refactor: transition secrets to sops-nix instead of relying on hard-coded paths

This commit is contained in:
2026-10-21 12:40:01 -04:00
parent 36aa9a054e
commit 2167861451
9 changed files with 125 additions and 18 deletions
+8
View File
@@ -0,0 +1,8 @@
keys:
- &personal_age_key age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
creation_rules:
- path_regex: "secrets/.*\\.yaml$"
key_groups:
- age:
- *personal_age_key
+52 -1
View File
@@ -1,5 +1,56 @@
{ pkgs, ... }:
{ pkgs, config, ... }:
{
sops = {
defaultSopsFile = ../.sops.yaml;
age = {
sshKeyPaths = [ ];
keyFile = "/persist/sops/age/keys.txt";
};
secrets = {
"password_hash" = {
sopsFile = ../secrets/password-hash.yaml;
owner = "root";
group = "root";
mode = "0400";
neededForUsers = true;
};
"personal_ssh_key_ed25519" = {
sopsFile = ../secrets/personal-ssh-key.yaml;
key = "personal_ssh_key_ed25519";
owner = config.users.users.frank.name;
group = config.users.users.frank.group;
mode = "0400";
};
"personal_ssh_key_ed25519.pub" = {
sopsFile = ../secrets/personal-ssh-key.yaml;
key = "personal_ssh_key_ed25519_pub";
owner = config.users.users.frank.name;
group = config.users.users.frank.group;
mode = "0644";
};
"work_ssh_key_rsa" = {
sopsFile = ../secrets/work-ssh-key.yaml;
key = "work_ssh_key_rsa";
owner = config.users.users.frank.name;
group = config.users.users.frank.group;
mode = "0400";
};
"work_ssh_key_rsa.pub" = {
sopsFile = ../secrets/work-ssh-key.yaml;
key = "work_ssh_key_rsa_pub";
owner = config.users.users.frank.name;
group = config.users.users.frank.group;
mode = "0644";
};
};
};
environment.systemPackages = with pkgs; [
sops
age
+11 -13
View File
@@ -1,7 +1,9 @@
{ inputs, pkgs, ... }:
let
sshSigningKey = builtins.readFile ./ssh-signing-key.pub;
in
{
inputs,
osConfig,
pkgs,
...
}:
{
imports = [
inputs.lazyvim.homeManagerModules.default
@@ -51,17 +53,12 @@ in
bash = {
enable = true;
# Import SSH identities and
# display fastfetch on shell open.
initExtra = ''
eval "$(devenv hook bash)"
[ -f $HOME/.ssh/id_floturcocantsee@daguerro.net ] && ssh-add $HOME/.ssh/id_floturcocantsee@daguerro.net
[ -f $HOME/.ssh/id_rsa ] && ssh-add $HOME/.ssh/id_rsa
clear;fastfetch
'';
};
# Configure ZSH if using darwin (macOS).
zsh =
if pkgs.stdenv.hostPlatform.isDarwin then
{
@@ -69,8 +66,6 @@ in
initContent = ''
eval "$(devenv hook zsh)"
[ -f $HOME/.ssh/id_floturcocantsee@daguerro.net ] && ssh-add --apple-use-keychain $HOME/.ssh/id_floturcocantsee@daguerro.net
[ -f $HOME/.ssh/id_rsa ] && --apple-use-keychain ssh-add $HOME/.ssh/id_rsa
clear;fastfetch
'';
}
@@ -111,7 +106,10 @@ in
enableDefaultConfig = false;
settings."*" = {
AddKeysToAgent = "yes";
IdentityFile = [
osConfig.sops.secrets."personal_ssh_key_ed25519".path
osConfig.sops.secrets."work_ssh_key_rsa".path
];
};
};
@@ -167,7 +165,7 @@ in
lfs.enable = true;
signing = {
key = sshSigningKey;
key = osConfig.sops.secrets."personal_ssh_key_ed25519.pub".path;
signByDefault = true;
};
-1
View File
@@ -1 +0,0 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ5+RJOhvamBpEptCRv90E+8bVWKn6Mep61wDpPYgKP3 floturcocantsee@daguerro.net
+2 -1
View File
@@ -1,4 +1,5 @@
{
config,
pkgs,
lib,
inputs,
@@ -151,7 +152,6 @@
security.rtkit.enable = true;
programs = {
ssh.startAgent = true;
firefox.enable = true;
gnupg.agent = {
@@ -168,6 +168,7 @@
users.users.frank = {
isNormalUser = true;
description = "Frank LoTurco";
hashedPassword = config.sops.secrets.password_hash.path;
extraGroups = [
"networkmanager"
+2 -2
View File
@@ -1,4 +1,5 @@
{
config,
pkgs,
...
