mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
130 lines
3.8 KiB
Nix
130 lines
3.8 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
agenix,
|
|
mysecrets,
|
|
myvars,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
agenix.darwinModules.default
|
|
];
|
|
|
|
# enable logs for debugging
|
|
launchd.daemons."activate-agenix".serviceConfig = {
|
|
StandardErrorPath = "/Library/Logs/org.nixos.activate-agenix.stderr.log";
|
|
StandardOutPath = "/Library/Logs/org.nixos.activate-agenix.stdout.log";
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
agenix.packages."${pkgs.stdenv.hostPlatform.system}".default
|
|
];
|
|
|
|
# if you changed this key, you need to regenerate all encrypt files from the decrypt contents!
|
|
age.identityPaths = [
|
|
# Generate manually via `sudo ssh-keygen -A`
|
|
"/etc/ssh/ssh_host_ed25519_key" # macOS, using the host key for decryption
|
|
];
|
|
|
|
age.secrets =
|
|
let
|
|
noaccess = {
|
|
mode = "0000";
|
|
owner = "root";
|
|
};
|
|
high_security = {
|
|
mode = "0500";
|
|
owner = "root";
|
|
};
|
|
user_readable = {
|
|
mode = "0500";
|
|
owner = myvars.username;
|
|
};
|
|
in
|
|
{
|
|
# ---------------------------------------------
|
|
# No discretionary access; privileged root can still bypass file modes.
|
|
# ---------------------------------------------
|
|
|
|
# .age means the decrypted file is still encrypted by age(via a passphrase)
|
|
"ryan4yin-gpg-subkeys.priv.age" = {
|
|
file = "${mysecrets}/desktop/ryan4yin-gpg-subkeys-2024-01-27.priv.age.age";
|
|
}
|
|
// noaccess;
|
|
|
|
# ---------------------------------------------
|
|
# only root can read this file.
|
|
# ---------------------------------------------
|
|
|
|
"rclone.conf" = {
|
|
file = "${mysecrets}/desktop/rclone.conf.age";
|
|
}
|
|
// high_security;
|
|
|
|
"nix-access-tokens" = {
|
|
file = "${mysecrets}/server/nix-access-tokens.age";
|
|
}
|
|
# access-token needs to be readable by the user running the `nix` command
|
|
// user_readable;
|
|
|
|
# ---------------------------------------------
|
|
# user can read this file.
|
|
# ---------------------------------------------
|
|
|
|
"ssh-key-romantic" = {
|
|
file = "${mysecrets}/desktop/ssh-key-romantic.age";
|
|
}
|
|
// user_readable;
|
|
|
|
# work git identity, symlinked to ~/work/.gitconfig by home-manager
|
|
"work-gitconfig" = {
|
|
file = "${mysecrets}/desktop/work-gitconfig.age";
|
|
}
|
|
// user_readable;
|
|
};
|
|
|
|
# place secrets in /etc/
|
|
# NOTE: this will fail for the first time. cause it's running before "activate-agenix"
|
|
environment.etc = {
|
|
"agenix/rclone.conf" = {
|
|
source = config.age.secrets."rclone.conf".path;
|
|
};
|
|
|
|
"agenix/ssh-key-romantic" = {
|
|
source = config.age.secrets."ssh-key-romantic".path;
|
|
};
|
|
|
|
"agenix/ryan4yin-gpg-subkeys.priv.age" = {
|
|
source = config.age.secrets."ryan4yin-gpg-subkeys.priv.age".path;
|
|
};
|
|
|
|
# The following secrets are used by home-manager modules
|
|
# But nix-darwin doesn't support environment.etc.<name>.mode
|
|
# So we need to change its mode manually
|
|
"agenix/work-gitconfig" = {
|
|
source = config.age.secrets."work-gitconfig".path;
|
|
};
|
|
};
|
|
|
|
# nix-darwin ignores environment.etc.<name>.mode/owner, and a blanket chown
|
|
# makes the root-only secrets readable by the login user. Re-apply each
|
|
# secret's declared policy instead.
|
|
system.activationScripts.postActivation.text = ''
|
|
if [ -d /etc/agenix ]; then
|
|
${pkgs.coreutils}/bin/chown ${myvars.username} \
|
|
/etc/agenix/ssh-key-romantic \
|
|
/etc/agenix/work-gitconfig
|
|
${pkgs.coreutils}/bin/chmod 0500 \
|
|
/etc/agenix/ssh-key-romantic \
|
|
/etc/agenix/work-gitconfig
|
|
|
|
${pkgs.coreutils}/bin/chown root /etc/agenix/rclone.conf
|
|
${pkgs.coreutils}/bin/chmod 0500 /etc/agenix/rclone.conf
|
|
|
|
${pkgs.coreutils}/bin/chown root /etc/agenix/ryan4yin-gpg-subkeys.priv.age
|
|
${pkgs.coreutils}/bin/chmod 0000 /etc/agenix/ryan4yin-gpg-subkeys.priv.age
|
|
fi
|
|
'';
|
|
}
|