Olivier
4034a6d81d
- Introduced a new secrets file for git-crypt personal documents. - Updated .sops.yaml to include new key groups for host-specific secrets. - Configured Sops settings in client-services.nix for managing secrets. - Removed redundant Sops configurations from multiple host configurations (14900k, ideapad, t2mbp, uConsole) to streamline secret management. - Added git-crypt to desktop-home-base package list.
54 lines
1.4 KiB
Nix
54 lines
1.4 KiB
Nix
{ self, ... }: {
|
|
#TODO[epic=Moderate] Move this somewhere else, would prefer not relying on this module
|
|
flake.nixosModules."client-services" = { ... }: {
|
|
imports = [
|
|
self.nixosModules.systemBluetooth
|
|
self.nixosModules.systemDeployBuilder
|
|
];
|
|
|
|
chiasson.system.deploy.builder.enable = true;
|
|
|
|
# Lab-ish SSH defaults on clients — tighten for anything exposed.
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
KbdInteractiveAuthentication = false;
|
|
PasswordAuthentication = true;
|
|
PermitRootLogin = "yes"; # consider tightening later
|
|
UseDns = false;
|
|
};
|
|
};
|
|
|
|
# Printing, polkit, udisks.
|
|
services.printing.enable = true;
|
|
security.polkit.enable = true;
|
|
services.udisks2.enable = true;
|
|
|
|
sops = {
|
|
defaultSopsFile = ../../secrets/secrets.yaml;
|
|
defaultSopsFormat = "yaml";
|
|
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
};
|
|
|
|
sops.secrets."caching/attic/token" = {
|
|
owner = "olivier";
|
|
group = "users";
|
|
mode = "0400";
|
|
};
|
|
|
|
sops.secrets."swiftshare/API_KEY" = {
|
|
owner = "olivier";
|
|
group = "users";
|
|
mode = "0400";
|
|
};
|
|
|
|
sops.secrets."gitcrypt/personal-docs-key" = {
|
|
sopsFile = ../../secrets/gitcrypt-personal-docs-key;
|
|
format = "binary";
|
|
owner = "olivier";
|
|
group = "users";
|
|
mode = "0400";
|
|
};
|
|
};
|
|
}
|