}:
@@ -72,11 +73,10 @@
};
};
programs.ssh.startAgent = true;
users.users.frank = {
isNormalUser = true;
description = "Frank LoTurco";
hashedPassword = config.sops.secrets.password_hash.path;
extraGroups = [
"wheel"
+16
View File
@@ -0,0 +1,16 @@
password_hash: ENC[AES256_GCM,data:ErID6NBUyznC7N+OMWWoArHPjcnZtphTkuDIfz4zI69TVJ7vudBoR8hz8lMq0jNzOq+rxkourkk3xm5J3mFyVUxOMJe0Vz2tlA==,iv:tCGHD8n6Y0lmvnpmQkf952VNQ42BkWjsiDhgzcls2ig=,tag:7tfLXfhFF9/qCzaDT1BEXA==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwazNKVjhNQjdVRVY5RG5p
cG5ETWwvbXZHZENpYWRORG1JZi9lclQvVmxnClByNjZtUFBkWjFCbDZ3TnJnWnVD
Yjc1Rkk4RWRZenhNS1dzcGlkNnFDV0UKLS0tIHEvSmgrMlBMb2tyK2hzeUVIQzZx
VTFua05vZFFQV0dzSjczKytBdHl0dDAKS9D3rRLy6F9rvUhOr0KYDhvNvRvn3W82
lCwkwtsXd2L2sPXKEfVd1r+dUaKDkXcLUXVbada7ma6UDLOmAq7Kqw==
-----END AGE ENCRYPTED FILE-----
recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
lastmodified: "2026-10-21T14:34:25Z"
mac: ENC[AES256_GCM,data:QuRO9S3rK6dDIGUsgTHzNcypCMeR1AkATwVARv7Na1p6/n2S+5HLuGLkoSDWMnB15r+9GYrYaxDs9b4ppApCfbENrH1ffO7ZyhbY+NfbCgNTq/KgxZvbtAoQiwYalD97MNiZ2OBhmmVEe4ne5Fy1WY7g5uYnwYd7hIK+Vr/iCNE=,iv:rSho67a/+rZjb7iw47IXwKnqONc4tk5lbJBZDmrj9U8=,tag:tYWB4Xiv+oCKadn0IIIy1A==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.3
+17
View File
@@ -0,0 +1,17 @@
personal_ssh_key_ed25519: ENC[AES256_GCM,data:57BaRc+Tkc/kdpLA8U/Qcydpo69FSP5kqAaqAsa7WaFGhPvrwiU4wrChP82nJb4Ilu4QLBphKRmKOFl7wlG3asvyyLhQ19JIeqdTq/lmByfdnGxv5Bugn58Oqj+f1uY5TQrLLf2QsVXwfgc2LgDGaMXzZdaobYOcgNwaRy6W0CWpGJRjUZgtwZRRnm6RApUaUsWjaN5n5NKcT1NlQNVVItRJiO86UUnv4PJcvZYw9ll5RrWEVgPXkljOq1BaKNhdwD1DEPJT0qYDK1N+Wypl/CGXL/Q1F/zKjwKf7VnGdHpXcef/BCG2fWI7fY0RQDEu5oKgVt4wtcPVRp4jbPpbW7OEUWW0BlcPqpteWXVmcl9U6s6E6RnbnSO/Gw4TppFXGnFvT/LsmlyLUeIFAtRb/278QgWzMfcjFeo+l6GK4i/8m4VU9pHQufsnEiF5KKESFQTk/r7waCBs3qe3PAkAg3M8tRkO1Q5E/8RLXwqZMD7LqAvuwraViJGYwWvlWVRsArBnv1n8sEKBlRlbpE6GShrgt3bAIKqoW3U/fxDdL3NCBYQ=,iv:/oeGYRtBWjD3pq/X/Sab+UVzIAVxE8QvvkTmb/45UO8=,tag:3kIbuY2UPbw1L7EH2++kaA==,type:str]
