diff options
| -rw-r--r-- | .sops.yaml | 8 | ||||
| -rw-r--r-- | flake.nix | 4 | ||||
| -rw-r--r-- | hosts/common.nix | 40 | ||||
| -rw-r--r-- | secrets/secrets.yaml | 16 | ||||
| -rw-r--r-- | users/bee/default.nix | 6 | ||||
| -rw-r--r-- | users/common.nix | 5 |
6 files changed, 78 insertions, 1 deletions
diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..bc68f85 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,8 @@ +keys: + - &nixios age1qfldnsnu2nmklke34uq9fpuf33677a6mlwmnszma7vkn75etrcrq6rxdpg + +creation_rules: + - path_regex: secrets/secrets.yaml$ + key_groups: + - age: + - *nixios @@ -17,6 +17,10 @@ url = "github:DreamMaoMao/mango"; inputs.nixpkgs.follows = "nixpkgs"; }; + sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = diff --git a/hosts/common.nix b/hosts/common.nix index e6bc71d..65302b1 100644 --- a/hosts/common.nix +++ b/hosts/common.nix @@ -7,6 +7,10 @@ ... }: { + imports = [ + inputs.sops-nix.nixosModules.sops + ]; + nix.settings = { trusted-users = [ "@wheel" ]; experimental-features = [ @@ -163,6 +167,42 @@ programs.gnupg.agent = { enable = true; enableSSHSupport = true; + pinentryPackage = pkgs.pinentry-gnome3; + }; + + sops = { + defaultSopsFile = ../secrets/secrets.yaml; + age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + secrets.gpg_private_key = { + owner = user; + mode = "0400"; + }; + }; + + systemd.services.import-gpg-key = { + description = "Import GPG key from sops secret"; + wantedBy = [ "multi-user.target" ]; + after = [ "sops-nix.service" ]; + wants = [ "sops-nix.service" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + User = user; + }; + path = [ + pkgs.gnupg + pkgs.gawk + ]; + script = '' + GPG_KEY="/run/secrets/gpg_private_key" + if [ -f "$GPG_KEY" ]; then + gpg --batch --import "$GPG_KEY" || true + KEY_FP=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^fpr:/{print $10; exit}') + if [ -n "$KEY_FP" ]; then + echo "$KEY_FP:6:" | gpg --batch --import-ownertrust || true + fi + fi + ''; }; services.upower.enable = true; diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml new file mode 100644 index 0000000..bdbd1bf --- /dev/null +++ b/secrets/secrets.yaml @@ -0,0 +1,16 @@ +gpg_private_key: ENC[AES256_GCM,data:w33fn+jpHrjiZLMI3ZBuxvltop8g6WXS3sWI70FNlCjF3Cf2VY9qCiRem4B/F647+LvaIKdtzchA3UMadDG1nTXjOdNOp6btBQUPKgw3zsaGJYravvWx/86qX13AHykcROaohlrNSmJGG8NwpADplSZ9i9/YfMU1ZZKrdrPw3669P9SuNmqKybQWzPYpHbfrH0jzRt3inGC77BFDAEXyFNtvBUfJdgTtMFGU/Aa87Nqil1PEw/Dg1SGzv8HxDcDw4FGPi6vrbEm0Ozq5gCbTuAf1LeEcjjEZ5sb8VTbiILRXFaznAuKAOTJODMhFU//CIOCholQ/pqaAQobBLETvizcOC7X7+wHMEvB9Nl4t2nwSS4nvNi1HfnWtq9jfw/OyovnbnTazAqY0LvfKSQvbhO65VEPgGpzdTtsMeLdey5c6DvFi8V7JcE/d9w20+g7jG59psZonA/S/3+bfoYjTotoY73iAmcU8Dn/gwsRkPPrh9TF7TcJ7wnbGtXac/TEe2vW5uLdadbxdirGlbgNmKgoLd8g/mLZbEmzZC8pacWlh8uGXDwMzPpBTayXJfWe8RcGzs8zB5NKKvnQQzEH5wM6vbrwL8v0b7hNvEdeJNInULS8ctqFlhYw8sHbnckrn/TrXYGLrF+gXuwL1P19EhYWQkaCLGGyvj1Eoc3qMkaE/AJNMxfNg0hrKm3TDiHHm6UeVcF1X1fyRAJUlnQkkEQ48+vfsaC9+C67XU2TUbhgnHX2xnWQ3dSE4/MIoupi1D5VqVJ4tev4PM5jYIAHA54wYtVDtlgVVNFvlMjoskwcXf1kaUdzZLINxfYLR/TtLhLCEfLgUYxblKtlQyGPwGnLi0k3025v43o1CVJAaVJMippCl4x5QOkedyGY89YBGyKrUsXyY72erxMTLZUhPajswE/ce/Uf+EmDob/uS2vViNd98F5FCrmD0peKYDeDp8Vnf66xbGsZ88RmDqwrsTjkdfItAzKqovGl2hD/yPMAWwKYUzrcVUI2ZPmnjKqSDeZeeGh4Sf81A/mP/FnJHkPv+R+GcxCGokL/Cg4P5c7EYYdxODH5mq4O/DaXqgPMMLmeps9OApl03fDJVH1ITmt/0censNCgPdP90Mob2UX0d3sjjUBrWZw68yflGsSvciTSKplUDY4KLxA==,iv:fsGogJ7kQt20A4PZNDUinbh3mvBqIT+N/KMWzOMpziI=,tag:jB5yrUJrXG2RbbWUf7jCVA==,type:str] +sops: + age: + - recipient: age1qfldnsnu2nmklke34uq9fpuf33677a6mlwmnszma7vkn75etrcrq6rxdpg + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6U2paUWZRSGUxaElMQXI2 + RmdDUE9SZzZxWlVFK2lUV1d1S1kxMEdJNmlFCnBhVSt1SGpiWk1ZNE1kOERGMGxH + TENYSHIrQmFGK3k2RW1WR2pWSk9sQ0UKLS0tIEpSWEw3TlF1bFZjZUgwUStKNW1S + U0JiMFV2L1B4dnpsNnhmYUNtVVNqU3cKZotGMk7AuFlp8mwnZ1/P5GqmR5IC9xBr + uwrsOyWrplA/Z251qda+CH41vKIVHvOV+AM5reu9G4K1/Bu/huF3/A== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-06T21:30:21Z" + mac: ENC[AES256_GCM,data:0aFsXxZPEqL3BBIpm4qNAGqwsJqhM+/kC/kJE2yEs107Q+iu4akW3BstzQ8VCuc3Rg7alNOKmkuVEhJwLPvYc8zpWlb+7eIqLUX11Yrtz0UCzgApLCshRxIRPAxksqQy3ueRD0g+KmKx/Nui3NWIov6ycr3UoqxCjBthqHCKkyk=,iv:gzABDgrzjwTQ9EYcmT9IzF+PXc2hhKImSA55OyRV/G8=,tag:CYp0BeENvWkh9pEnWkCHdQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.12.1 diff --git a/users/bee/default.nix b/users/bee/default.nix index 577ad09..064ff78 100644 --- a/users/bee/default.nix +++ b/users/bee/default.nix @@ -33,6 +33,12 @@ TERM = config.beeMods.terminal.default; }; + home.packages = with pkgs; [ + vim + sops + ]; + programs.home-manager.enable = true; + home.stateVersion = systemState; # check flake.nix } diff --git a/users/common.nix b/users/common.nix index c55187e..6c95959 100644 --- a/users/common.nix +++ b/users/common.nix @@ -10,10 +10,13 @@ settings = { user = { name = "beeb5k"; - email = "beebeeb5k@gmail.com"; + email = "bee@4d2.org"; + signingkey = "42177A22EA630575"; }; init.defaultBranch = "main"; credential.helper = "libsecret"; + commit.gpgsign = true; + tag.gpgsign = true; }; }; |