Add secrets with sops

1 files changed, 40 insertions, 0 deletions

diff --git a/hosts/common.nix b/hosts/common.nix
index e6bc71d..65302b1 100644
--- a/hosts/common.nix
+++ b/hosts/common.nix
@@ -7,6 +7,10 @@
   ...
 }:
 {
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
   nix.settings = {
     trusted-users = [ "@wheel" ];
     experimental-features = [
@@ -163,6 +167,42 @@
   programs.gnupg.agent = {
     enable = true;
     enableSSHSupport = true;
+    pinentryPackage = pkgs.pinentry-gnome3;
+  };
+
+  sops = {
+    defaultSopsFile = ../secrets/secrets.yaml;
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    secrets.gpg_private_key = {
+      owner = user;
+      mode = "0400";
+    };
+  };
+
+  systemd.services.import-gpg-key = {
+    description = "Import GPG key from sops secret";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "sops-nix.service" ];
+    wants = [ "sops-nix.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      User = user;
+    };
+    path = [
+      pkgs.gnupg
+      pkgs.gawk
+    ];
+    script = ''
+      GPG_KEY="/run/secrets/gpg_private_key"
+      if [ -f "$GPG_KEY" ]; then
+        gpg --batch --import "$GPG_KEY" || true
+        KEY_FP=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^fpr:/{print $10; exit}')
+        if [ -n "$KEY_FP" ]; then
+          echo "$KEY_FP:6:" | gpg --batch --import-ownertrust || true
+        fi
+      fi
+    '';
   };
 
   services.upower.enable = true;