refactor: transition secrets to sops-nix instead of relying on hard-coded paths

2026-10-21 12:40:01 -04:00
parent 36aa9a054e
commit 2167861451
9 changed files with 125 additions and 18 deletions
@@ -1,5 +1,56 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
+  sops = {
+    defaultSopsFile = ../.sops.yaml;
+
+    age = {
+      sshKeyPaths = [ ];
+      keyFile = "/persist/sops/age/keys.txt";
+    };
+
+    secrets = {
+      "password_hash" = {
+        sopsFile = ../secrets/password-hash.yaml;
+        owner = "root";
+        group = "root";
+        mode = "0400";
+        neededForUsers = true;
+      };
+
+      "personal_ssh_key_ed25519" = {
+        sopsFile = ../secrets/personal-ssh-key.yaml;
+        key = "personal_ssh_key_ed25519";
+        owner = config.users.users.frank.name;
+        group = config.users.users.frank.group;
+        mode = "0400";
+      };
+
+      "personal_ssh_key_ed25519.pub" = {
+        sopsFile = ../secrets/personal-ssh-key.yaml;
+        key = "personal_ssh_key_ed25519_pub";
+        owner = config.users.users.frank.name;
+        group = config.users.users.frank.group;
+        mode = "0644";
+      };
+
+      "work_ssh_key_rsa" = {
+        sopsFile = ../secrets/work-ssh-key.yaml;
+        key = "work_ssh_key_rsa";
+        owner = config.users.users.frank.name;
+        group = config.users.users.frank.group;
+        mode = "0400";
+      };
+
+      "work_ssh_key_rsa.pub" = {
+        sopsFile = ../secrets/work-ssh-key.yaml;
+        key = "work_ssh_key_rsa_pub";
+        owner = config.users.users.frank.name;
+        group = config.users.users.frank.group;
+        mode = "0644";
+      };
+    };
+  };
+
  environment.systemPackages = with pkgs; [
    sops
    age