From 4034a6d81da69a8ce843feccd5e66245c2924e28 Mon Sep 17 00:00:00 2001 From: OlivierChiasson Date: Sat, 20 Jun 2026 16:52:08 -0300 Subject: [PATCH] Add git-crypt support and update Sops configuration for multiple hosts - Introduced a new secrets file for git-crypt personal documents. - Updated .sops.yaml to include new key groups for host-specific secrets. - Configured Sops settings in client-services.nix for managing secrets. - Removed redundant Sops configurations from multiple host configurations (14900k, ideapad, t2mbp, uConsole) to streamline secret management. - Added git-crypt to desktop-home-base package list. --- .sops.yaml | 8 ++++++ modules/hosts/14900k/configuration.nix | 20 +-------------- modules/hosts/client-services.nix | 26 ++++++++++++++++++++ modules/hosts/desktop-home-base.nix | 3 +++ modules/hosts/ideapad/configuration.nix | 20 --------------- modules/hosts/t2mbp/configuration.nix | 19 --------------- modules/hosts/uConsole/configuration.nix | 18 -------------- modules/system/users/catalog-default.nix | 17 ++++++++++--- secrets/gitcrypt-personal-docs-key | 31 ++++++++++++++++++++++++ 9 files changed, 82 insertions(+), 80 deletions(-) create mode 100644 secrets/gitcrypt-personal-docs-key diff --git a/.sops.yaml b/.sops.yaml index f4d13f9..8c6348d 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -17,6 +17,14 @@ creation_rules: - *host_ideapad - *host_nix-server - *host_r5500 + - path_regex: secrets/gitcrypt-personal-docs-key$ + key_groups: + - age: + - *primary + - *host_14900k + - *host_uConsole + - *host_t2mbp + - *host_ideapad # Host secrets at modules/hosts/nix-server/secrets.yaml (see configuration imports), # or optional extra files under _secrets/. - path_regex: modules/hosts/nix-server/(secrets\.(yaml|json|env|ini)|_secrets/.*\.(yaml|json|env|ini))$ diff --git a/modules/hosts/14900k/configuration.nix b/modules/hosts/14900k/configuration.nix index d834e9f..b62e283 100644 --- a/modules/hosts/14900k/configuration.nix +++ b/modules/hosts/14900k/configuration.nix @@ -24,25 +24,7 @@ ./_private/moonfin-flatpak.nix ]; - sops = { - defaultSopsFile = ../../../secrets/secrets.yaml; - defaultSopsFormat = "yaml"; - age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - }; - - sops.secrets."caching/attic/token" = { - owner = "olivier"; - group = "users"; - mode = "0400"; - }; - - sops.secrets."users/olivier/hashedPassword".neededForUsers = true; - sops.secrets."swiftshare/API_KEY" = { - owner = "olivier"; - group = "users"; - mode = "0400"; - }; -services.cloudflare-warp.enable = true; + services.cloudflare-warp.enable = true; # Intel iGPU video acceleration (VA-API / QSV via oneVPL). # This fixes common NixOS issues like `vaInitialize failed` and missing QSV encoders in apps. diff --git a/modules/hosts/client-services.nix b/modules/hosts/client-services.nix index 70e35a4..0c0e12e 100644 --- a/modules/hosts/client-services.nix +++ b/modules/hosts/client-services.nix @@ -23,5 +23,31 @@ services.printing.enable = true; security.polkit.enable = true; services.udisks2.enable = true; + + sops = { + defaultSopsFile = ../../secrets/secrets.yaml; + defaultSopsFormat = "yaml"; + age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + }; + + sops.secrets."caching/attic/token" = { + owner = "olivier"; + group = "users"; + mode = "0400"; + }; + + sops.secrets."swiftshare/API_KEY" = { + owner = "olivier"; + group = "users"; + mode = "0400"; + }; + + sops.secrets."gitcrypt/personal-docs-key" = { + sopsFile = ../../secrets/gitcrypt-personal-docs-key; + format = "binary"; + owner = "olivier"; + group = "users"; + mode = "0400"; + }; }; } diff --git a/modules/hosts/desktop-home-base.nix b/modules/hosts/desktop-home-base.nix index ba42939..d577743 100644 --- a/modules/hosts/desktop-home-base.nix +++ b/modules/hosts/desktop-home-base.nix @@ -24,6 +24,9 @@ }; }; + #TODO[epic=Moderate] Check if git-crypt should belong in desktop-home-base. + home.packages = [ pkgs.git-crypt ]; + chiasson.home = { # Catalog of `chiasson.home.