From 5e4d8a007254b9811c86b2ea142a280c9828271d Mon Sep 17 00:00:00 2001 From: Franck Cuny Date: Wed, 13 Apr 2022 10:23:20 -0700 Subject: secrets: move the actual secrets with hosts config Having the secrets closer to the host is easier to manage. At the moment I don't have secrets that are shared across multiple hosts, so that's an OK approach. --- hosts/aptos/secrets/secrets.nix | 4 ++++ hosts/aptos/secrets/wireguard_privatekey.age | Bin 0 -> 467 bytes hosts/tahoe/secrets/rclone/config.ini.age | Bin 0 -> 616 bytes .../secrets/rclone/gcs_service_account.json.age | Bin 0 -> 2864 bytes hosts/tahoe/secrets/restic/repo-systems.age | 12 +++++++++++ hosts/tahoe/secrets/secrets.nix | 14 +++++++++++++ .../secrets/traefik/gcp_service_account.json.age | Bin 0 -> 2827 bytes hosts/tahoe/secrets/unifi/unifi-poller.age | 13 ++++++++++++ hosts/tahoe/secrets/wireguard_privatekey.age | Bin 0 -> 616 bytes lib/private-wireguard.nix | 3 +-- modules/secrets/default.nix | 23 +++++++++++---------- .../secrets/network/aptos/wireguard_privatekey.age | Bin 467 -> 0 bytes 12 files changed, 56 insertions(+), 13 deletions(-) create mode 100644 hosts/aptos/secrets/secrets.nix create mode 100644 hosts/aptos/secrets/wireguard_privatekey.age create mode 100644 hosts/tahoe/secrets/rclone/config.ini.age create mode 100644 hosts/tahoe/secrets/rclone/gcs_service_account.json.age create mode 100644 hosts/tahoe/secrets/restic/repo-systems.age create mode 100644 hosts/tahoe/secrets/secrets.nix create mode 100644 hosts/tahoe/secrets/traefik/gcp_service_account.json.age create mode 100644 hosts/tahoe/secrets/unifi/unifi-poller.age create mode 100644 hosts/tahoe/secrets/wireguard_privatekey.age delete mode 100644 modules/secrets/network/aptos/wireguard_privatekey.age diff --git a/hosts/aptos/secrets/secrets.nix b/hosts/aptos/secrets/secrets.nix new file mode 100644 index 0000000..28c4078 --- /dev/null +++ b/hosts/aptos/secrets/secrets.nix @@ -0,0 +1,4 @@ +let + aptos = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIdlm/qoR/dnMjZhVSTtqFzkgN3Yf9eQ3pgKMiipg+dl"; +in { "wireguard_privatekey.age".publicKeys = [ aptos ]; } diff --git a/hosts/aptos/secrets/wireguard_privatekey.age b/hosts/aptos/secrets/wireguard_privatekey.age new file mode 100644 index 0000000..2f6edf3 Binary files /dev/null and b/hosts/aptos/secrets/wireguard_privatekey.age differ diff --git a/hosts/tahoe/secrets/rclone/config.ini.age b/hosts/tahoe/secrets/rclone/config.ini.age new file mode 100644 index 0000000..a017b29 Binary files /dev/null and b/hosts/tahoe/secrets/rclone/config.ini.age differ diff --git a/hosts/tahoe/secrets/rclone/gcs_service_account.json.age b/hosts/tahoe/secrets/rclone/gcs_service_account.json.age new file mode 100644 index 0000000..982dd30 Binary files /dev/null and b/hosts/tahoe/secrets/rclone/gcs_service_account.json.age differ diff --git a/hosts/tahoe/secrets/restic/repo-systems.age b/hosts/tahoe/secrets/restic/repo-systems.age new file mode 100644 index 0000000..79363e6 --- /dev/null +++ b/hosts/tahoe/secrets/restic/repo-systems.age @@ -0,0 +1,12 @@ +age-encryption.org/v1 +-> ssh-ed25519 wtownA