System: Rename system/modules to system/systemmodules
This commit is contained in:
64
system/systemmodules/sops-nix/default.nix
Normal file
64
system/systemmodules/sops-nix/default.nix
Normal file
@ -0,0 +1,64 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
mylib,
|
||||
pkgs,
|
||||
username,
|
||||
...
|
||||
}: let
|
||||
inherit (config.modules) sops-nix;
|
||||
in {
|
||||
options.modules.sops-nix = import ./options.nix {inherit lib mylib;};
|
||||
|
||||
config = {
|
||||
environment.systemPackages = with pkgs; [
|
||||
sops
|
||||
age
|
||||
# ssh-to-age
|
||||
];
|
||||
|
||||
environment.variables = {
|
||||
# Set this environment variable to make "sops edit secrets.yaml" work
|
||||
SOPS_AGE_KEY_FILE = config.sops.age.keyFile;
|
||||
};
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = ./secrets.yaml;
|
||||
|
||||
age = {
|
||||
keyFile = lib.mkDefault "/home/${username}/.secrets/age/age.key";
|
||||
generateKey = false;
|
||||
sshKeyPaths = [];
|
||||
};
|
||||
|
||||
secrets = let
|
||||
mkSecret = name: {
|
||||
${name} = {
|
||||
owner = config.users.users.${username}.name;
|
||||
group = config.users.users.${username}.group;
|
||||
};
|
||||
};
|
||||
|
||||
mkBootSecret = name: {
|
||||
${name} = {
|
||||
# Make these secrets available before creating users.
|
||||
# This means we can't set the owner or group.
|
||||
neededForUsers = true;
|
||||
};
|
||||
};
|
||||
in
|
||||
lib.mkMerge [
|
||||
(
|
||||
if (builtins.hasAttr "${username}" sops-nix.secrets)
|
||||
then lib.mergeAttrsList (builtins.map mkSecret sops-nix.secrets.${username})
|
||||
else {}
|
||||
)
|
||||
(
|
||||
if (builtins.hasAttr "${username}" sops-nix.bootSecrets)
|
||||
then lib.mergeAttrsList (builtins.map mkBootSecret sops-nix.bootSecrets.${username})
|
||||
else {}
|
||||
)
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
27
system/systemmodules/sops-nix/options.nix
Normal file
27
system/systemmodules/sops-nix/options.nix
Normal file
@ -0,0 +1,27 @@
|
||||
{
|
||||
lib,
|
||||
mylib,
|
||||
...
|
||||
}: {
|
||||
secrets = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.listOf lib.types.str);
|
||||
description = "The secrets to expose on this host";
|
||||
example = ''
|
||||
christoph = [
|
||||
"docker-password"
|
||||
];
|
||||
'';
|
||||
default = [];
|
||||
};
|
||||
|
||||
