets.yaml b/infra/modules/base/secrets.yaml new file mode 100644 index 0000000..361d835 --- /dev/null +++ b/infra/modules/base/secrets.yaml @@ -0,0 +1,19 @@ +hosts: + indra: + users: + vkcku: ENC[AES256_GCM,data:/R5i0zj4MbI1fhKLFZqQ1w34JzYE7i4BK/9HzFxdXh3gnZgrMDRPfDF0r++zmsEVhwwQLVqKFM5qo56rzJ5lWOrWE3HpLXXrhjuRyBjNTXRpGYhrjHJozcQZahM2zvb8lUevjGe8WNFS2Q==,iv:ggibCGPV0mQJ8Ds4mTX79fGl0PIwB+TGf1NP4pFHiGM=,tag:8gOR8HGwL5sd7zykAb04mQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArYm1CTHQyckhYK3Uxa0Za + U3gvSUdHcktKRWxtKzJpZWVuOGhtalVBVEVrCjN5UTl1VmdxQ1lEWW9OWDhab1R6 + aDlER1UwbUZWWFgvMmVMVE5NWW9mYkEKLS0tIDY4RWE3SnVnL3Q1UVM5UzdNUGpx + NEYxZzlyRm12RmM3aUV6RjZqRnNmYjAKNoAUckfpEmBeP37W2TBhRITo0v1uFQGt + X1SHrCHKm6P6QD5Nminy6tVZWP1BpGC+jcXas2lWq6URovNdMKSdPg== + -----END AGE ENCRYPTED FILE----- + recipient: age1jtl0m9t7rtfmh674zres8pecmcugv7yxamv8hkvlf3tk2g8p25nsnccslh + lastmodified: "2026-06-01T06:57:19Z" + mac: ENC[AES256_GCM,data:DZig1NCkYssUXxrGmKau2BpRr4l/Sap2XwyMwwvoZGj6oedS1oQyQnxSc5nitkNCW7xlkk4OgUYPiHqtxeFVIQ5hnfHdR8+rlkD64RcsPVWq+oyiTe8toWXbzpa9mHG6+XQp3iPybMVHfFrdRP0IZ6hNvbSS54ejH8CFDfZ9pYY=,iv:A1xBgPxWQrlmChD7qF/TpwknrjckuI6Fd/0pgHdM2+g=,tag:WK5kHak7ClTetpwqmollog==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1 |