modules/system/secrets.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

{
  flake.modules.nixos.secrets =
    { inputs, ... }:
    {
      imports = [ inputs.sops-nix.nixosModules.sops ];
      sops = {
        defaultSopsFile = inputs.self + /secrets/secrets.yaml;
        age.keyFile = "/etc/sops/age_key";
        secrets = {
          "borgbase_ssh_key" = {
            owner = "root";
            mode = "0600";
          };
          "nextcloud-secrets" = {
            owner = "nextcloud";
            group = "nextcloud";
            mode = "0400";
          };
          "nextcloud-admin-pass" = {
            owner = "root";
            mode = "0600";
          };
          "ssh_github_key" = {
            owner = "administrator";
            mode = "0600";
          };
          "ssh_jonsbo_key" = {
            owner = "administrator";
            mode = "0600";
          };
          "ssh_sachiel_key" = {
            owner = "administrator";
            mode = "0600";
          };
          "borg_repo" = {
            owner = "root";
            mode = "0600";
          };
          "ssh_git_pubkey" = {
            owner = "git";
            group = "git";
            mode = "0400";
            path = "/var/lib/git-server/.ssh/authorized_keys";
          };
          "cert_fullchain" = {
            owner = "nginx";
            group = "nginx";
          };
          "cert_private" = {
            owner = "nginx";
            group = "nginx";
          };
        };
      };
    };
}