personal_ssh_key_ed25519_pub: ENC[AES256_GCM,data:zz/LBq5KI2t/z3YgP3gHK3B/c2O/jq6sQ8mT5qgoUGsL5VTvREUGnDaDxtaOcbez59srqmlQHwXbQ7Dax6iWEtWx4gtMhJ9piVzH/3skB0dMZ3W+7bNtCev1SkHchbWLUPD/ryXZ4LCAipMoJA==,iv:qD07xcOdZDokhKIVqS5ibWsEKG66eYy1JnBUzzlPoS4=,tag:732RVmwKJL2PlcJih+2PGQ==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1SFRTZFU3bzM5UE82Uk5p
UENKUFd5R1lIOW43YnBTcXlSWHBFUHlRYURRCkFGZTM5MFlnd2hKRUpRM2hRdy9o
dHlzbU9Xbm9YVENuSVR5Qi9JdEFIZk0KLS0tIDJ4SDNKZE41eGtPa2UrVDBTZFVv
VWsvQkc1bU1ObHBBUVd3ZXJBQjB1UE0KRgd4k0kRo15tsDOvv/VRTXUJ1afp8DKs
EumIPk0zTyes/2WgrDOD4/j0wGfhkallIv/fdE3X5XD113nX5tPx4g==
-----END AGE ENCRYPTED FILE-----
recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
lastmodified: "2026-10-21T15:36:21Z"
mac: ENC[AES256_GCM,data:6X3jGfrWA1jZexwmABzYiM1zayYeY+SvLXABVTHpoxxS+nMlIk63f+kG9WawcUJlXe1OoUau5PTNTDgOHAqx0ADqS2hImr74SXR/6HOoisB3l3R/jEUOLUYAW+AsgPeMba0h/3I7KkHVxbJjNkWt4znm2M1kmCF4r30sUm1FL8w=,iv:RTtObsxYvBZpY2UgSgk3X+Y3m17hG1qQzsrucmO0azo=,tag:oc33OTwCqknLAmlBYBktOw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.3
+17
View File
@@ -0,0 +1,17 @@
work_ssh_key_rsa: ENC[AES256_GCM,data:0fs+x0gDnj3rQ68fzQT1npIKTyBRSIbqGWDkzFXI+un/9PKb3HoffpNEPvGnjC+XqG0gnA/0WQbbGyN8xN+eJPmDKYodVh1v5RfumM96FLazgolaY/esi3zlFKHRCEEtJRNcGi7YQKrr5k4vpt1cyMFYrcpPcWnq1P4TIdQXfGyTmlaQfMowAE1FQHfKt/6p2fnTHcgIeLnrSeJVWKc5v1yzWGULHsbUXVP4z/1YPNWeCtUosb5Hf3FGLXy4KHKW+Zt8aX8gGf6KG/CWBhHVxfyqNSP+EkHJjpYzngVQpqP27LniltQn4tIikU0OJsGBhUlRmRJHryy+hmQyXxxP93rh/wD4xlw0x0jQJ8w1r1VMPvgnk7HPGzEYwvgblFDHlfwgQI/FtMtvz/PuXzXHZeLSteCBKphB6JaaOqlMuggrb6rBnaomoSUTbICTefumjH2V4KNOB++xUfOk8h8NJzvGeEznBKcKtuz8kRVwaplaSdgOy2cDRT+UGaTfj3yFK8zQkKAdCsortkgetPhwoB9XeHaOCULh9Iu0GsikxJ/vJA6rhR5S3zVARdNGHV+M4IbKVrbMT1Y+WCykeSZdU+1ONQAONkSctMNmVUDXfuOJ3P6O7ZA997UO/PydDuJtb7IUoDqkme8Rg5Vw0MdhSxHbpzxPfF8aGfO5pzduVQld61qdYQI3H+aj5SIFpijoppCFB9xqq0btKhOOy7yHLOU75TsDkxbaG6mzdeFIrOBC+ynWMmyBYXMIhWoxUWqEfWozSRXLuBHxle0s4bYUcAs078kdrCi5qaYuOV+DmRtSmNgWXuiMxwzHHDq6MQG584sixOijAJIIvDFk4aBkr/8tW+o1rDLmvYgxdZnixbImDy/LOqmmM7HkIUduAHonw0/gYQ4Vpj1wE+ep9EsYiZIp1SJSxVGCREgDxtow1i3oPLjFySHkhZX6BhNQVuRFgNyfmi5HUaU3NxXATsc2g4qT49NfvgGrO81UjYh2AZRlDThI1mZ6+SjOZWYD8d7d14G6kaye0CgOAjbFr1lKzkUsdFF2/2kSoelZ6rJ054j+QjdX2hYLHWj9nzDnYY54Aw74Hhaf0jfUsz/nz/do+gQ56HfkwGY+ClVwz7I87QNWIgYGuF9jflpceEB6O9n+ga0+u+ohrV4MT7LhCnJCmW+t5MHdKnup/DYuXZb+VvigcUrJgKb8fglNkL7dCjnUoz07aBlHAWA0wehgZP0TQG7eSwOs3UdZ0wEG2HL8SiRjB6XtfVaelERiFtdf4+W++txezZfmCwyiTntS/ItF6i6DAB0ZxDMo0d97eHa4tO7V73dD4/Iq1kUKB5cjvbcxPtbp1ROfx6c1wj/XbHEvnOxHCTGzlkRCACR2ZevT1sHzjLTz/92amJd7BJ6x0KHt718NQxezBXgvIQqb29SXqAThZGMp1Jv33CrJRvVMyPTwvMq8+OViDF+cFHJSGJ2CQZ0tjGe3bUP3/LtGFXBN0bYUGF7r8IkFg3vp/YJpu2avuuOY41OuJkZ+XfDtK0NwCUmuBbjNLUjFG+lTkrnd+n1VbYuIUVlgWyXpbX0uppmRurLItpOBvbcQTNL7v6bSElkU+PsTUiOPJhZoR+GiMpZRLnPbSe+MzwI4kKmu+HSdLIYLyv1AXKyGcb3GMG7FZr1pSY3vm73R7UvEgv4jmT8RnKF8lidelv1g4LapcTrrtHimbInD5DGJnygKLYU0coQ0woz73xy/GsDp6emKKolpvZyOBjApovpMEmdWvEz73TeACDh8VB4Vra72VjuNPGF39pcO7yZ0I11eCCDk145CCfmRxVxfZTIIOHl6whPC1Lz+CCsK7h/2dE5bdPkc86f28AEeAVL5zFYz1KqyhyOM7lx+EAAnUVXOpUBMyCHbSbKbUUzmr7cZ56xB47fgphaKrFYRqNvID+25WCxUa/n5PTj95LoMc9QYd4BrY7cQMZBDANmzBLYN23j7qA3TFVzOasQa8iRce4s1v4KcKiKTwpQ3317T1Z26+vcluEPXKHoKXJw341EbwkrWxSIX90fbYBhYTTU1Wc5/lpmME+9WMILy6OKgK41xhIu6+hGvHGLIOn7uL34smGKuSu+6z1MYT+c6/+GrbwKo5Wiw4YZeJ1uHAxYbyGr5qOP6zzkTG/aKiZJTrS6sAMipomyj//ty+YuSp0frRQ2MACNIeXQK3qSHlZQgHPeEfS3X4OINqB1IvmY7CiprtJj5P69gux0PgnCnXqkP5Hm4QmlirDbtZRMaVhllgWKxVmZf+7V4Lakuw9q//QIhQZ5Uhu+PtTcAfckPrFZKxoDXlnfbF+oxr4MSWZNK0UFZSvlvLPN08nu85W7gPyqKGSRekbkloJZ0PQi0Z0VzsH5SlMKbUaqftenh6UN+vVSZUDVqu11wXtl+fFqbr6jQWiIteXf23CNwCtSBcHwvq07izwxmzHJS8OCyZZNTA6RVg8oaZNmcGp+K+8K6nRibgHCvmP0p4A54p9jNdypmL3EbtjGMTivmtlfoffaq6z3cYOhyMqKeAaoTOxKM7bVYK+CoaFfIpCqzP+2B2tMX1AZnEqe6S7hdAHqndfgpY23KwVPqxTEK7Xe4m2HLt5fTvNs50zilBbkrpP62OyH0K7MDcA18ECltKWu+w2SqI4Z4jxULcawmeO3XxT1ocowJNK4LgejTqjFUkjsc0Eds4wF21UDRIHR2scMfP+5wZZhZTMJl4aeOT0HECKLfLi1mqwbo3TVviGjxjNSMIVJ18d79Gvupi4f3BpdrQcXR+VIdR9+mYbK4zR68S2ka/lN5+m6g7N06oh+xRAPSruRdfolqgI9EfPRvV1y2m9J6u3koWTN1q8EzIxAoT8z9I3qEV1x2YCAziXnaZ/cHcO83hoGsjwCrw7C9vcftLhpebJPH94oddTE9+S4DLL80XFRFaeudGSxOXzysv+eILp6xR61Riqx9o7FzmKtLFRnZWckJXn51zfJvHyZlMiJyqAS/4POT5acQq5SVzg+0PhHSRjx+XFaqBIvouTMwUyHPVGyOowrQcWUtMd6MPg1WHigdVT0JtzGTbUtqYfxQa7kWbvlxW/UsUuHfS5ZR7FSpVlsyRxCzrow+a7R9n3z6DUo+obtl0p5ya4ujIu9oCwuk/iAth11orES19WRdh3t9pgRlhrM12nCgRjimAhDkxtXqBtiBxOjJEOxCeS0MXqp/+65xf09pUxiSt2Lpp5SPSAp8JqUJcmYy+d/DXSEqLxetVhk1KolA2ItH33a3gw==,iv:THOxkQwaN/kdzH0CclqsImu7L1pFE4zSp/tMmenaAdw=,tag:qhGNi++VEEW7X5axFvpVVg==,type:str]
work_ssh_key_rsa_pub: ENC[AES256_GCM,data:/WkultfyCTL8un1/AbCZvJDqhnsYqir0CN1NNRt3IX+o7xEBWJPdElysSW1Y6EC6GQZym0apgRVE/uiaG6Sjhczcgan5VN6TUk8s3aJZCwICtE7npRKV11q7D/HukzpAj8a2BnB0O0SLjGeIAfhOjSBfVmpWScoIGpHhU7XgAMvm5x8lcaX/Gi0F8lHlF+zigW/R4oR8q7XuGGrFXUZmHraK713IpJBDsUAiYRh34wu0T3Z8PqMAJUPRUvGYHMa3ouEBc5RoVxuK4z2hFS5tWMZBgCQCMt4eVQcIwgc3FROw66iDFYkRnhXXUm2YBoULMHiLFU2LoULiI6i7RK3Aqr+dyL//FCPjxZLluP7ujlqX+GEaiHVZNAg+OvM8Je8XuUufyVYw5nbUvklU4lQd8m9U3yYdMK1GExQ0cgS2CGTGf364bWOLb+dPkeuh93kE+dfsW8r3FcQOwcN/X4F3alFt+dD1eiW7cndD7Pd/RQ7907MarzZ9H2AyAJhq8xcP8MqK7p8CLM5+cvgeb+XACWoCh12NuV8eBkWniK412b0yddj2DBIgCgJTvZXsUk8tb6vOuIdvh4qoVTd7ROyfr86eTjKFtiZTFtt7vUMU81N2ywyn4Iq9DYBqEijuYCqo/vBxMGSEHU1Rawh064ApyznUV16obHzx6DnydNQewGGEUeWC6ad/USlEMXUR7pm9Ou/ulY0TyB9Jvb8oNxCOcqjM/QK9r6dgfA==,iv:BTpI5ez+Xppmfe/FwXupyaOWpi2Xbg/DXl6KBP9cQVc=,tag:hwfWHZs817tEfpNgx8fBSw==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArS1lHNXg0RXZtUDNqVVFN
eUQ2R3hQZHpualNvR0szdWw3ZE1EOE5ERlFZCkIzdnhrdWpVelBvQU9ZKytqZU83
SUpVbzZqRklJUW5vMmRVSml4WFF6SVUKLS0tIGY5Vnh6aUV0cm5Gc3ZzclU5M21W
U1MxUksxNExCanVIdFg1TWM2VjF2RkkKhAAaUkUU8yibX/IWsHEqUpj8YXF5788o
BnICIf71oGouFzEUOFvUk1kRrnGvtzLCk5yb63Cta6wwRsF2svnWcw==
-----END AGE ENCRYPTED FILE-----
recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
lastmodified: "2026-10-21T16:12:16Z"
mac: ENC[AES256_GCM,data:7voI9O3u5v1z4u24NOPjKfS5RYhZFG80rL5NJ/ynr/5k9EZpWI1bhfLT61ZVJFXZnPij6WZGRn+LZl4/ReS7bKTp15gicrUGgjnNAEe/iRYbPUUsCpSi/tbGNebPr1P/Z/D78gzTnPZdx7ulbgRtGfByVWRL3Nx4yXaIrDd9T4s=,iv:CQaoW0J8XdCzSgjV6iRlxtE0mwhl/zIebWUNs3OouSQ=,tag:HOfuYMT1tfQYKJj+m34lKw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.3