Olivier/chiasson-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add git-crypt support and update Sops configuration for multiple hosts

Browse Source 
- Introduced a new secrets file for git-crypt personal documents.
- Updated .sops.yaml to include new key groups for host-specific secrets.
- Configured Sops settings in client-services.nix for managing secrets.
- Removed redundant Sops configurations from multiple host configurations (14900k, ideapad, t2mbp, uConsole) to streamline secret management.
- Added git-crypt to desktop-home-base package list.
This commit is contained in:
OlivierChiasson
2026-06-20 16:52:08 -03:00
parent 026aea4ac4
commit 4034a6d81d
9 changed files with 82 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.sops.yaml
+8
View File
@@ -17,6 +17,14 @@ creation_rules:
- *host_ideapad
- *host_nix-server
- *host_r5500
- path_regex: secrets/gitcrypt-personal-docs-key$
key_groups:
- age:
- *primary
- *host_14900k
- *host_uConsole
- *host_t2mbp
- *host_ideapad
# Host secrets at modules/hosts/nix-server/secrets.yaml (see configuration imports),
# or optional extra files under _secrets/.
- path_regex: modules/hosts/nix-server/(secrets\.(yaml|json|env|ini)|_secrets/.*\.(yaml|json|env|ini))$
modules/hosts/14900k/configuration.nix
+1 -19
View File
@@ -24,25 +24,7 @@
./_private/moonfin-flatpak.nix
];
sops = {
defaultSopsFile = ../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
services.cloudflare-warp.enable = true;
services.cloudflare-warp.enable = true;
# Intel iGPU video acceleration (VA-API / QSV via oneVPL).
# This fixes common NixOS issues like `vaInitialize failed` and missing QSV encoders in apps.
modules/hosts/client-services.nix
+26
View File
@@ -23,5 +23,31 @@
services.printing.enable = true;
security.polkit.enable = true;
services.udisks2.enable = true;
sops = {
defaultSopsFile = ../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."gitcrypt/personal-docs-key" = {
sopsFile = ../../secrets/gitcrypt-personal-docs-key;
format = "binary";
owner = "olivier";
group = "users";
mode = "0400";
};
};
}
modules/hosts/desktop-home-base.nix
+3
View File
@@ -24,6 +24,9 @@
};
};
#TODO[epic=Moderate] Check if git-crypt should belong in desktop-home-base.
home.packages = [ pkgs.git-crypt ];
chiasson.home = {
# Catalog of `chiasson.home.*` toggles — host `home.nix` sets `enable = true` to override `mkDefault false`.
shell = {
modules/hosts/ideapad/configuration.nix
-20
View File
@@ -37,26 +37,6 @@
./_private/platform.nix
];
# ─────────────────────── Sops ───────────────────────
# `host_ideapad` recipient in `.sops.yaml` derives from the new ed25519 host key (post-reflash).
sops = {
defaultSopsFile = ../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
# ─────────────────────── Mobile NixOS / firmware ───────────────────────
# mruby's test-suite breaks on aarch64 in the Nix sandbox; the overlay strips checks and
# rebuilds Mobile NixOS' script-loader against the patched mruby.
modules/hosts/t2mbp/configuration.nix
-19
View File
@@ -19,25 +19,6 @@
./_private/firmware.nix
];
# ───────────────────────────── Sops (see repo secrets/.sops.yaml) ───────────
sops = {
defaultSopsFile = ../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."tailscale/auth-key" = {
mode = "0400";
};
modules/hosts/uConsole/configuration.nix
-18
View File
@@ -42,24 +42,6 @@
require-sigs = false;
};
sops = {
defaultSopsFile = ../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
sops.secrets."caching/attic/token" = {
owner = "olivier";
group = "users";
mode = "0400";
};
sops.secrets."swiftshare/API_KEY" = {
owner = "olivier";
group = "users";
mode = "0400";
};
chiasson.system.librepods.enable = true;
chiasson.system.palera1n.enable = true;
modules/system/users/catalog-default.nix
+13 -4
View File
@@ -2,8 +2,15 @@
# Module (not bare attrset) so catalog entries can use `config.*` for sops paths etc.
{ ... }: {
flake.nixosModules.usersCatalogDefaults =
{ config, ... }:
{ config, lib, ... }:
let
olivierEnabled = lib.elem "olivier" config.chiasson.users.enabled;
in
{
sops.secrets."users/olivier/hashedPassword" = lib.mkIf olivierEnabled {
neededForUsers = true;
};
config.chiasson.users.catalog = {
olivier = {
isNormalUser = true;
@@ -24,9 +31,11 @@
"input"
];
# Host must set `sops.secrets."users/olivier/hashedPassword".neededForUsers = true`.
# With that, `.path` is under /run/secrets-for-users/… (sops-nix README).
hashedPasswordFile = config.sops.secrets."users/olivier/hashedPassword".path;
