diff options
Diffstat (limited to 'modules/secrets')
| -rw-r--r-- | modules/secrets/default.nix | 24 | ||||
| -rw-r--r-- | modules/secrets/network/aptos/wireguard_privatekey.age | bin | 0 -> 467 bytes | |||
| -rw-r--r-- | modules/secrets/network/tahoe/wireguard_privatekey.age | bin | 0 -> 616 bytes | |||
| -rw-r--r-- | modules/secrets/rclone/config.ini.age | bin | 0 -> 616 bytes | |||
| -rw-r--r-- | modules/secrets/rclone/gcs_service_account.json.age | bin | 0 -> 2864 bytes | |||
| -rw-r--r-- | modules/secrets/restic/repo-systems.age | 12 | ||||
| -rw-r--r-- | modules/secrets/secrets.nix | 27 | ||||
| -rw-r--r-- | modules/secrets/traefik/gcp_service_account.json.age | bin | 0 -> 2827 bytes | |||
| -rw-r--r-- | modules/secrets/unifi/unifi-poller.age | 13 |
9 files changed, 76 insertions, 0 deletions
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix new file mode 100644 index 0000000..e6f3a7b --- /dev/null +++ b/modules/secrets/default.nix @@ -0,0 +1,24 @@ +{ config, inputs, lib, options, ... }: + +{ + imports = [ inputs.agenix.nixosModules.age ]; + + config.age = { + secrets = let + toName = lib.removeSuffix ".age"; + userExists = u: builtins.hasAttr u config.users.users; + # Only set the user if it exists, to avoid warnings + userIfExists = u: if userExists u then u else "root"; + toSecret = name: + { owner ? "root", ... }: { + file = ./. + "/${name}"; + owner = lib.mkDefault (userIfExists owner); + }; + convertSecrets = n: v: lib.nameValuePair (toName n) (toSecret n v); + secrets = import ./secrets.nix; + in lib.mapAttrs' convertSecrets secrets; + + identityPaths = options.age.identityPaths.default + ++ [ "/home/fcuny/.ssh/id_ed25519" ]; + }; +} diff --git a/modules/secrets/network/aptos/wireguard_privatekey.age b/modules/secrets/network/aptos/wireguard_privatekey.age new file mode 100644 index 0000000..2f6edf3 --- /dev/null +++ b/modules/secrets/network/aptos/wireguard_privatekey.age Binary files differdiff --git a/modules/secrets/network/tahoe/wireguard_privatekey.age b/modules/secrets/network/tahoe/wireguard_privatekey.age new file mode 100644 index 0000000..4304cfe --- /dev/null +++ b/modules/secrets/network/tahoe/wireguard_privatekey.age Binary files differdiff --git a/modules/secrets/rclone/config.ini.age b/modules/secrets/rclone/config.ini.age new file mode 100644 index 0000000..a017b29 --- /dev/null +++ b/modules/secrets/rclone/config.ini.age Binary files differdiff --git a/modules/secrets/rclone/gcs_service_account.json.age b/modules/secrets/rclone/gcs_service_account.json.age new file mode 100644 index 0000000..982dd30 --- /dev/null +++ b/modules/secrets/rclone/gcs_service_account.json.age Binary files differdiff --git a/modules/secrets/restic/repo-systems.age b/modules/secrets/restic/repo-systems.age new file mode 100644 index 0000000..79363e6 --- /dev/null +++ b/modules/secrets/restic/repo-systems.age @@ -0,0 +1,12 @@ +age-encryption.org/v1 +-> ssh-ed25519 wtownA Rv+TIuyxDf6bsdVH4W1inxwvbTNPAoIfBGDLQvyhaV0 +qZ6JAZq5P0WGdCLJ5scQl+mlOJ3fwkwMtlEEB1wIMlc +-> ssh-ed25519 +LF+iw TqTfv9yx+6yOExJ151o03d0VsWQ8jm5KQW1XmmYoqlY +AeXv4e1APSIgoPR7Ty0ysrC/fowp7ACA6+nKqsrFFks +-> ssh-ed25519 dtgBNg giDZ+PMXQd98UsIrGM4bqSOBWEK071PuVcd326imbB8 +AplnAox8y+b34fC0vlshoh6KCfhJP9LPGyfF4o2cUCo +-> 6o>-grease )}i\s<hC Qhde N p4=H +kTdnW/JPzgMexPznHQWhH0hXgwgxCxJCTePD1HYTEeebXic3FL0/CNJ2sjcrl/y+ +5XdlBPc +--- fn55JPZabkZRlf7DsIw7O46mis6C6fIqx5KEpTyXwak +H 7'\̹_OؙY[& n.LT{" \ No newline at end of file diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix new file mode 100644 index 0000000..45b1d33 --- /dev/null +++ b/modules/secrets/secrets.nix @@ -0,0 +1,27 @@ +let + fcuny_aptos = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIdlm/qoR/dnMjZhVSTtqFzkgN3Yf9eQ3pgKMiipg+dl"; + users = [ fcuny_aptos ]; + + aptos = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTcPGaiL+/Mwl8JzLHrBwas7QvWPjix4lnaAA1tw+5t"; + tahoe = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEq1IQRvj2jofCHOO6M28w2SRdgtHU06NJvwAwv/b69F"; + + systems = [ aptos tahoe ]; +in { + "network/aptos/wireguard_privatekey.age".publicKeys = [ fcuny_aptos aptos ]; + + "network/tahoe/wireguard_privatekey.age".publicKeys = + [ fcuny_aptos aptos tahoe ]; + + "traefik/gcp_service_account.json.age".publicKeys = + [ fcuny_aptos aptos tahoe ]; + + "unifi/unifi-poller.age".publicKeys = [ fcuny_aptos aptos tahoe ]; + + "restic/repo-systems.age".publicKeys = [ fcuny_aptos aptos tahoe ]; + "rclone/config.ini.age".publicKeys = [ fcuny_aptos aptos tahoe ]; + "rclone/gcs_service_account.json.age".publicKeys = + [ fcuny_aptos aptos tahoe ]; +} diff --git a/modules/secrets/traefik/gcp_service_account.json.age b/modules/secrets/traefik/gcp_service_account.json.age new file mode 100644 index 0000000..0f99905 --- /dev/null +++ b/modules/secrets/traefik/gcp_service_account.json.age Binary files differdiff --git a/modules/secrets/unifi/unifi-poller.age b/modules/secrets/unifi/unifi-poller.age new file mode 100644 index 0000000..bd71926 --- /dev/null +++ b/modules/secrets/unifi/unifi-poller.age @@ -0,0 +1,13 @@ +age-encryption.org/v1 +-> ssh-ed25519 wtownA 0VcUc7jKvTUSaSN8mj5DavrRh5OOu9tmlESZTZM1vy0 +YLbthCfZpcqKlUj0SKEvaczL1bWepXo6pTpurP4pyRU +-> ssh-ed25519 +LF+iw L+QyJtlQS7KGsWafQRTSfWbX13pb8Vl0skQsX+yVNjo +7hhNe1E3ctyLCfYjSHH9RuB220x368Ut312Ql+0E8MM +-> ssh-ed25519 dtgBNg h0M/tnUsWja+Y+06eBnKJYcLBX5RSRn19B+idfnTtGs +To6JQ/h7ag1H+xLkC4/tWnWGf0cjvq6NGBPqNeqExAU +-> #qx-grease ie.h +gEn12esIeUQ7g/SwgEiw3TH1Mqd3IZ/iyn+OJt16UIIUCi3ox7MgDLyS8ngicmOj +idBj8DS72toie9iG5rt9IDzV +--- 9jnTt5KR/MIJfT9s6gLP4cgqFZD2W0UQf4FF8HOBPX4 +n,0cC]KfNYpRn u Ij +_{/k \ No newline at end of file |