diff options
| -rw-r--r-- | modules/hosts/adam/flake-parts.nix | 1 | ||||
| -rw-r--r-- | modules/hosts/adam/secrets.nix | 28 | ||||
| -rw-r--r-- | modules/hosts/lilith/secrets.nix | 25 | ||||
| -rw-r--r-- | modules/hosts/sachiel/flake-parts.nix | 1 | ||||
| -rw-r--r-- | modules/hosts/sachiel/secrets.nix | 40 |
5 files changed, 93 insertions, 2 deletions
diff --git a/modules/hosts/adam/flake-parts.nix b/modules/hosts/adam/flake-parts.nix index cf50170..9f23227 100644 --- a/modules/hosts/adam/flake-parts.nix +++ b/modules/hosts/adam/flake-parts.nix @@ -4,7 +4,6 @@ specialArgs = { inherit inputs; }; modules = [ inputs.self.modules.nixos.adam - inputs.self.modules.nixos.secrets inputs.self.modules.nixos.home-manager inputs.self.modules.nixos.plymouth inputs.self.modules.nixos.kde diff --git a/modules/hosts/adam/secrets.nix b/modules/hosts/adam/secrets.nix new file mode 100644 index 0000000..f88e1bf --- /dev/null +++ b/modules/hosts/adam/secrets.nix @@ -0,0 +1,28 @@ +{ + flake.modules.nixos.adam = + { inputs, ... }: + { + imports = [ inputs.sops-nix.nixosModules.sops ]; + sops = { + defaultSopsFile = inputs.self + /secrets/secrets.yaml; + age.keyFile = "/etc/sops/age_key"; + secrets = { + "ssh_github_key" = { + owner = "schererleander"; + group = "users"; + mode = "0600"; + }; + "ssh_jonsbo_key" = { + owner = "administrator"; + group = "users"; + mode = "0600"; + }; + "ssh_sachiel_key" = { + owner = "administrator"; + group = "users"; + mode = "0600"; + }; + }; + }; + }; +} diff --git a/modules/hosts/lilith/secrets.nix b/modules/hosts/lilith/secrets.nix new file mode 100644 index 0000000..b02dacc --- /dev/null +++ b/modules/hosts/lilith/secrets.nix @@ -0,0 +1,25 @@ +{ + flake.modules.darwin.lilith = + { inputs, ... }: + { + imports = [ inputs.sops-nix.darwinModules.sops ]; + sops = { + defaultSopsFile = inputs.self + /secrets/secrets.yaml; + age.keyFile = "/etc/sops/age_key"; + secrets = { + "ssh_github_key" = { + owner = "schererleander"; + mode = "0600"; + }; + "ssh_jonsbo_key" = { + owner = "schererleander"; + mode = "0600"; + }; + "ssh_sachiel_key" = { + owner = "schererleander"; + mode = "0600"; + }; + }; + }; + }; +} diff --git a/modules/hosts/sachiel/flake-parts.nix b/modules/hosts/sachiel/flake-parts.nix index 42d7551..6f33503 100644 --- a/modules/hosts/sachiel/flake-parts.nix +++ b/modules/hosts/sachiel/flake-parts.nix @@ -4,7 +4,6 @@ specialArgs = { inherit inputs; }; modules = [ inputs.self.modules.nixos.sachiel - inputs.self.modules.nixos.secrets inputs.self.modules.nixos.openssh inputs.self.modules.nixos.nginx inputs.self.modules.nixos.nextcloud diff --git a/modules/hosts/sachiel/secrets.nix b/modules/hosts/sachiel/secrets.nix new file mode 100644 index 0000000..c0968fd --- /dev/null +++ b/modules/hosts/sachiel/secrets.nix @@ -0,0 +1,40 @@ +{ + flake.modules.nixos.sachiel = + { inputs, ... }: + { + imports = [ inputs.sops-nix.nixosModules.sops ]; + sops = { + defaultSopsFile = inputs.self + /secrets/secrets.yaml; + age.keyFile = "/etc/sops/age_key"; + secrets = { + "nextcloud-secrets" = { + owner = "nextcloud"; + group = "nextcloud"; + mode = "0400"; + }; + "nextcloud-admin-pass" = { + owner = "root"; + mode = "0600"; + }; + # SSL certificates + "cert_fullchain" = { + owner = "nginx"; + group = "nginx"; + }; + "cert_private" = { + owner = "nginx"; + group = "nginx"; + }; + # Backup configuration + "borgbase_ssh_key" = { + owner = "root"; + mode = "0600"; + }; + "borg_repo" = { + owner = "root"; + mode = "0600"; + }; + }; + }; + }; +} |