Olivier/chiasson-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add git-crypt support and update Sops configuration for multiple hosts

Browse Source 
- Introduced a new secrets file for git-crypt personal documents.
- Updated .sops.yaml to include new key groups for host-specific secrets.
- Configured Sops settings in client-services.nix for managing secrets.
- Removed redundant Sops configurations from multiple host configurations (14900k, ideapad, t2mbp, uConsole) to streamline secret management.
- Added git-crypt to desktop-home-base package list.
This commit is contained in:
OlivierChiasson
2026-06-20 16:52:08 -03:00
parent 026aea4ac4
commit 4034a6d81d
9 changed files with 82 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/hosts/14900k/configuration.nix
+1 -19
View File
@@ -24,25 +24,7 @@
./_private/moonfin-flatpak.nix
];
sops = {
defaultSopsFile = ../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
services.cloudflare-warp.enable = true;
services.cloudflare-warp.enable = true;
# Intel iGPU video acceleration (VA-API / QSV via oneVPL).
# This fixes common NixOS issues like `vaInitialize failed` and missing QSV encoders in apps.
modules/hosts/client-services.nix
+26
View File
@@ -23,5 +23,31 @@
services.printing.enable = true;
security.polkit.enable = true;
services.udisks2.enable = true;
sops = {
defaultSopsFile = ../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."gitcrypt/personal-docs-key" = {
sopsFile = ../../secrets/gitcrypt-personal-docs-key;
format = "binary";
owner = "olivier";
group = "users";
mode = "0400";
};
};
}
modules/hosts/desktop-home-base.nix
+3
View File
@@ -24,6 +24,9 @@
};
};
#TODO[epic=Moderate] Check if git-crypt should belong in desktop-home-base.
home.packages = [ pkgs.git-crypt ];
chiasson.home = {
# Catalog of `chiasson.home.*` toggles — host `home.nix` sets `enable = true` to override `mkDefault false`.
shell = {
modules/hosts/ideapad/configuration.nix
-20
View File
@@ -37,26 +37,6 @@
./_private/platform.nix
];
# ─────────────────────── Sops ───────────────────────
# `host_ideapad` recipient in `.sops.yaml` derives from the new ed25519 host key (post-reflash).
sops = {
defaultSopsFile = ../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
# ─────────────────────── Mobile NixOS / firmware ───────────────────────
# mruby's test-suite breaks on aarch64 in the Nix sandbox; the overlay strips checks and
# rebuilds Mobile NixOS' script-loader against the patched mruby.
modules/hosts/t2mbp/configuration.nix
-19
View File
@@ -19,25 +19,6 @@
./_private/firmware.nix
];
# ───────────────────────────── Sops (see repo secrets/.sops.yaml) ───────────
sops = {
defaultSopsFile = ../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."tailscale/auth-key" = {
mode = "0400";
};
modules/hosts/uConsole/configuration.nix
-18
View File
@@ -42,24 +42,6 @@
require-sigs = false;
};
sops = {
defaultSopsFile = ../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
chiasson.system.librepods.enable = true;
chiasson.system.palera1n.enable = true;
modules/system/users/catalog-default.nix
+13 -4
View File
@@ -2,8 +2,15 @@
# Module (not bare attrset) so catalog entries can use `config.*` for sops paths etc.
{ ... }: {
flake.nixosModules.usersCatalogDefaults =
{ config, ... }:
{ config, lib, ... }:
let
olivierEnabled = lib.elem "olivier" config.chiasson.users.enabled;
in
{
sops.secrets."users/olivier/hashedPassword" = lib.mkIf olivierEnabled {
neededForUsers = true;
};
config.chiasson.users.catalog = {
olivier = {
isNormalUser = true;
@@ -24,9 +31,11 @@
"input"
];
# Host must set `sops.secrets."users/olivier/hashedPassword".neededForUsers = true`.
# With that, `.path` is under /run/secrets-for-users/… (sops-nix README).
hashedPasswordFile = config.sops.secrets."users/olivier/hashedPassword".path;
# Declared in this module when olivier is in `chiasson.users.enabled`.
# With `neededForUsers`, `.path` is under /run/secrets-for-users/… (sops-nix README).
hashedPasswordFile = lib.mkIf olivierEnabled (
config.sops.secrets."users/olivier/hashedPassword".path
);
homeManager = {
enable = true;