Add sops secrets for Marid.

This commit is contained in:
Kevin Baensch 2023-06-17 18:10:50 +02:00
parent d298b78c4d
commit 7d02cab301
Signed by: derped
GPG key ID: C0F1D326C7626543
3 changed files with 54 additions and 0 deletions

View file

@ -2,6 +2,9 @@
{ {
services.cron.enable = false; services.cron.enable = false;
security.pki.certificateFiles = [
config.sops.secrets."certs/proxy".path
];
networking.dhcpcd.extraConfig = "noarp"; networking.dhcpcd.extraConfig = "noarp";
system.stateVersion = "21.05"; system.stateVersion = "21.05";
} }

View file

@ -0,0 +1,37 @@
users:
derped:
password: ENC[AES256_GCM,data:bSkIZ3CrpnYPzmOZSp/J6y2IUXOe2kszqRYH1ffv7UQgE0sbbbRD/Re5b/p2RfJMhF7vRGH7QfSX6rcTMktyf4cnq14L655OHrah4/+J9YgRRYtGKNeVxr6DJAFPcoW3nc99,iv:NI9lm0SeNN0keDxeLoa+tU6LCfDkICJNCMm90+kKd5c=,tag:edoH4DVqjnu4233DXk5GIg==,type:str]
certs:
proxy: ENC[AES256_GCM,data:T68c6HOxit4pJwWhRcYfFFXi3F8c5j0auiIAlafoexaJvOgnarjmyDnikRB4+gobV0ZytVYIRosb2JuqtH159B05310dJDmUBnGPpOyKSKtPjIaKV0BFCnMI04sosTqh0dNKhqPCuA/95QNJeXvJ3zHkpWuriZhuej45EGJLROWG3fQCpibdDvYaeHhWj2SdtJB9o/eRRbyI7g/AuqJfuvHXoKJmTKbsEXZHu8M0qAiABoR/fuMwF8/FrCgzJ9FZPLPBqQLfGzLMyRULYay8JYegmbvw/YKGk2Y6OMp2zgQOz2xbIAPfGFrPVhoaeyJMRq6aaVa1zupHKFLd8R+cxIfYuViRwMQGOQWZ/hy6gEOCasBzZQVP1SXpCYmHLZPK1Q9jsRxO3ja61EBwNg2dFEe9ONBfSftmj71Ipzrjo/jm3VBPabI3OYbp6LaDIShn/lJxVoyTYJiSe2rn1jix/LE2mwJYg//g2ckkCDSJCVr991MHpsYKeGc7Aocxy/UAWUFPWtCdLGfkJ5T/Z1jYqvGE0MbcifUO2KBvOdZJSu4ptYWxgq1hg0q+f/KQu7WPGcDXpiE2AOfA04coaF+NxCOwHq46py7Ez36wt4y3a2/5xBYnvsdQCb2kKf253IuSF1hMB+yj0Fbw2+HU4FK5V8zuVjfhvC9zncq8WSWojiyodWritbzBKBj/FDqOSKH4UdFfsC4oSzY8y0vDsW5Ied2iE5gPlDeXqwmkfEQuqtBLekc8063ny+iX8TD+5WbEUxn+6++lXiQZWPcaGffGSWcGFaE+EhKV67ul6uARYSuB328WO/mA9cKlv1xPH4HwEXcqPBOdtw==,iv:vyUBk+7VryI+u1yIkPYLYV13gZVE2P9q4T/pmz92OqY=,tag:htempltVO7hkJI0Wfkgm/A==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age10vw4q40dq0tk9xzexeyn7cl6qka0hz7mfkmhv9g322k0u4dacd5sq8gg67
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Rnd5UndnWlVUd3RQdEs1
S2c3OTFMbmwwdE1WWE5wSEhVQ1NIenJDMG5vCm0xMk1jTGJqTzVtVGwrMVBKNlF5
bGxHaURhSzRkdndZalRpT2VLOXhDbEkKLS0tIEd0T1AyR3RsT3NCaGhiZ3BtQUFi
MHl3cFVaa0pnbTR3NGhuTXp0dk5ob2cKh2aFZqv1C/m3rZvEKSl9sCYJ8lC/mofq
oaigG2BXkgVkcT9xhZufWkMDhS+mOZW7oL0m2DDM3M8cnSMx55ONFg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-06-17T17:35:37Z"
mac: ENC[AES256_GCM,data:r4VXy06lvBAtGMexX3zDg9VI67WYeWLS7g9zg9HIv9rZUfwF2/2ZAXDu4PC9Ree8navCb1JhRYpopkZqlm04ky/6XI8RgFfGHXrdtvJAMJeS3houHuL7xLHlEarPvlLfE53g0zZa/GJqBiPzv+VTFEibv6kRKhhQ3FyRgsqUrO4=,iv:cpX1FIhCivvzM6dN4e+z6A2Lo/crHxRffRDweIViehA=,tag:FHRX14G/ke8MgJMyge+eiQ==,type:str]
pgp:
- created_at: "2023-06-17T16:07:20Z"
enc: |
-----BEGIN PGP MESSAGE-----
hF4DVbZwA9DOvl8SAQdAcdYIYiBbPSGSTJBzT5ZTV+4fJr8AdZcE5IpSEno7pVIw
k6f2fPf2VuXdfnHOFtSMvPfDCsWIqO9JLuue5Bgjd6yxyq7Ss7QqZpFFWjlW6V1A
1GgBCQIQI8f3q64+P9CSec9gjmIhAv/ohOsMfBI3CozxHJhQO4B+N4CyZsCYvHrF
6qUXpvXEMm6xkTvmXnMc6EEKEuIRMTm+pHEf8Uoz9NCGsWSBbNRFtL6fUZVKLQ09
lglDc2ZHhC6XJg==
=uWvi
-----END PGP MESSAGE-----
fp: 1F2EA6D9A57A9BE5A7F3AA035BEBEE4EE57DC7E2
unencrypted_suffix: _unencrypted
version: 3.7.3

14
machines/Marid/sops.nix Normal file
View file

@ -0,0 +1,14 @@
{ config, lib, ... }:
{
sops = {
defaultSopsFile = ./secrets.yaml;
age = {
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
# TODO: auto loop over users
secrets."users/derped/password".neededForUsers = true;
secrets."certs/proxy".mode = "0440";
};
}