*` toggles — host `home.nix` sets `enable = true` to override `mkDefault false`. shell = { diff --git a/modules/hosts/ideapad/configuration.nix b/modules/hosts/ideapad/configuration.nix index e2c67fe..cc45dff 100644 --- a/modules/hosts/ideapad/configuration.nix +++ b/modules/hosts/ideapad/configuration.nix @@ -37,26 +37,6 @@ ./_private/platform.nix ]; - # ─────────────────────── Sops ─────────────────────── - # `host_ideapad` recipient in `.sops.yaml` derives from the new ed25519 host key (post-reflash). - sops = { - defaultSopsFile = ../../../secrets/secrets.yaml; - defaultSopsFormat = "yaml"; - age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - }; - - sops.secrets."users/olivier/hashedPassword".neededForUsers = true; - sops.secrets."caching/attic/token" = { - owner = "olivier"; - group = "users"; - mode = "0400"; - }; - sops.secrets."swiftshare/API_KEY" = { - owner = "olivier"; - group = "users"; - mode = "0400"; - }; - # ─────────────────────── Mobile NixOS / firmware ─────────────────────── # mruby's test-suite breaks on aarch64 in the Nix sandbox; the overlay strips checks and # rebuilds Mobile NixOS' script-loader against the patched mruby. diff --git a/modules/hosts/t2mbp/configuration.nix b/modules/hosts/t2mbp/configuration.nix index 7f08250..b46008a 100644 --- a/modules/hosts/t2mbp/configuration.nix +++ b/modules/hosts/t2mbp/configuration.nix @@ -19,25 +19,6 @@ ./_private/firmware.nix ]; - # ───────────────────────────── Sops (see repo secrets/.sops.yaml) ─────────── - sops = { - defaultSopsFile = ../../../secrets/secrets.yaml; - defaultSopsFormat = "yaml"; - age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - }; - - sops.secrets."caching/attic/token" = { - owner = "olivier"; - group = "users"; - mode = "0400"; - }; - - sops.secrets."users/olivier/hashedPassword".neededForUsers = true; - sops.secrets."swiftshare/API_KEY" = { - owner = "olivier"; - group = "users"; - mode = "0400"; - }; sops.secrets."tailscale/auth-key" = { mode = "0400"; }; diff --git a/modules/hosts/uConsole/configuration.nix b/modules/hosts/uConsole/configuration.nix index 4ef0cd4..22ad0ee 100644 --- a/modules/hosts/uConsole/configuration.nix +++ b/modules/hosts/uConsole/configuration.nix @@ -42,24 +42,6 @@ require-sigs = false; }; - sops = { - defaultSopsFile = ../../../secrets/secrets.yaml; - defaultSopsFormat = "yaml"; - age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - }; - - sops.secrets."users/olivier/hashedPassword".neededForUsers = true; - sops.secrets."caching/attic/token" = { - owner = "olivier"; - group = "users"; - mode = "0400"; - }; - sops.secrets."swiftshare/API_KEY" = { - owner = "olivier"; - group = "users"; - mode = "0400"; - }; - chiasson.system.librepods.enable = true; chiasson.system.palera1n.enable = true; diff --git a/modules/system/users/catalog-default.nix b/modules/system/users/catalog-default.nix index 40ae68d..c951324 100644 --- a/modules/system/users/catalog-default.nix +++ b/modules/system/users/catalog-default.nix @@ -2,8 +2,15 @@ # Module (not bare attrset) so catalog entries can use `config.