From 4dda24d573daa349f4bb1d400a1e0e423876df77 Mon Sep 17 00:00:00 2001 From: Martin Fischer Date: Sun, 14 Dec 2025 20:57:54 +0100 Subject: refactor: move host-specific secrets to host dirs --- nixos/hosts/ev/miniflux.nix | 2 +- nixos/hosts/ev/secrets/miniflux-admin.age | 9 ++++++ nixos/hosts/tente/grafana.nix | 2 +- .../tente/secrets/grafana-matrix-forwarder-env.age | Bin 0 -> 449 bytes nixos/secrets.nix | 31 +++++++++++++++++++++ nixos/secrets/grafana-matrix-forwarder-env.age | Bin 449 -> 0 bytes nixos/secrets/miniflux-admin.age | 9 ------ nixos/secrets/secrets.nix | 12 -------- nixos/secrets/vpn-se-privKey.age | 12 -------- nixos/shared/secrets/vpn-se-privKey.age | 12 ++++++++ nixos/shared/vpn.nix | 2 +- 11 files changed, 55 insertions(+), 36 deletions(-) create mode 100644 nixos/hosts/ev/secrets/miniflux-admin.age create mode 100644 nixos/hosts/tente/secrets/grafana-matrix-forwarder-env.age create mode 100644 nixos/secrets.nix delete mode 100644 nixos/secrets/grafana-matrix-forwarder-env.age delete mode 100644 nixos/secrets/miniflux-admin.age delete mode 100644 nixos/secrets/secrets.nix delete mode 100644 nixos/secrets/vpn-se-privKey.age create mode 100644 nixos/shared/secrets/vpn-se-privKey.age (limited to 'nixos') diff --git a/nixos/hosts/ev/miniflux.nix b/nixos/hosts/ev/miniflux.nix index 5bf1ccd..73bdf98 100644 --- a/nixos/hosts/ev/miniflux.nix +++ b/nixos/hosts/ev/miniflux.nix @@ -11,7 +11,7 @@ in }; config = { - age.secrets.miniflux-admin.file = ; + age.secrets.miniflux-admin.file = ./secrets/miniflux-admin.age; services.miniflux = { enable = true; diff --git a/nixos/hosts/ev/secrets/miniflux-admin.age b/nixos/hosts/ev/secrets/miniflux-admin.age new file mode 100644 index 0000000..b656b07 --- /dev/null +++ b/nixos/hosts/ev/secrets/miniflux-admin.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 PMTW+A CIjI5374KCn9hZRM6vj4PTcUj4FzHan/buPBD5gQmw8 +6mXVcux6zZQ16U1y3bipsKD4y1QiMQ498IQAzpDJqt0 +-> ssh-ed25519 PHC5tQ IQiEl8meNDHIE0HI2SErDxFDVSEd/TCRH5PplnIC9H4 +mq/N57ex2NpbptzaMpAfYJ1Y/exIj1+J2X9CRW28aOg +-> e#-grease TdfbQVa$ L X4("^:7K V&L1z +cHZi1Yyb7tz7gw9zkPqbbhEZeGVIncPZfTpIvch0e/wDCIjMxY7e2Pb6nOVDxQ +--- b32AUhCBWDVXlj4pUbDW91Y80nQ5Wp9zTy+rl6vnFHU +A5'`eYZ%Fdk*&8IBe@Aa[/{eEu<)>ItMY};b \ No newline at end of file diff --git a/nixos/hosts/tente/grafana.nix b/nixos/hosts/tente/grafana.nix index f7c8789..a2ea9b9 100644 --- a/nixos/hosts/tente/grafana.nix +++ b/nixos/hosts/tente/grafana.nix @@ -26,7 +26,7 @@ in ]; config = { - age.secrets.grafana-matrix-forwarder-env.file = ; + age.secrets.grafana-matrix-forwarder-env.file = ./secrets/grafana-matrix-forwarder-env.age; services.grafana = { enable = true; diff --git a/nixos/hosts/tente/secrets/grafana-matrix-forwarder-env.age b/nixos/hosts/tente/secrets/grafana-matrix-forwarder-env.age new file mode 100644 index 0000000..84cab14 Binary files /dev/null and b/nixos/hosts/tente/secrets/grafana-matrix-forwarder-env.age differ diff --git a/nixos/secrets.nix b/nixos/secrets.nix new file mode 100644 index 0000000..f44defe --- /dev/null +++ b/nixos/secrets.nix @@ -0,0 +1,31 @@ +let + admins = [ + # martin + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+moAzcnDJsyUalRVdLeJS1D5wezwMDyHuM+Cyk1nQh" + ]; + + hosts = { + hamac = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmjbC0gk2s/qDQ+QR//GJH0ZPld99L0EtX7dPP5h2RN"; + ev = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINCSypbTOnAYBO32vUUieOsb6ws32gCsDg8nB8JhuFuI"; + tente = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGTyZdGXxkAjzRulRFB23AX0T/lVLZOaSaFJi+thsjgx"; + }; + + hostSpecific = host: + let + hostSecrets = "hosts/${host}/secrets"; + files = builtins.attrNames (builtins.readDir ./${hostSecrets}); + in + builtins.listToAttrs ( + map (f: { + name = "${hostSecrets}/${f}"; + value = { + publicKeys = [hosts.