# Declared in this module when olivier is in `chiasson.users.enabled`.
# With `neededForUsers`, `.path` is under /run/secrets-for-users/… (sops-nix README).
hashedPasswordFile = lib.mkIf olivierEnabled (
config.sops.secrets."users/olivier/hashedPassword".path
);
homeManager = {
enable = true;
secrets/gitcrypt-personal-docs-key
+31
View File
@@ -0,0 +1,31 @@
{
"data": "ENC[AES256_GCM,data:Oz/nHP+4sv9NlVkZYorufEjlSwLWRtZdpHNXRz2+yBQmtRKUPdK+MHpgwdp350kWBX36Id7DztcY3uTYXPp+NSOQ+NYjngg8pkSK7JI3Avs89S5tmaFwj3L8ouDJpOpDX8djPmnYuoF9xp/ekAVGHJvQOfSeDlJkOb3wEDIEgmO+osYckb+FvWqyQiUWbbus13hkaqGSNFelu20OU1Y6F645NJ3oNUwgHg==,iv:izq1awBfohJNzRVuk5cyMAadAShxp8BmmYmS+QrdDkg=,tag:7+WHz+R4rabPlz4VQae97A==,type:str]",
"sops": {
"age": [
{
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOREM4bldDTWlEd2VjZ3BS\nVFFURFQrYnlBWVN6c0sxWSs4cWI3ampkV2hnCmNuSm44WlFqOXcvdTZvcC9TSks0\nZGhmMkU5OTVZM1VGUlJBRTM5OEEzVkkKLS0tIFZhRitla3NLRHI1YmdnQ2o4ZHNN\nenRMdXJ4YTNNQWxZa2NYMmhRRGlZQVkKA9e88DRGxR7l+ppj72IGh/2KPzUVNkNT\nNuvDN7MAmKmc5zEe2njasINGvgtnnthwF6paLrp0YvJbyk/Ek9NfOQ==\n-----END AGE ENCRYPTED FILE-----\n",
"recipient": "age1yyzgmazjxkvwtfcv9re3lqmt2ru5dcrfu3sauysm0wzfwzvyap8qkjkq32"
},
{
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYXk5eHhnK3k1ZmRYNDlv\nSmdZbXd0TjdXSnJTbnA5Ukw2R29vSWJ4REhZCmVVNWh2UWRrZUtQeDNtTTJiZEpE\nYi93TlVWWFhLRVJzNTNoajhKNVp3V2MKLS0tIGpsOExhSkFtL1VUeEdpYTNhNktp\nTWdTMHRhb21PRGVJYWg3WVpZd0RWU0kKPif0ZmG4gYPmGeFWczEDZcQJnHlSS7gJ\njX7GdkRGtu/of6JCHUhGHwSsrEvmjzAObPjF23RzFxpXp0jXfwFH0Q==\n-----END AGE ENCRYPTED FILE-----\n",
"recipient": "age1elk6zwmcylwfk7gd4pjda7g29upftjvxys8py42s8d42jklnyv7s7dm9z2"
},
{
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByQUNsRE90NU9rR3VzMlh0\neExvaEZYQlZwZlNYdHEyb3RKbW40ZmIzdkJnCmE2eXFndExac2hKT0w5R250MEJ5\nZ1dpd1NHMzJ0K29aRFExZFFMMGRxc2sKLS0tIG5rSzhGNUttZ05Ddlk2SGh2azJ5\nL0pTSjhsUmMvK1lEdW8wZFlLSittN0EKCw7RzjJIks/0ND3lJH0w1x/CC0tCghij\nH+LUSvdArr04xG7MoNtVytmd7nxQueg+jRVdnenVwBOtmFQLOXfCEA==\n-----END AGE ENCRYPTED FILE-----\n",
"recipient": "age193gw802ytal7h5p5q37kpd9079k2vsflzmnvupcwfxh2kjdrwqtsk3g6rm"
},
{
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdlkxWElrYXBzb2dncjNp\nSjVWWnk2bjJhTDFuemdBaVhwcUVjbytxQjI0ClRUZHRmcisxRjExYVJHc1FtYjM2\naHR4TWpRbTdYcUtPckNibmluR2ZuNXcKLS0tIDZlVlZZZzRSMHQxdVRwbDhHQjdz\na2tvdFd0RXVKM1EySXR5UE9ocFRtaU0KRn1/A7TXpk8vF+xSsT6Zuk2dfiksiUd3\nzDoX84Fkmuh5t5ke0gkrn5o/O+kl2TnedueTUQrflzcVl9N8AQ7qzQ==\n-----END AGE ENCRYPTED FILE-----\n",
"recipient": "age1yr7vurfxc3w8ewfw9djfm54atw6ayze69qglamecuft5q0n9gu2sadsa2m"
},
{
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVa3M4cVJrOXl6Z2RxK3hZ\nTDQvWjY1MHJLaG1SVFJudytNMm5zVzdPaFJrCldvLytraVdZSjVCeE90N1lsUGJM\ndG9Pb0xBRWJ3QTNXeHhhbSt2QjZibkEKLS0tIEVFM0k1bUdPSUZuQ0UxTXMwL3ZS\nMThYQVFKZURROHRwRk8wYThHdkNJY28KWfUiwpne23NSmNKhR46lGHi1Jwy1H+4+\nFaiS3iCk4rNb0rBG+IOJ+BdVGKwKgpzTfsSsZzKupihJ9Nxd5YjLEg==\n-----END AGE ENCRYPTED FILE-----\n",
"recipient": "age1hya7pgpe8zal52w3pjf036tpapmehedatfm4r84h30t4wuh079ssedfd37"
}
],
"lastmodified": "2026-06-20T08:39:02Z",
"mac": "ENC[AES256_GCM,data:KgRW3x6fcGtE4AVjl6kxyf0o4LhC/a8CanALLIR8CiXWfpiQ3pY8nja2y0hEThXRHGjxy53TdGBp/yanDd9gd45c0RYuUgD5zzMnebL4LgMw/7I1Ezw1BYnWp+rXm2he/40lb7rfxX3D9jdtzlrOlMR+Uv1Ib4EzIABbcyF9WS8=,iv:4ifFSJ8MrG4Lh0nng7YhyJLeZ9zNn7GX8ju6Ulkj/so=,tag:FNP5grMpYo4uhVK85RTIKA==,type:str]",
"unencrypted_suffix": "_unencrypted",
"version": "3.13.1"
}
}