*` for sops paths etc. { ... }: { flake.nixosModules.usersCatalogDefaults = - { config, ... }: + { config, lib, ... }: + let + olivierEnabled = lib.elem "olivier" config.chiasson.users.enabled; + in { + sops.secrets."users/olivier/hashedPassword" = lib.mkIf olivierEnabled { + neededForUsers = true; + }; + config.chiasson.users.catalog = { olivier = { isNormalUser = true; @@ -24,9 +31,11 @@ "input" ]; - # Host must set `sops.secrets."users/olivier/hashedPassword".neededForUsers = true`. - # With that, `.path` is under /run/secrets-for-users/… (sops-nix README). - hashedPasswordFile = config.sops.secrets."users/olivier/hashedPassword".path; + # Declared in this module when olivier is in `chiasson.users.enabled`. + # With `neededForUsers`, `.path` is under /run/secrets-for-users/… (sops-nix README). + hashedPasswordFile = lib.mkIf olivierEnabled ( + config.sops.secrets."users/olivier/hashedPassword".path + ); homeManager = { enable = true; diff --git a/secrets/gitcrypt-personal-docs-key b/secrets/gitcrypt-personal-docs-key new file mode 100644 index 0000000..00bccae --- /dev/null +++ b/secrets/gitcrypt-personal-docs-key @@ -0,0 +1,31 @@ +{ + "data": "ENC[AES256_GCM,data:Oz/nHP+4sv9NlVkZYorufEjlSwLWRtZdpHNXRz2+yBQmtRKUPdK+MHpgwdp350kWBX36Id7DztcY3uTYXPp+NSOQ+NYjngg8pkSK7JI3Avs89S5tmaFwj3L8ouDJpOpDX8djPmnYuoF9xp/ekAVGHJvQOfSeDlJkOb3wEDIEgmO+osYckb+FvWqyQiUWbbus13hkaqGSNFelu20OU1Y6F645NJ3oNUwgHg==,iv:izq1awBfohJNzRVuk5cyMAadAShxp8BmmYmS+QrdDkg=,tag:7+WHz+R4rabPlz4VQae97A==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOREM4bldDTWlEd2VjZ3BS\nVFFURFQrYnlBWVN6c0sxWSs4cWI3ampkV2hnCmNuSm44WlFqOXcvdTZvcC9TSks0\nZGhmMkU5OTVZM1VGUlJBRTM5OEEzVkkKLS0tIFZhRitla3NLRHI1YmdnQ2o4ZHNN\nenRMdXJ4YTNNQWxZa2NYMmhRRGlZQVkKA9e88DRGxR7l+ppj72IGh/2KPzUVNkNT\nNuvDN7MAmKmc5zEe2njasINGvgtnnthwF6paLrp0YvJbyk/Ek9NfOQ==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1yyzgmazjxkvwtfcv9re3lqmt2ru5dcrfu3sauysm0wzfwzvyap8qkjkq32" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYXk5eHhnK3k1ZmRYNDlv\nSmdZbXd0TjdXSnJTbnA5Ukw2R29vSWJ4REhZCmVVNWh2UWRrZUtQeDNtTTJiZEpE\nYi93TlVWWFhLRVJzNTNoajhKNVp3V2MKLS0tIGpsOExhSkFtL1VUeEdpYTNhNktp\nTWdTMHRhb21PRGVJYWg3WVpZd0RWU0kKPif0ZmG4gYPmGeFWczEDZcQJnHlSS7gJ\njX7GdkRGtu/of6JCHUhGHwSsrEvmjzAObPjF23RzFxpXp0jXfwFH0Q==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1elk6zwmcylwfk7gd4pjda7g29upftjvxys8py42s8d42jklnyv7s7dm9z2" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByQUNsRE90NU9rR3VzMlh0\neExvaEZYQlZwZlNYdHEyb3RKbW40ZmIzdkJnCmE2eXFndExac2hKT0w5R250MEJ5\nZ1dpd1NHMzJ0K29aRFExZFFMMGRxc2sKLS0tIG5rSzhGNUttZ05Ddlk2SGh2azJ5\nL0pTSjhsUmMvK1lEdW8wZFlLSittN0EKCw7RzjJIks/0ND3lJH0w1x/CC0tCghij\nH+LUSvdArr04xG7MoNtVytmd7nxQueg+jRVdnenVwBOtmFQLOXfCEA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age193gw802ytal7h5p5q37kpd9079k2vsflzmnvupcwfxh2kjdrwqtsk3g6rm" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdlkxWElrYXBzb2dncjNp\nSjVWWnk2bjJhTDFuemdBaVhwcUVjbytxQjI0ClRUZHRmcisxRjExYVJHc1FtYjM2\naHR4TWpRbTdYcUtPckNibmluR2ZuNXcKLS0tIDZlVlZZZzRSMHQxdVRwbDhHQjdz\na2tvdFd0RXVKM1EySXR5UE9ocFRtaU0KRn1/A7TXpk8vF+xSsT6Zuk2dfiksiUd3\nzDoX84Fkmuh5t5ke0gkrn5o/O+kl2TnedueTUQrflzcVl9N8AQ7qzQ==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1yr7vurfxc3w8ewfw9djfm54atw6ayze69qglamecuft5q0n9gu2sadsa2m" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVa3M4cVJrOXl6Z2RxK3hZ\nTDQvWjY1MHJLaG1SVFJudytNMm5zVzdPaFJrCldvLytraVdZSjVCeE90N1lsUGJM\ndG9Pb0xBRWJ3QTNXeHhhbSt2QjZibkEKLS0tIEVFM0k1bUdPSUZuQ0UxTXMwL3ZS\nMThYQVFKZURROHRwRk8wYThHdkNJY28KWfUiwpne23NSmNKhR46lGHi1Jwy1H+4+\nFaiS3iCk4rNb0rBG+IOJ+BdVGKwKgpzTfsSsZzKupihJ9Nxd5YjLEg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1hya7pgpe8zal52w3pjf036tpapmehedatfm4r84h30t4wuh079ssedfd37" + } + ], + "lastmodified": "2026-06-20T08:39:02Z", + "mac": "ENC[AES256_GCM,data:KgRW3x6fcGtE4AVjl6kxyf0o4LhC/a8CanALLIR8CiXWfpiQ3pY8nja2y0hEThXRHGjxy53TdGBp/yanDd9gd45c0RYuUgD5zzMnebL4LgMw/7I1Ezw1BYnWp+rXm2he/40lb7rfxX3D9jdtzlrOlMR+Uv1Ib4EzIABbcyF9WS8=,iv:4ifFSJ8MrG4Lh0nng7YhyJLeZ9zNn7GX8ju6Ulkj/so=,tag:FNP5grMpYo4uhVK85RTIKA==,type:str]", + "unencrypted_suffix": "_unencrypted", + "version": "3.13.1" + } +}