${host}] ++ admins; + }; + }) files + ); +in +{ + "shared/secrets/vpn-se-privKey.age".publicKeys = [hosts.hamac hosts.ev] ++ admins; +} +// hostSpecific "ev" +// hostSpecific "tente" diff --git a/nixos/secrets/grafana-matrix-forwarder-env.age b/nixos/secrets/grafana-matrix-forwarder-env.age deleted file mode 100644 index 84cab14..0000000 Binary files a/nixos/secrets/grafana-matrix-forwarder-env.age and /dev/null differ diff --git a/nixos/secrets/miniflux-admin.age b/nixos/secrets/miniflux-admin.age deleted file mode 100644 index b656b07..0000000 --- a/nixos/secrets/miniflux-admin.age +++ /dev/null @@ -1,9 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 PMTW+A CIjI5374KCn9hZRM6vj4PTcUj4FzHan/buPBD5gQmw8 -6mXVcux6zZQ16U1y3bipsKD4y1QiMQ498IQAzpDJqt0 --> ssh-ed25519 PHC5tQ IQiEl8meNDHIE0HI2SErDxFDVSEd/TCRH5PplnIC9H4 -mq/N57ex2NpbptzaMpAfYJ1Y/exIj1+J2X9CRW28aOg --> e#-grease TdfbQVa$ L X4("^:7K V&L1z -cHZi1Yyb7tz7gw9zkPqbbhEZeGVIncPZfTpIvch0e/wDCIjMxY7e2Pb6nOVDxQ ---- b32AUhCBWDVXlj4pUbDW91Y80nQ5Wp9zTy+rl6vnFHU -A5'`eYZ%Fdk*&8IBe@Aa[/{eEu<)>ItMY};b \ No newline at end of file diff --git a/nixos/secrets/secrets.nix b/nixos/secrets/secrets.nix deleted file mode 100644 index f1c8ab8..0000000 --- a/nixos/secrets/secrets.nix +++ /dev/null @@ -1,12 +0,0 @@ -let - martin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+moAzcnDJsyUalRVdLeJS1D5wezwMDyHuM+Cyk1nQh"; - - hamac = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmjbC0gk2s/qDQ+QR//GJH0ZPld99L0EtX7dPP5h2RN"; - ev = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINCSypbTOnAYBO32vUUieOsb6ws32gCsDg8nB8JhuFuI"; - tente = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGTyZdGXxkAjzRulRFB23AX0T/lVLZOaSaFJi+thsjgx"; -in -{ - "vpn-se-privKey.age".publicKeys = [ martin hamac ev ]; - "grafana-matrix-forwarder-env.age".publicKeys = [ martin tente ]; - "miniflux-admin.age".publicKeys = [ martin ev ]; -} diff --git a/nixos/secrets/vpn-se-privKey.age b/nixos/secrets/vpn-se-privKey.age deleted file mode 100644 index ca2a8eb..0000000 --- a/nixos/secrets/vpn-se-privKey.age +++ /dev/null @@ -1,12 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 PMTW+A WNGr/0aVmRRmhZ6P6PaWxPML3VRBi59QTD5kQ2AuqXk -6ivhC1Cm/DVWdCxx+48U0YzJqhj0rmZ195SmjEX+Y4k --> ssh-ed25519 zNg/mg I4MbADHlAgwced5uYaEWXNgKvzfyGxKAWiXtg7rgRCg -ipQGQn7rCu59gHq5DjQIckvqGO5P/LJTtSP8yViEVdQ --> ssh-ed25519 PHC5tQ xsy2ivym+ymHacFJeTwll7aJyypoQTg8h/DyaVp98xs -rwPb2fCAtHKzUQgZ/0SxKZ37MnVb8u74vesd0o5G7yc --> @n>>$-grease @J3N{1sN qN_Oh]I K(# -dA ---- P0ZI10bTAqn+OPH84hF1V+Qa/X7gqvMZHkYAZQg5zgo -v:LՓQ "[YU -KY?+$Aa?`o[k369U0Ȯ8PH[H*g`w \ No newline at end of file diff --git a/nixos/shared/secrets/vpn-se-privKey.age b/nixos/shared/secrets/vpn-se-privKey.age new file mode 100644 index 0000000..ca2a8eb --- /dev/null +++ b/nixos/shared/secrets/vpn-se-privKey.age @@ -0,0 +1,12 @@ +age-encryption.org/v1 +-> ssh-ed25519 PMTW+A WNGr/0aVmRRmhZ6P6PaWxPML3VRBi59QTD5kQ2AuqXk +6ivhC1Cm/DVWdCxx+48U0YzJqhj0rmZ195SmjEX+Y4k +-> ssh-ed25519 zNg/mg I4MbADHlAgwced5uYaEWXNgKvzfyGxKAWiXtg7rgRCg +ipQGQn7rCu59gHq5DjQIckvqGO5P/LJTtSP8yViEVdQ +-> ssh-ed25519 PHC5tQ xsy2ivym+ymHacFJeTwll7aJyypoQTg8h/DyaVp98xs +rwPb2fCAtHKzUQgZ/0SxKZ37MnVb8u74vesd0o5G7yc +-> @n>>$-grease @J3N{1sN qN_Oh]I K(# +dA +--- P0ZI10bTAqn+OPH84hF1V+Qa/X7gqvMZHkYAZQg5zgo +v:LՓQ "[YU +KY?+$Aa?`o[k369U0Ȯ8PH[H*g`w \ No newline at end of file diff --git a/nixos/shared/vpn.nix b/nixos/shared/vpn.nix index 9cbcf45..4015edb 100644 --- a/nixos/shared/vpn.nix +++ b/nixos/shared/vpn.nix @@ -1,7 +1,7 @@ { config, pkgs, ... }: { - age.secrets.vpn-se-privKey.file = ../secrets/vpn-se-privKey.age; + age.secrets.vpn-se-privKey.file = ./secrets/vpn-se-privKey.age; # We're creating the wireguard interfaces in network namespaces so that # we can use them on demand: -- cgit v1.3.1