Rv+TIuyxDf6bsdVH4W1inxwvbTNPAoIfBGDLQvyhaV0 +qZ6JAZq5P0WGdCLJ5scQl+mlOJ3fwkwMtlEEB1wIMlc +-> ssh-ed25519 +LF+iw TqTfv9yx+6yOExJ151o03d0VsWQ8jm5KQW1XmmYoqlY +AeXv4e1APSIgoPR7Ty0ysrC/fowp7ACA6+nKqsrFFks +-> ssh-ed25519 dtgBNg giDZ+PMXQd98UsIrGM4bqSOBWEK071PuVcd326imbB8 +AplnAox8y+b34fC0vlshoh6KCfhJP9LPGyfF4o2cUCo +-> 6o>-grease )}i\s ssh-ed25519 wtownA 0VcUc7jKvTUSaSN8mj5DavrRh5OOu9tmlESZTZM1vy0 +YLbthCfZpcqKlUj0SKEvaczL1bWepXo6pTpurP4pyRU +-> ssh-ed25519 +LF+iw L+QyJtlQS7KGsWafQRTSfWbX13pb8Vl0skQsX+yVNjo +7hhNe1E3ctyLCfYjSHH9RuB220x368Ut312Ql+0E8MM +-> ssh-ed25519 dtgBNg h0M/tnUsWja+Y+06eBnKJYcLBX5RSRn19B+idfnTtGs +To6JQ/h7ag1H+xLkC4/tWnWGf0cjvq6NGBPqNeqExAU +-> #qx-grease ie.h +gEn12esIeUQ7g/SwgEiw3TH1Mqd3IZ/iyn+OJt16UIIUCi3ox7MgDLyS8ngicmOj +idBj8DS72toie9iG5rt9IDzV +--- 9jnTt5KR/MIJfT9s6gLP4cgqFZD2W0UQf4FF8HOBPX4 +n,0cC]KfNYpRnuIj +_{/k \ No newline at end of file diff --git a/hosts/tahoe/secrets/wireguard_privatekey.age b/hosts/tahoe/secrets/wireguard_privatekey.age new file mode 100644 index 0000000..4304cfe Binary files /dev/null and b/hosts/tahoe/secrets/wireguard_privatekey.age differ diff --git a/lib/private-wireguard.nix b/lib/private-wireguard.nix index d77c7dd..706dfd8 100644 --- a/lib/private-wireguard.nix +++ b/lib/private-wireguard.nix @@ -19,8 +19,7 @@ in { networking = { wireguard.interfaces.wg0 = { listenPort = port; - privateKeyFile = - secrets."network/${config.networking.hostName}/wireguard_privatekey".path; + privateKeyFile = secrets."wireguard_privatekey".path; ips = [ "${wgcfg.subnet4}.${toString thisPeer.ipv4}/${toString wgcfg.mask4}" ]; diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix index 556bf32..20dbfd2 100644 --- a/modules/secrets/default.nix +++ b/modules/secrets/default.nix @@ -1,22 +1,23 @@ { config, inputs, lib, options, ... }: -with builtins; { +with builtins; +with lib; +let + secretsDir = "${toString ../../hosts}/${config.networking.hostName}/secrets"; + secretsFile = "${secretsDir}/secrets.nix"; +in { imports = [ inputs.agenix.nixosModules.age ]; config.age = { secrets = let - toName = lib.removeSuffix ".age"; userExists = u: builtins.hasAttr u config.users.users; # Only set the user if it exists, to avoid warnings userIfExists = u: if userExists u then u else "root"; - toSecret = name: - { owner ? "root", ... }: { - file = ./. + "/${name}"; - owner = lib.mkDefault (userIfExists owner); - }; - convertSecrets = n: v: lib.nameValuePair (toName n) (toSecret n v); - secrets = import ./secrets.nix; - in lib.mapAttrs' convertSecrets secrets; - + in if pathExists secretsFile then + mapAttrs' (n: _: + nameValuePair (removeSuffix ".age" n) { file = "${secretsDir}/${n}"; }) + (import secretsFile) + else + { }; identityPaths = options.age.identityPaths.default ++ (filter pathExists [ "${config.users.users.fcuny.home}/.ssh/id_ed25519" ]); }; diff --git a/modules/secrets/network/aptos/wireguard_privatekey.age b/modules/secrets/network/aptos/wireguard_privatekey.age deleted file mode 100644 index 2f6edf3..0000000 Binary files a/modules/secrets/network/aptos/wireguard_privatekey.age and /dev/null differ -- cgit 1.4.1