asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

sops: introduce sops-nix (age), ssh keys from encrypted tarball, .example secrets

Browse source
This commit is contained in:
Sergei Poljanski 2026-07-14 12:24:21 +04:00
commit a7ec82579c
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
9 changed files with 149 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/networking.nix
View file

@ -58,9 +58,9 @@
# A previous wwan-autoconnect oneshot service called `mmcli --simple-connect`
# with a hardcoded APN and set up routing by hand. It fought NM for the modem
# (endless "connecting") and its hardcoded APN broke when the SIM changed.
# Removed: connect via the GNOME network applet using the "narayana" GSM
# profile (apn=data.narayana). Re-add a service only if headless autoconnect
# is needed, and if so set the NM profile's autoconnect=no to avoid contention.
# Removed: connect via the GNOME network applet using the carrier's GSM
# profile instead. Re-add a service only if headless autoconnect is needed,
# and if so set the NM profile's autoconnect=no to avoid contention.
# IVPN service — installed but not auto-started at boot.
# Start manually: `sudo systemctl start ivpn-service`

30
modules/sops.nix Normal file
View file

@ -0,0 +1,30 @@
# sops-nix: decrypt secrets at activation using the root-side age key.
# Key installed once via:
# sudo install -d -m 700 /var/lib/sops-nix
# sudo install -m 600 ~/.config/sops/age/keys.txt /var/lib/sops-nix/key.txt
{ config, pkgs, ... }:
{
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
# Secret files are gitignored (only .example structure files are tracked),
# so they are referenced by absolute path and read at activation, not eval.
sops.validateSopsFiles = false;
# SSH keys travel as one encrypted tarball so filenames stay inside the
# encrypted payload. (Re)create with:
# tar -C ~/.ssh -cf secrets/ssh-keys.tar <keys...> && sops -e -i secrets/ssh-keys.tar
sops.secrets."ssh-keys.tar" = {
sopsFile = "/etc/nixos/secrets/ssh-keys.tar";
format = "binary";
};
system.activationScripts.ssh-keys = {
deps = [ "setupSecrets" "users" ];
text = ''
mkdir -p /home/asxpi/.ssh
${pkgs.gnutar}/bin/tar --unlink-first -C /home/asxpi/.ssh -xf ${config.sops.secrets."ssh-keys.tar".path}
chown -R asxpi:users /home/asxpi/.ssh
chmod 700 /home/asxpi/.ssh
'';
};
}