nixos

commit 5db3010a5e6cd546a718995baf3c239b8d3e7104
parent a9168ae0d5e4099d828e6f8b937c517b265f3697
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed,  9 Aug 2023 15:15:26 +0200

Add sops

Diffstat:
M
.sops.yaml
 | 
2
++
M
nixos/worker-1/configuration.nix
 | 
40
++++++++++++++++++++++++++++++++++------
A
nixos/worker-1/secrets/secrets.yaml
 | 
25
+++++++++++++++++++++++++

3 files changed, 61 insertions(+), 6 deletions(-)
diff --git a/.sops.yaml b/.sops.yaml
@@ -1,7 +1,9 @@
 keys:
   - &admin_mtrnord age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+  - &server_worker_1 age1c6420232n3rs9kwlqjrucv88pdu0khmdzxlff8tpnvmccuh9sups07l3hr
 creation_rules:
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
       - age:
           - *admin_mtrnord
+          - *server_worker_1
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -9,7 +9,7 @@
 
     # Or modules from other flakes (such as nixos-hardware):
     # inputs.hardware.nixosModules.common-cpu-amd
-    # inputs.hardware.nixosModules.common-ssd
+    inputs.hardware.nixosModules.common-ssd
 
     # You can also split up your configuration and import pieces of it here:
     # ./users.nix
@@ -150,6 +150,36 @@
   };
 
 
+  # SOPS
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  # This is using an age key that is expected to already be in the filesystem
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  # This will generate a new key if the key specified above does not exist
+  sops.age.generateKey = true;
+  sops.defaultSopsFile = builtins.path { path = ./secrets/secrets.yaml; name = "worker-1-secrets"; };
+  sops.secrets.marcel_initial_password.neededForUsers = true;
+
+  environment.etc."ssh/ssh_host_ed25519_key" = {
+    mode = "0600";
+    source = config.sops.secrets.ssh_host_ed25519_key.path;
+  };
+
+  environment.etc."ssh/ssh_host_ed25519_key.pub" = {
+    mode = "0644";
+    source = config.sops.secrets.ssh_host_ed25519_key_pub.path;
+  };
+
+
+  environment.etc."ssh/ssh_host_rsa_key" = {
+    mode = "0644";
+    source = config.sops.secrets.ssh_host_rsa_key.path;
+  };
+
+  environment.etc."ssh/ssh_host_rsa_key.pub" = {
+    mode = "0644";
