asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

sops: introduce sops-nix (age), ssh keys from encrypted tarball, .example secrets

Browse source
This commit is contained in:
Sergei Poljanski 2026-07-14 12:24:21 +04:00
commit a7ec82579c
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
9 changed files with 149 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

30
modules/sops.nix Normal file
View file

@ -0,0 +1,30 @@
# sops-nix: decrypt secrets at activation using the root-side age key.
# Key installed once via:
# sudo install -d -m 700 /var/lib/sops-nix
# sudo install -m 600 ~/.config/sops/age/keys.txt /var/lib/sops-nix/key.txt
{ config, pkgs, ... }:
{
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
# Secret files are gitignored (only .example structure files are tracked),
# so they are referenced by absolute path and read at activation, not eval.
sops.validateSopsFiles = false;
# SSH keys travel as one encrypted tarball so filenames stay inside the
# encrypted payload. (Re)create with:
# tar -C ~/.ssh -cf secrets/ssh-keys.tar <keys...> && sops -e -i secrets/ssh-keys.tar
sops.secrets."ssh-keys.tar" = {
sopsFile = "/etc/nixos/secrets/ssh-keys.tar";
format = "binary";
};
system.activationScripts.ssh-keys = {
deps = [ "setupSecrets" "users" ];
text = ''
mkdir -p /home/asxpi/.ssh
${pkgs.gnutar}/bin/tar --unlink-first -C /home/asxpi/.ssh -xf ${config.sops.secrets."ssh-keys.tar".path}
chown -R asxpi:users /home/asxpi/.ssh
chmod 700 /home/asxpi/.ssh
'';
};
}