bootSecrets = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.listOf lib.types.str);
|
||||
description = "The secrets to expose on this host earlier in the boot process";
|
||||
example = ''
|
||||
christoph = [
|
||||
"user-password"
|
||||
];
|
||||
'';
|
||||
default = [];
|
||||
};
|
||||
}
|
||||
39
system/systemmodules/sops-nix/secrets.yaml
Normal file
39
system/systemmodules/sops-nix/secrets.yaml
Normal file
@ -0,0 +1,39 @@
|
||||
#
|
||||
#ENC[AES256_GCM,data:mZKPbrWtgyRvOg==,iv:vLyN3JkWWrWS+0pndTuom8cNVfpb8SUC4dA6m7utXoE=,tag:YAy2gPot6KFS9/VLVAoSxw==,type:comment]
|
||||
#
|
||||
user-password: ENC[AES256_GCM,data:okgvaTTesCDwriI8PxhNdHZF8XgzB4yxapuFl2/CK8x4WNYxGFjuZqGKcu7pqfnBofNcF2ByuM+HLH9FKxpK0dMCoHD/laR1IA==,iv:ltExELuM7g7ydSAMj8ioF9Nb7N4xe5enhDQrVJ+k2jQ=,tag:AV165m5yKnX+uJnMyC3mxA==,type:str]
|
||||
ssh-private-key: ENC[AES256_GCM,data:JrRarfeS3y6b9gxg4Za5GIc5Ci3aGR+OyZxQybj4dcv2mzxXmT/bm7KOwM1zkz1PFl1xW5X82T5jte+XQOKx0+6m4ovjUgUmQUMP4E/yosp8XSdi0+YlUKBEHEJx6HqCZy+v6qx5kfp9JC6fZqCbL1J6FIqWqAoKTFXoiou1YnhmBa2fM17Q++i6TflDWiVrUS7X9xjuZFq1hz1aQXS303uvJEUOEpXdqPyJvUKJWzVsFrAwpa9FG+reO70SSc+1hBbqdw1QjrzNWh3eNnztwZURauJtVFBYUZ5ozHmWBr4aVFjYvqz+t6G1SAunmBRbVqbH4bjBv9jXXjHAB4U0wanvkJN2C+EY1zxwjyx2fWckMdhoLr9gtC1FJKMbV49UFHJ3iXWNczKj1t7LrctehEKXJa0Eb3UogYuaRxbVYbC++kD8LvL4AY8ertgc9/pxQQZmogdINJmIxKN4HTlGbX8kSDLbohZLheOfzZ5ycTlrbOjfJ1EBMLo+mJcMUW0qhFySl1aamPqTeII7lvgTOE3xV/d/9VAQTFKsftWPNkfhAJIym51bYrrMPV8AVeFQnLhSid3d3zK4w20zIQKSYnq9A8zcNhM0keddiv4XC+M=,iv:7HP7VCFpMRZXRD6GD/zFzDSBO02V/DyxKLmuDCLXTLU=,tag:Ugx81JwCP8HmhtflYoevLg==,type:str]
|
||||
nix-github-token: ENC[AES256_GCM,data:AXV0ODLhfa4M6+7clulfIKm0qCOeo3lQ+66iYgoDeR12RxZOV19UtA==,iv:1XECVKyzH3NumKwRSPKNlUwJMLFwptcG8DQ09U4LrGk=,tag:QdtvJNV8BttWjhH4v0RtRQ==,type:str]
|
||||
docker-password: ENC[AES256_GCM,data:mK5YWEQPKWBtVCgRBZvwWTdVAi8MEGbLnLeP7hfDkcc=,iv:Az8+eAK6R6xssmmbhuEsDbLU+ks8lS+qzc4L33WfefA=,tag:NSXvRhbIuRZZqRR28Tu0PQ==,type:str]
|
||||
#
|
||||
#ENC[AES256_GCM,data:y5dlZFhK38dR+Q==,iv:1JYizUeyWeMR4KUblkj7kVSHPCL5l8mFpaQdo774BcM=,tag:kUTnBZb46KYQyi8bgIYSOQ==,type:comment]
|
||||
#
|
||||
makemkv-app-key: ENC[AES256_GCM,data:/pTxr4q4ucJLx5VI8ySzOgd4g1s+6lcZNe4crxRmidTYrhJ0I6V3CIhm4wLC105W+Xka6HIZTqPn8SbqcMC4Dt3wSus=,iv:aYsGobD+Vl/VUNAHcAxQb7HEmLT8aXyKNOELgzvKDH4=,tag:xhnVb/ns6VZEnTuoUv9w5A==,type:str]
|
||||
