diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..730beb1 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,8 @@ +keys: + - &personal_age_key age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl + +creation_rules: + - path_regex: "secrets/.*\\.yaml$" + key_groups: + - age: + - *personal_age_key diff --git a/features/sops.nix b/features/sops.nix index ec0b39f..a0c6895 100644 --- a/features/sops.nix +++ b/features/sops.nix @@ -1,5 +1,56 @@ -{ pkgs, ... }: +{ pkgs, config, ... }: { + sops = { + defaultSopsFile = ../.sops.yaml; + + age = { + sshKeyPaths = [ ]; + keyFile = "/persist/sops/age/keys.txt"; + }; + + secrets = { + "password_hash" = { + sopsFile = ../secrets/password-hash.yaml; + owner = "root"; + group = "root"; + mode = "0400"; + neededForUsers = true; + }; + + "personal_ssh_key_ed25519" = { + sopsFile = ../secrets/personal-ssh-key.yaml; + key = "personal_ssh_key_ed25519"; + owner = config.users.users.frank.name; + group = config.users.users.frank.group; + mode = "0400"; + }; + + "personal_ssh_key_ed25519.pub" = { + sopsFile = ../secrets/personal-ssh-key.yaml; + key = "personal_ssh_key_ed25519_pub"; + owner = config.users.users.frank.name; + group = config.users.users.frank.group; + mode = "0644"; + }; + + "work_ssh_key_rsa" = { + sopsFile = ../secrets/work-ssh-key.yaml; + key = "work_ssh_key_rsa"; + owner = config.users.users.frank.name; + group = config.users.users.frank.group; + mode = "0400"; + }; + + "work_ssh_key_rsa.pub" = { + sopsFile = ../secrets/work-ssh-key.yaml; + key = "work_ssh_key_rsa_pub"; + owner = config.users.users.frank.name; + group = config.users.users.frank.group; + mode = "0644"; + }; + }; + }; + environment.systemPackages = with pkgs; [ sops age diff --git a/home/frank.nix b/home/frank.nix index e93d727..b4dfebb 100644 --- a/home/frank.nix +++ b/home/frank.nix @@ -1,7 +1,9 @@ -{ inputs, pkgs, ... }: -let - sshSigningKey = builtins.readFile ./ssh-signing-key.pub; -in +{ + inputs, + osConfig, + pkgs, + ... +}: { imports = [ inputs.lazyvim.homeManagerModules.default @@ -51,17 +53,12 @@ in bash = { enable = true; - # Import SSH identities and - # display