felixalb/pvv-nixos-config
1
0
Fork 0
mirror of https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git synced 2026-02-04 01:00:04 +01:00
Code Issues Projects Releases Wiki Activity

base: configure sops

Browse Source
This commit is contained in:
h7x4
2026-01-22 16:48:59 +09:00
parent f7757d697d
commit 1d47409d96
13 changed files with 15 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
base/default.nix
View File

@@ -10,11 +10,12 @@
(fp /users)
(fp /modules/snakeoil-certs.nix)
./flake-input-exporter.nix
./networking.nix
./nix.nix
./vm.nix
./flake-input-exporter.nix
./programs.nix
./sops.nix
./vm.nix
./services/acme.nix
./services/auto-upgrade.nix

12
base/sops.nix Normal file
View File

@@ -0,0 +1,12 @@
{ config, fp, lib, ... }:
{
sops.defaultSopsFile = let
secretsFilePath = fp /secrets/${config.networking.hostName}/${config.networking.hostName}.yaml;
in lib.mkIf (builtins.pathExists secretsFilePath) secretsFilePath;
sops.age = lib.mkIf (config.sops.defaultSopsFile != null) {
sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
}

5
hosts/bakke/configuration.nix
View File

@@ -6,11 +6,6 @@
./filesystems.nix
];
sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
networking.hostId = "99609ffc";
systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
matchConfig.Name = "enp2s0";

5
hosts/bekkalokk/configuration.nix
View File

@@ -19,11 +19,6 @@
./services/qotd
];
sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
matchConfig.Name = "enp2s0";
address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];

5
hosts/bicep/configuration.nix
View File

@@ -15,11 +15,6 @@
./services/matrix
];
sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
#systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
#matchConfig.Name = "enp6s0f0";

5
hosts/ildkule/configuration.nix
View File

@@ -10,11 +10,6 @@
./services/journald-remote.nix
];
sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
boot.loader.systemd-boot.enable = false;
boot.loader.grub.device = "/dev/vda";
boot.tmp.cleanOnBoot = true;

5
hosts/kommode/configuration.nix
View File

@@ -9,11 +9,6 @@
./services/nginx.nix
];
sops.defaultSopsFile = fp /secrets/kommode/kommode.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
matchConfig.Name = "ens18";
address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];

3
hosts/lupine/configuration.nix
View File

@@ -9,9 +9,6 @@
];
sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
matchConfig.Name = "enp0s31f6";

5
hosts/shark/configuration.nix
View File

@@ -6,11 +6,6 @@
(fp /base)
];
sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
matchConfig.Name = "ens18";
address = with values.hosts.shark; [ (ipv4 + "/25") (ipv6 + "/64") ];

5
hosts/skrott/configuration.nix
View File

@@ -22,11 +22,6 @@
# TODO: can we reduce further?
sops.defaultSopsFile = fp /secrets/skrott/skrott.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
sops.secrets = {
"dibbler/postgresql/url" = {
owner = "dibbler";

5
hosts/temmie/configuration.nix
View File

@@ -8,11 +8,6 @@
./services/nfs-mounts.nix
];
# sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
# sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# sops.age.keyFile = "/var/lib/sops-nix/key.txt";
# sops.age.generateKey = true;
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
matchConfig.Name = "ens18";
address = with values.hosts.temmie; [ (ipv4 + "/25") (ipv6 + "/64") ];

5
hosts/ustetind/configuration.nix
View File

@@ -7,11 +7,6 @@
./services/gitea-runners.nix
];
sops.defaultSopsFile = fp /secrets/ustetind/ustetind.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
boot.loader.systemd-boot.enable = false;
networking.useHostResolvConf = lib.mkForce false;

5
hosts/wenche/configuration.nix
View File

@@ -14,11 +14,6 @@
"armv7l-linux"
];
sops.defaultSopsFile = fp /secrets/wenche/wenche.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.generateKey = true;
boot.loader.systemd-boot.enable = false;
boot.loader.grub.device = "/dev/sda";