restic-repo-key: ENC[AES256_GCM,data:lSFuhjbhdQq4cabAVFGQ4kuaJxb7EhXgBDlgoEQWJhs=,iv:7IhGDBYEwY1TwLvc/4DOkUBQ3eqSszZcKwnT7Lllfps=,tag:yJVlMi9X0W+Kh3zMkb0QuA==,type:str]
|
||||
#
|
||||
#ENC[AES256_GCM,data:Raagjz1qPvXC,iv:OSWTKaIlmo1paU2ZZn20XMeZ2gdM52pHmVZ3m2ngCdI=,tag:bPCdvjOFjpxxkrwA7Mhl5Q==,type:comment]
|
||||
#
|
||||
heidi-discord-token: ENC[AES256_GCM,data:FYvfUn8tG7glqIomSDj9rGyNQjnHSCsD/C3Kk/JR1vm/xkrxzXwP3rpyxAzqRQ7vd+zFBf2BJfV/zMk=,iv:b+aKcu98rxslEGSYf6t/jGwPfS256WQ3B/iuQ4Qeykk=,tag:e48Q0BraIvItyD2WBfbYEA==,type:str]
|
||||
kopia-server-username: ENC[AES256_GCM,data:4onewFkWpi9g,iv:aA4WSS8T6KUcGbAIHDd8BjE0sRK/Qz0j4QvEnKdlt2U=,tag:FQlB0Wx2u8wT3TKIhMAyLg==,type:str]
|
||||
kopia-server-password: ENC[AES256_GCM,data:6nMnhRA=,iv:Qz9qP+m0obzL+eHFmW1qVmc/0TR4Iw4X1GL4zACOSMk=,tag:v3v+33+g4y6se5q+b4e8mA==,type:str]
|
||||
kopia-user-password: ENC[AES256_GCM,data:jPWeru4e2w9qzA==,iv:WpZS3Qmx8v12v3q1Lq1YrPnWw7BY0FhxurXYuaOdfwA=,tag:+8bQAnHRh55rUMdyoK6N8w==,type:str]
|
||||
paperless-nextcloud-sync-password: ENC[AES256_GCM,data:pfLg3OVBqLsM4R7mSgLQEachj9gMkexPjBMSyzU=,iv:XBe1cdwlTjPfQW70NIEjD8CikK58iGErI9ZTlLWtCA4=,tag:qO35GdjljgS3/z5/1fCOFg==,type:str]
|
||||
#
|
||||
#ENC[AES256_GCM,data:Gdh/hjCaOuAE,iv:XjPXn3SskpUPUkDIEDl5701/g9QhuS83fACMaoPMiIM=,tag:Q7s8xZG/GsOtQrasekBnkQ==,type:comment]
|
||||
#
|
||||
wireguard-vps-private-key: ENC[AES256_GCM,data:B6IWYuzKV9YZ+G9GIjOsXVEVugwMY14PrwmYyHsFAJEb1OJRXMg8+zeFnqs=,iv:2QroGA10UVSmNIBHFSTeCgMBD3VjtiUnng3pkR/mPVQ=,tag:FGlCrmdccgsObyut6E5ggA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age14ph8vrj657e7s35d60xehzuq46t9zd6pzcm6pw4jragzrvf6xs9s77usnm
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWSVRhVDREMXduZElrRklE
|
||||
R2s3Y081TGVTOCtKWVVWN0RLb0ZIT3lmMTNZCjFaNmRqb2hRVXFDSU12dFhDNmJo
|
||||
UHUyTUlOWWpMaVZ6Tlg3ZkRhOHJDUUEKLS0tIHduRXdxQ1VCR1ZuV3hjVjM1REtY
|
||||
SURMTmh1TGIrRmtENzc0Sk4rNFJNUE0KOpjN6jkEHO+lvdWdp4P++r9SNSPWaT0h
|
||||
FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-07-19T01:29:00Z"
|
||||
mac: ENC[AES256_GCM,data:IzLYRuOlkUpry37sw7OB5MglntVflMjCcNiWpi7rvT2suOivLX9IT36qZFfYIbVIFXDmfsi1hsTvsPyekD7vVWQ1vkajAlGQYYTVpnO2cFrK3+TfWCyYjiD01rQBiRikybrR11zWRq6atieurDIxMUMEI7ypiqFOwpYaqSePAFc=,iv:9bc6rc4gjuiJWNjg1g0KfySqxnPjpzmlzDi/R+Iv2g4=,tag:tEwthVZAmdXbwRtoNykGrQ==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.10.2
|
||||
Reference in New Issue
Block a user