fastfetch on shell open. initExtra = '' eval "$(devenv hook bash)" - [ -f $HOME/.ssh/id_floturcocantsee@daguerro.net ] && ssh-add $HOME/.ssh/id_floturcocantsee@daguerro.net - [ -f $HOME/.ssh/id_rsa ] && ssh-add $HOME/.ssh/id_rsa clear;fastfetch ''; }; - # Configure ZSH if using darwin (macOS). zsh = if pkgs.stdenv.hostPlatform.isDarwin then { @@ -69,8 +66,6 @@ in initContent = '' eval "$(devenv hook zsh)" - [ -f $HOME/.ssh/id_floturcocantsee@daguerro.net ] && ssh-add --apple-use-keychain $HOME/.ssh/id_floturcocantsee@daguerro.net - [ -f $HOME/.ssh/id_rsa ] && --apple-use-keychain ssh-add $HOME/.ssh/id_rsa clear;fastfetch ''; } @@ -111,7 +106,10 @@ in enableDefaultConfig = false; settings."*" = { - AddKeysToAgent = "yes"; + IdentityFile = [ + osConfig.sops.secrets."personal_ssh_key_ed25519".path + osConfig.sops.secrets."work_ssh_key_rsa".path + ]; }; }; @@ -167,7 +165,7 @@ in lfs.enable = true; signing = { - key = sshSigningKey; + key = osConfig.sops.secrets."personal_ssh_key_ed25519.pub".path; signByDefault = true; }; diff --git a/home/ssh-signing-key.pub b/home/ssh-signing-key.pub deleted file mode 100644 index 1f67a5c..0000000 --- a/home/ssh-signing-key.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ5+RJOhvamBpEptCRv90E+8bVWKn6Mep61wDpPYgKP3 floturcocantsee@daguerro.net \ No newline at end of file diff --git a/hosts/shared/nixos-pc.nix b/hosts/shared/nixos-pc.nix index 22500ad..df35340 100644 --- a/hosts/shared/nixos-pc.nix +++ b/hosts/shared/nixos-pc.nix @@ -1,4 +1,5 @@ { + config, pkgs, lib, inputs, @@ -151,7 +152,6 @@ security.rtkit.enable = true; programs = { - ssh.startAgent = true; firefox.enable = true; gnupg.agent = { @@ -168,6 +168,7 @@ users.users.frank = { isNormalUser = true; description = "Frank LoTurco"; + hashedPassword = config.sops.secrets.password_hash.path; extraGroups = [ "networkmanager" diff --git a/hosts/shared/nixos-server.nix b/hosts/shared/nixos-server.nix index 69089ad..23122b3 100644 --- a/hosts/shared/nixos-server.nix +++ b/hosts/shared/nixos-server.nix @@ -1,4 +1,5 @@ { + config, pkgs, ... }: @@ -72,11 +73,10 @@ }; }; - programs.ssh.startAgent = true; - users.users.frank = { isNormalUser = true; description = "Frank LoTurco"; + hashedPassword = config.sops.secrets.password_hash.path; extraGroups = [ "wheel" diff --git a/secrets/password-hash.yaml b/secrets/password-hash.yaml new file mode 100644 index 0000000..96878e8 --- /dev/null +++ b/secrets/password-hash.yaml @@ -0,0 +1,16 @@ +password_hash: ENC[AES256_GCM,data:ErID6NBUyznC7N+OMWWoArHPjcnZtphTkuDIfz4zI69TVJ7vudBoR8hz8lMq0jNzOq+rxkourkk3xm5J3mFyVUxOMJe0Vz2tlA==,iv:tCGHD8n6Y0lmvnpmQkf952VNQ42BkWjsiDhgzcls2ig=,tag:7tfLXfhFF9/qCzaDT1BEXA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwazNKVjhNQjdVRVY5RG5p + cG5ETWwvbXZHZENpYWRORG1JZi9lclQvVmxnClByNjZtUFBkWjFCbDZ3TnJnWnVD + Yjc1Rkk4RWRZenhNS1dzcGlkNnFDV0UKLS0tIHEvSmgrMlBMb2tyK2hzeUVIQzZx + VTFua05vZFFQV0dzSjczKytBdHl0dDAKS9D3rRLy6F9rvUhOr0KYDhvNvRvn3W82 + lCwkwtsXd2L2sPXKEfVd1r+dUaKDkXcLUXVbada7ma6UDLOmAq7Kqw== + -----END AGE ENCRYPTED FILE----- + recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl + lastmodified: "2026-10-21T14:34:25Z" + mac: ENC[AES256_GCM,data:QuRO9S3rK6dDIGUsgTHzNcypCMeR1AkATwVARv7Na1p6/n2S+5HLuGLkoSDWMnB15r+9GYrYaxDs9b4ppApCfbENrH1ffO7ZyhbY+NfbCgNTq/KgxZvbtAoQiwYalD97MNiZ2OBhmmVEe4ne5Fy1WY7g5uYnwYd7hIK+Vr/iCNE=,iv:rSho67a/+rZjb7iw47IXwKnqONc4tk5lbJBZDmrj9U8=,tag:tYWB4Xiv+oCKadn0IIIy1A==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3 diff --git a/secrets/personal-ssh-key.yaml b/secrets/personal-ssh-key.yaml new file mode 100644 index 0000000..1282d91 --- /dev/null +++ b/secrets/personal-ssh-key.yaml @@ -0,0 +1,17 @@ +personal_ssh_key_ed25519: ENC[AES256_GCM,data:57BaRc+Tkc/kdpLA8U/Qcydpo69FSP5kqAaqAsa7WaFGhPvrwiU4wrChP82nJb4Ilu4QLBphKRmKOFl7wlG3asvyyLhQ19JIeqdTq/lmByfdnGxv5Bugn58Oqj+f1uY5TQrLLf2QsVXwfgc2LgDGaMXzZdaobYOcgNwaRy6W0CWpGJRjUZgtwZRRnm6RApUaUsWjaN5n5NKcT1NlQNVVItRJiO86UUnv4PJcvZYw9ll5RrWEVgPXkljOq1BaKNhdwD1DEPJT0qYDK1N+Wypl/CGXL/Q1F/zKjwKf7VnGdHpXcef/BCG2fWI7fY0RQDEu5oKgVt4wtcPVRp4jbPpbW7OEUWW0BlcPqpteWXVmcl9U6s6E6RnbnSO/Gw4TppFXGnFvT/LsmlyLUeIFAtRb/278QgWzMfcjFeo+l6GK4i/8m4VU9pHQufsnEiF5KKESFQTk/r7waCBs3qe3PAkAg3M8tRkO1Q5E/8RLXwqZMD7LqAvuwraViJGYwWvlWVRsArBnv1n8sEKBlRlbpE6GShrgt3bAIKqoW3U/fxDdL3NCBYQ=,iv:/oeGYRtBWjD3pq/X/Sab+UVzIAVxE8QvvkTmb/45UO8=,tag:3kIbuY2UPbw1L7EH2++kaA==,type:str] +personal_ssh_key_ed25519_pub: ENC[AES256_GCM,data:zz/LBq5KI2t/z3YgP3gHK3B/c2O/jq6sQ8mT5qgoUGsL5VTvREUGnDaDxtaOcbez59srqmlQHwXbQ7Dax6iWEtWx4gtMhJ9piVzH/3skB0dMZ3W+7bNtCev1SkHchbWLUPD/ryXZ4LCAipMoJA==,iv:qD07xcOdZDokhKIVqS5ibWsEKG66eYy1JnBUzzlPoS4=,tag:732RVmwKJL2PlcJih+2PGQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1SFRTZFU3bzM5UE82Uk5p + UENKUFd5R1lIOW43YnBTcXlSWHBFUHlRYURRCkFGZTM5MFlnd2hKRUpRM2hRdy9o + dHlzbU9Xbm9YVENuSVR5Qi9JdEFIZk0KLS0tIDJ4SDNKZE41eGtPa2UrVDBTZFVv + VWsvQkc1bU1ObHBBUVd3ZXJBQjB1UE0KRgd4k0kRo15tsDOvv/VRTXUJ1afp8DKs + EumIPk0zTyes/2WgrDOD4/j0wGfhkallIv/fdE3X5XD113nX5tPx4g== + -----END AGE ENCRYPTED FILE----- + recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl + lastmodified: "2026-10-21T15:36:21Z" + mac: ENC[AES256_GCM,data:6X3jGfrWA1jZexwmABzYiM1zayYeY+SvLXABVTHpoxxS+nMlIk63f+kG9WawcUJlXe1OoUau5PTNTDgOHAqx0ADqS2hImr74SXR/6HOoisB3l3R/jEUOLUYAW+AsgPeMba0h/3I7KkHVxbJjNkWt4znm2M1kmCF4r30sUm1FL8w=,iv:RTtObsxYvBZpY2UgSgk3X+Y3m17hG1qQzsrucmO0azo=,tag:oc33OTwCqknLAmlBYBktOw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3 diff --git a/secrets/work-ssh-key.yaml b/secrets/work-ssh-key.yaml new file mode 100644 index 0000000..8dbf0a9 --- /dev/null +++ b/secrets/work-ssh-key.yaml @@ -0,0 +1,17 @@ +work_ssh_key_rsa: ENC[AES256_GCM,data:0fs+x0gDnj3rQ68fzQT1npIKTyBRSIbqGWDkzFXI+un/9PKb3HoffpNEPvGnjC+XqG0gnA/0WQbbGyN8xN+eJPmDKYodVh1v5RfumM96FLazgolaY/esi3zlFKHRCEEtJRNcGi7YQKrr5k4vpt1cyMFYrcpPcWnq1P4TIdQXfGyTmlaQfMowAE1FQHfKt/6p2fnTHcgIeLnrSeJVWKc5v1yzWGULHsbUXVP4z/1YPNWeCtUosb5Hf3FGLXy4KHKW+Zt8aX8gGf6KG/CWBhHVxfyqNSP+EkHJjpYzngVQpqP27LniltQn4tIikU0OJsGBhUlRmRJHryy+hmQyXxxP93rh/wD4xlw0x0jQJ8w1r1VMPvgnk7HPGzEYwvgblFDHlfwgQI/FtMtvz/PuXzXHZeLSteCBKphB6JaaOqlMuggrb6rBnaomoSUTbICTefumjH2V4KNOB++xUfOk8h8NJzvGeEznBKcKtuz8kRVwaplaSdgOy2cDRT+UGaTfj3yFK8zQkKAdCsortkgetPhwoB9XeHaOCULh9Iu0GsikxJ/vJA6rhR5S3zVARdNGHV+M4IbKVrbMT1Y+WCykeSZdU+1ONQAONkSctMNmVUDXfuOJ3P6O7ZA997UO/PydDuJtb7IUoDqkme8Rg5Vw0MdhSxHbpzxPfF8aGfO5pzduVQld61qdYQI3H+aj5SIFpijoppCFB9xqq0btKhOOy7yHLOU75TsDkxbaG6mzdeFIrOBC+ynWMmyBYXMIhWoxUWqEfWozSRXLuBHxle0s4bYUcAs078kdrCi5qaYuOV+DmRtSmNgWXuiMxwzHHDq6MQG584sixOijAJIIvDFk4aBkr/8tW+o1rDLmvYgxdZnixbImDy/LOqmmM7HkIUduAHonw0/gYQ4Vpj1wE+ep9EsYiZIp1SJSxVGCREgDxtow1i3oPLjFySHkhZX6BhNQVuRFgNyfmi5HUaU3NxXATsc2g4qT49NfvgGrO81UjYh2AZRlDThI1mZ6+SjOZWYD8d7d14G6kaye0CgOAjbFr1lKzkUsdFF2/2kSoelZ6rJ054j+QjdX2hYLHWj9nzDnYY54Aw74Hhaf0jfUsz/nz/do+gQ56HfkwGY+ClVwz7I87QNWIgYGuF9jflpceEB6O9n+ga0+u+ohrV4MT7LhCnJCmW+t5MHdKnup/DYuXZb+VvigcUrJgKb8fglNkL7dCjnUoz07aBlHAWA0wehgZP0TQG7eSwOs3UdZ0wEG2HL8SiRjB6XtfVaelERiFtdf4+W++txezZfmCwyiTntS/ItF6i6DAB0ZxDMo0d97eHa4tO7V73dD4/Iq1kUKB5cjvbcxPtbp1ROfx6c1wj/XbHEvnOxHCTGzlkRCACR2ZevT1sHzjLTz/92amJd7BJ6x0KHt718NQxezBXgvIQqb29SXqAThZGMp1Jv33CrJRvVMyPTwvMq8+OViDF+cFHJSGJ2CQZ0tjGe3bUP3/LtGFXBN0bYUGF7r8IkFg3vp/YJpu2avuuOY41OuJkZ+XfDtK0NwCUmuBbjNLUjFG+lTkrnd+n1VbYuIUVlgWyXpbX0uppmRurLItpOBvbcQTNL7v6bSElkU+PsTUiOPJhZoR+GiMpZRLnPbSe+MzwI4kKmu+HSdLIYLyv1AXKyGcb3GMG7FZr1pSY3vm73R7UvEgv4jmT8RnKF8lidelv1g4LapcTrrtHimbInD5DGJnygKLYU0coQ0woz73xy/GsDp6emKKolpvZyOBjApovpMEmdWvEz73TeACDh8VB4Vra72VjuNPGF39pcO7yZ0I11eCCDk145CCfmRxVxfZTIIOHl6whPC1Lz+CCsK7h/2dE5bdPkc86f28AEeAVL5zFYz1KqyhyOM7lx+EAAnUVXOpUBMyCHbSbKbUUzmr7cZ56xB47fgphaKrFYRqNvID+25WCxUa/n5PTj95LoMc9QYd4BrY7cQMZBDANmzBLYN23j7qA3TFVzOasQa8iRce4s1v4KcKiKTwpQ3317T1Z26+vcluEPXKHoKXJw341EbwkrWxSIX90fbYBhYTTU1Wc5/lpmME+9WMILy6OKgK41xhIu6+hGvHGLIOn7uL34smGKuSu+6z1MYT+c6/+GrbwKo5Wiw4YZeJ1uHAxYbyGr5qOP6zzkTG/aKiZJTrS6sAMipomyj//ty+YuSp0frRQ2MACNIeXQK3qSHlZQgHPeEfS3X4OINqB1IvmY7CiprtJj5P69gux0PgnCnXqkP5Hm4QmlirDbtZRMaVhllgWKxVmZf+7V4Lakuw9q//QIhQZ5Uhu+PtTcAfckPrFZKxoDXlnfbF+oxr4MSWZNK0UFZSvlvLPN08nu85W7gPyqKGSRekbkloJZ0PQi0Z0VzsH5SlMKbUaqftenh6UN+vVSZUDVqu11wXtl+fFqbr6jQWiIteXf23CNwCtSBcHwvq07izwxmzHJS8OCyZZNTA6RVg8oaZNmcGp+K+8K6nRibgHCvmP0p4A54p9jNdypmL3EbtjGMTivmtlfoffaq6z3cYOhyMqKeAaoTOxKM7bVYK+CoaFfIpCqzP+2B2tMX1AZnEqe6S7hdAHqndfgpY23KwVPqxTEK7Xe4m2HLt5fTvNs50zilBbkrpP62OyH0K7MDcA18ECltKWu+w2SqI4Z4jxULcawmeO3XxT1ocowJNK4LgejTqjFUkjsc0Eds4wF21UDRIHR2scMfP+5wZZhZTMJl4aeOT0HECKLfLi1mqwbo3TVviGjxjNSMIVJ18d79Gvupi4f3BpdrQcXR+VIdR9+mYbK4zR68S2ka/lN5+m6g7N06oh+xRAPSruRdfolqgI9EfPRvV1y2m9J6u3koWTN1q8EzIxAoT8z9I3qEV1x2YCAziXnaZ/cHcO83hoGsjwCrw7C9vcftLhpebJPH94oddTE9+S4DLL80XFRFaeudGSxOXzysv+eILp6xR61Riqx9o7FzmKtLFRnZWckJXn51zfJvHyZlMiJyqAS/4POT5acQq5SVzg+0PhHSRjx+XFaqBIvouTMwUyHPVGyOowrQcWUtMd6MPg1WHigdVT0JtzGTbUtqYfxQa7kWbvlxW/UsUuHfS5ZR7FSpVlsyRxCzrow+a7R9n3z6DUo+obtl0p5ya4ujIu9oCwuk/iAth11orES19WRdh3t9pgRlhrM12nCgRjimAhDkxtXqBtiBxOjJEOxCeS0MXqp/+65xf09pUxiSt2Lpp5SPSAp8JqUJcmYy+d/DXSEqLxetVhk1KolA2ItH33a3gw==,iv:THOxkQwaN/kdzH0CclqsImu7L1pFE4zSp/tMmenaAdw=,tag:qhGNi++VEEW7X5axFvpVVg==,type:str] +work_ssh_key_rsa_pub: ENC[AES256_GCM,data:/WkultfyCTL8un1/AbCZvJDqhnsYqir0CN1NNRt3IX+o7xEBWJPdElysSW1Y6EC6GQZym0apgRVE/uiaG6Sjhczcgan5VN6TUk8s3aJZCwICtE7npRKV11q7D/HukzpAj8a2BnB0O0SLjGeIAfhOjSBfVmpWScoIGpHhU7XgAMvm5x8lcaX/Gi0F8lHlF+zigW/R4oR8q7XuGGrFXUZmHraK713IpJBDsUAiYRh34wu0T3Z8PqMAJUPRUvGYHMa3ouEBc5RoVxuK4z2hFS5tWMZBgCQCMt4eVQcIwgc3FROw66iDFYkRnhXXUm2YBoULMHiLFU2LoULiI6i7RK3Aqr+dyL//FCPjxZLluP7ujlqX+GEaiHVZNAg+OvM8Je8XuUufyVYw5nbUvklU4lQd8m9U3yYdMK1GExQ0cgS2CGTGf364bWOLb+dPkeuh93kE+dfsW8r3FcQOwcN/X4F3alFt+dD1eiW7cndD7Pd/RQ7907MarzZ9H2AyAJhq8xcP8MqK7p8CLM5+cvgeb+XACWoCh12NuV8eBkWniK412b0yddj2DBIgCgJTvZXsUk8tb6vOuIdvh4qoVTd7ROyfr86eTjKFtiZTFtt7vUMU81N2ywyn4Iq9DYBqEijuYCqo/vBxMGSEHU1Rawh064ApyznUV16obHzx6DnydNQewGGEUeWC6ad/USlEMXUR7pm9Ou/ulY0TyB9Jvb8oNxCOcqjM/QK9r6dgfA==,iv:BTpI5ez+Xppmfe/FwXupyaOWpi2Xbg/DXl6KBP9cQVc=,tag:hwfWHZs817tEfpNgx8fBSw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArS1lHNXg0RXZtUDNqVVFN + eUQ2R3hQZHpualNvR0szdWw3ZE1EOE5ERlFZCkIzdnhrdWpVelBvQU9ZKytqZU83 + SUpVbzZqRklJUW5vMmRVSml4WFF6SVUKLS0tIGY5Vnh6aUV0cm5Gc3ZzclU5M21W + U1MxUksxNExCanVIdFg1TWM2VjF2RkkKhAAaUkUU8yibX/IWsHEqUpj8YXF5788o + BnICIf71oGouFzEUOFvUk1kRrnGvtzLCk5yb63Cta6wwRsF2svnWcw== + -----END AGE ENCRYPTED FILE----- + recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl + lastmodified: "2026-10-21T16:12:16Z" + mac: ENC[AES256_GCM,data:7voI9O3u5v1z4u24NOPjKfS5RYhZFG80rL5NJ/ynr/5k9EZpWI1bhfLT61ZVJFXZnPij6WZGRn+LZl4/ReS7bKTp15gicrUGgjnNAEe/iRYbPUUsCpSi/tbGNebPr1P/Z/D78gzTnPZdx7ulbgRtGfByVWRL3Nx4yXaIrDd9T4s=,iv:CQaoW0J8XdCzSgjV6iRlxtE0mwhl/zIebWUNs3OouSQ=,tag:HOfuYMT1tfQYKJj+m34lKw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3