+    source = config.sops.secrets.ssh_host_rsa_key_pub.path;
+  };
+
   # Configure your system-wide user settings (groups, etc), add more users as needed.
   users.users = {
     marcel = {
@@ -158,6 +188,7 @@
       # Be sure to change it (using passwd) after rebooting!
       #initialPassword = "correcthorsebatterystaple";
       isNormalUser = true;
+      passwordFile = config.sops.secrets.marcel_initial_password.path;
       openssh.authorizedKeys.keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUzC9NeEc4voBeAO7YuQ1ewRKCS2iar4Bcm4cKoNKUH mtrnord@nordgedanken.dev"
       ];
@@ -182,16 +213,13 @@
   # # Darling Erasure
   # environment.etc = {
   #   nixos.source = "/persist/etc/nixos";
-  #   "NetworkManager/system-connections".source = "/persist/etc/NetworkManager/system-connections";
   #   adjtime.source = "/persist/etc/adjtime";
   #   NIXOS.source = "/persist/etc/NIXOS";
   #   machine-id.source = "/persist/etc/machine-id";
   # };
   # systemd.tmpfiles.rules = [
-  #   "L /var/lib/NetworkManager/secret_key - - - - /persist/var/lib/NetworkManager/secret_key"
-  #   "L /var/lib/NetworkManager/seen-bssids - - - - /persist/var/lib/NetworkManager/seen-bssids"
-  #   "L /var/lib/NetworkManager/timestamps - - - - /persist/var/lib/NetworkManager/timestamps"
-  #   "L /kubernetes - - - - /persist/kubernetes"
+  #   "L /etc/secrets/initrd/ssh_host_ed25519_key - - - - /persist/etc/secrets/initrd/ssh_host_ed25519_key"
+  #   "L /etc/secrets/initrd/ssh_host_ed25519_key.pub - - - - /persist/etc/secrets/initrd/ssh_host_ed25519_key.pub"
   # ];
   # security.sudo.extraConfig = ''
   #   # rollback results in sudo lectures after each reboot
diff --git a/nixos/worker-1/secrets/secrets.yaml b/nixos/worker-1/secrets/secrets.yaml
@@ -0,0 +1,25 @@
+ssh_host_ed25519_key: ENC[AES256_GCM,data:u8fLWVoOOjfSo5uL3Zcv4+cxrvQPyghmd4+2YSXkskLpLvJZLrLKhL9//uFjRrMrhKE2gvW7aXaM/V6TaInCedGoRgLeDc8UrXFU7AMGf0QyKELpcdb2ZvydQUN6kT0PnzRSYdRXjdC+GuSi8ALQqTV7yaH1Tm7C2Oc7Tg1EqpzX+ouZqFKFyIdylJ3gMh5cqTPVzA9XIupbW5o8wN2d9iZOXngCBeyH/c0YOPKoh2KcaOc5fqoi6oHuCIWKS7wyXUyznlWH3FSjT4iS5cewnbpzl8F9YHrZY+tIy8xQ8dF8oFRENwyEHceSCPdxnthG2MPbdIXAhjaRNUqte04ByWqG4HkEgqOResXgkKDKg9aLIcAK9qyFV+FxDgujLXgupQkGlh7OyalxjrwP1h7w63fIyBkaSmosb66m8yTSN/zGsvjHSnXoaxJ5ysbL9sr0T8XLBcyGwXS5+yUL0A2hkGo63oVNfMHoOwiIQmWBB6uWSW4LNqGmg3ij0ZsAcydyXeoF1afc94LHcpBf/0cU,iv:ZimTtCdtDRyheCOrnhVZoUHJZqz+sxhobYLVEuLAVFQ=,tag:SU30uZiIkH3ZFkYoC09toA==,type:str]
