starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-07-14 16:42:43 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

feat: agenix - use the system's host ssh key for cryption

Browse Source
This commit is contained in:
Ryan Yin
2024-01-26 20:52:16 +08:00
parent d1cdddc9ca
commit 7f72a0612b
5 changed files with 152 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
secrets/darwin.nix
+69 -30
View File
@@ -16,44 +16,79 @@
# if you changed this key, you need to regenerate all encrypt files from the decrypt contents!
age.identityPaths = [
"/Users/${username}/.ssh/juliet-age" # macOS
# Generate manually via `sudo ssh-keygen -A`
"/etc/ssh/ssh_host_ed25519_key" # macOS, using the host key for decryption
];
age.secrets = {
"wg-business.conf" = {
file = "${mysecrets}/wg-business.conf.age";
owner = username;
};
"ssh-key-romantic" = {
file = "${mysecrets}/ssh-key-romantic.age";
mode = "0600";
owner = username;
};
"ryan4yin-gpg-subkeys.priv" = {
file = "${mysecrets}/ryan4yin-gpg-subkeys.priv.age";
# owner = root
age.secrets = let
noaccess = {
mode = "0000";
owner = "root";
};
high_security = {
mode = "0500";
owner = "root";
};
user_readable = {
mode = "0500";
owner = username;
};
in {
# ---------------------------------------------
# no one can read/write this file, even root.
# ---------------------------------------------
"ryan4yin-gpg-subkeys.priv" =
{
file = "${mysecrets}/ryan4yin-gpg-subkeys.priv.age";
}
// noaccess;
# ---------------------------------------------
# only root can read this file.
# ---------------------------------------------
"wg-business.conf" =
{
file = "${mysecrets}/wg-business.conf.age";
}
// high_security;
"rclone.conf" =
{
file = "${mysecrets}/rclone.conf.age";
}
// high_security;
"nix-access-tokens" =
{
file = "${mysecrets}/nix-access-tokens.age";
}
// high_security;
# ---------------------------------------------
# user can read this file.
# ---------------------------------------------
"ssh-key-romantic" =
{
file = "${mysecrets}/ssh-key-romantic.age";
}
// user_readable;
# alias-for-work
"alias-for-work.nushell" = {
file = "${mysecrets}/alias-for-work.nushell.age";
mode = "0600";
owner = username;
};
"alias-for-work.bash" = {
file = "${mysecrets}/alias-for-work.bash.age";
mode = "0600";
owner = username;
};
"alias-for-work.nushell" =
{
file = "${mysecrets}/alias-for-work.nushell.age";
}
// user_readable;
"nix-access-tokens" = {
file = "${mysecrets}/nix-access-tokens.age";
mode = "0600";
owner = username;
};
"alias-for-work.bash" =
{
file = "${mysecrets}/alias-for-work.bash.age";
}
// user_readable;
};
# place secrets in /etc/
@@ -64,6 +99,10 @@
source = config.age.secrets."wg-business.conf".path;
};
"agenix/rclone.conf" = {
source = config.age.secrets."rclone.conf".path;
};
"agenix/ssh-key-romantic" = {
source = config.age.secrets."ssh-key-romantic".path;
};