+ssh_host_ed25519_key_pub: ENC[AES256_GCM,data:1ZrC7SRY34Sa5cwqvXzt/DDUU7M7kcAg/UD8SUExpUr+eDzxD2uVXem54UwOQLHZWFO95mBNAgTsDtrX1EmPocphLJqSIOKRb9ZdEatqdzcDm9fqaPBrLUQx4bDApA==,iv:dzc/iG3QNqi5vPstih/Vk8nUpHJV8hvfdogRZFTRP0M=,tag:+D1MrmJGcYH8JG/nVGyK3w==,type:str]
+ssh_host_rsa_key: ENC[AES256_GCM,data:sSutPdR+cbekWeeXQxSXHT/06CkeXS8nhwRUJIPo9sUz2euRrk/EYLzCmWH9OnU6hAZZCY6X4rJd1bsqMA8XkGXPxUBalHTHGgRpMNn+AaU7z0byV60MHeB1knlO1z2iomvwLb677N7Y3Krj5iwakKWit0H55B9tQe65omesa7BcWeGRniSLFFDKGlJ0GARJTrfCPjmYhc9fj+VjXnsyRUdM1jdvHDfkXcB20vV3OFLckRFIYhkCFQlB2XjTgsX4/7h4/kNiUug6CDzVYLDPA/yCmAhpWrCwTxnu/H0G8sqb2X/ybwrmGsPOF8FjEHrZamIMzHJKorK+tXyfVsF57z2DZL5U01EhyHGFyZ4x0KH2dbG4kdZzkxklbh1hImAfDIjt8QYqSEf/yqQjJB4CU6AfVkDVeMtFjFCvshkSNLwIY28JLZ10cdEugFHkTgiDQwno578btGHrJ7yeHkmtqS+QtmemqQ/rRXGOZ9nQUHcxYG2DCjnvSD6YfxVbojsOZuzim+uLJAzJINTIc6VqMazqLkrUliUGB+uiYSNK01D26lOFm6TPFdaJ4gGzgGBaEjGi6+u/Rb3xyVyNX5TbnVzrv+HknekfYdL1d4+zD9BsGhwCA7/03k0nJ/NlzhsHZ5sXG6WtMvVOiXMC980W4TkcoPQlklNI54SIhD1G4usECyZLjIjS4rJpquK4AxuSrWA+te/xx5aRqj6nxmOd8341yaEFIw9PFTHgoD/CNPGoTZMDuhrf6VRyiQukE1+n3Ew0P9wWrCYYS48Chn71bJZNTlYV2kAxBlUsHOz9Qt2cHBbuyMLicnf3a4gS0lmJqtoxDa4y+J+yxxjFZdxQNN0DLSZJDYSqzqzYe1bHMpPkX7KkirlMjxa38yMTQ76YphhcigrJUb//DWGxKsnayK2SxAhkV+vLilmGHbtSgAoehbfBzFQotSSPAcYSOOQAKGo4RqeRBLtGU2pmX4zDViN1iJzwIUS+49jQvT6aWrDSQaD5uatj96xiPM9wM7tj1ryx1l837rHrQCRRhAUsYk7skVZxWEtVDXZEb1a2GnTxakEM72/JE6J6rk5q4/2/g+YpXFVQ1JNHSnVeGVeSljD9UMQbxEUrZmwdTPaWCv1CJdQ+r0XvyrfywYMGbtMFdsTyFtqeYNQXOqMNy2tte84B3sPujJ9CtQvAHYpzHMn8Yb5TflBjCiq7C3RmAKj74VBSH0zMtum1jCDUFyBPPsfA28/5lfX5uzDfrL9MO9XwHdqk5RW/M2taDYbqNCOF6SV0KUIStKcofaOL3xi8lUBt/+TDgXEIlR9RDqjONAcTMukIsXIlAM2+QbwDWAZtxBfLwYfiuJBEGfHffBiPEcfmWyPrRLAEzp/KOwtAkU5x7ulqsHzLwWiz8m2Z8C86yXO0Kg1mNtPrNV8htL3Pd/X4ww/VOEh0y+F3S2qGsZScMucNEr1759hqY6IuOgn6d8ayKk2psGAh2itp+aO8t9ntQa1hkqyViF0SmphqmdBZjWAZa//jkERUu59272EFkyGowWKRKH0Hifqz8OSd9patZFpawviTWpuXkyxB3DWfT7QAaTER+YNUWOQ6TewhNxnbC+IP4lWenghVaH7rJgt7aKpX22N2HB4GvEhXkqVRq1y2a7ZL9/gTn/S+XnkpFBJ9Ji5NL1vDHh2a7eZgNKUHCJyYI4nupOn0huZZ4ALGM07f8m75W/oOAnjpCw7BOmiKFSMwZ0SwzqSsZ12jnxkhDfQyK/nnSO+7REa+Ljmo1Vo43ARWh9XQFkNk/GwUD10Ifqfoj34er7Y+Zg+sxMb5LuntQG2UVAs8/ps6kZY5Zzgo8pEj5CwiYQZDFYTRwzI4Mob61q0Tot6b9oOWjr83uM3e5ApaqqPi3U5XULr0IqtTSiF/pyly8FzsRXqLZ/OcCWTEAiCwJN/pD5nUz8r663BHvazFcGn0DnRTW2+/IqsM/CuS6HhW2/GqKH1xBxP2NgCtNrTFw+5qrI1OfbcJAIT2nw/W3I3K4TS/8w4BZQc33RqHxcZgszA5uGR9dZkkOQYfXtSFPcRJuTj4DOwXUtAhdcHq/xTEyIqm8wZNWtN0X0V6J3lXHHojp03jQ/OoSU9Bbh8jBTFUZKELWkTQ8ZA7HB0VVm6Boj+tyr98XCormm8Fjaw8ST4zyjFl27n9l1SDHdciSuziFlBsU2Y9hMh6PhyMgWnUGmCzBw3Cn3CN8+Q4gDSKfN1SqOQazSkTEH1giy0FbBFxOM4Ar0ni+sg+XkozrRnkn+Hkv0e9lbCbe9jM9BifjQc1A6MJCGSdQgYNR8y+TeH/XJuOG4FExOreuqHz7fIadDTfFTbzttgjX4jGo8vFSWszM9+S81aCIfKh1bcm6kI5+UiIlt/iVaZnx3xILS5DB77G2sy54d+n4rgZFmmGAyU6AVLDs5WIfZoc746dVwmbcAaL+YAH+SBSKMve9ko2mEUT299jzBSLwl6r//+mBIzuTHXxIu7UxWK4db/PBPy6BlQYOUUtwFD3vEiOr5hCiYdNj8vm//2m1RlY3fXlU7eIdOAWA20IcczDf+syeMUsit8Ey40rmo8F/w4Qt9NT4DctE8mk20fkMhnO98zwvAWqp4UJE+PcJAeSem3vFcqgNkZJM1j7+tbZerRKlNUSnYtJ5SjslJmr2nZ1TeGwK2I+E0uVMRfwMTkYIt8n85akgbynoKN4U62bjTFnVMf0DnxACeCGSqAJceWJBZKRluOzGloURK0lIZApYuMadiU1MBdpSdqj+eFo2Y4Hdl9SfcAVMOoKR0GrQDiLcG4dYyKKGBByRsg7IAHXWrYrZFSEYR5oIA1F1SdScFQcN2+rLzytquHihh4yekFVhVg2MqwX5r5ePFgpCcFQA4ad0ryvgESoSXCyHI3OsfWfoobxWOMYrs+rkg0UZGn1EK4327wumsbSR4bRu9JFjXdB8dvhajdUv74gItZ3chXM4D32fZ9zeF3nlRwurvoW6L4PO/m0ninUU85bIHMeGFVwxMxuuMEwzUWs1zac7m799ROT+tV9A0s7h9D6lSaHZpQiJOqDf1yclL700ZRUyGKO0+I/xjw9f0V7kONCrENBUPO3gcppi7m6FBS4ee/VJYg+gkI2oY4c9AhDD9+Wb4vxAE4wFjHfr9k7wv+l173ItvG7D4XR7P4DIhegUfCcmBSmUY9/W0iZNPAk5QMICJphuKPxFloD+bKWOCUHwrl/1dz385r3mJnr3AbxLnmmvOM+8SdMTiplJ5D3YgeqDWgKPFIns3EuExFsIaComDdz0KCQocigKfqk6s8aaDzCQ4Pgz4Fvz6bFfgUTLJcTNlSRNbnbHFfBFbRDt1m5Z/MRAuNfTJ7kMmaAHZFvRULQVirS81zUXSAXN/4kLieT8gMOcFYeMb4GmAridvBuzpFI14CYUTBGGrPYXwdxjAy6QyGO9D5ghFjCp5L4V7h4jkBOVA7qEDKYpjeDCcUkRUJWntJg5icgpYhvxmXTob9rjktpX9zqpH5V2OXls/m3m5cgqOnGxVYCauNFCKKeLZb3+j25ULdjU4Jur/RxOsN259aQ6dYZxzlR6HWnZYwZe5xkD5ZhuTeOkY+LDr8MgXE/fUHUHsivNaHw62NPK/FJyJN+VFzBAsKE0q4ddqIsv94iORb9dme7FcnimzDrlmzAgrgDYKtifcwPsLXIdHpCqicUKeRuw0069HhCTrzza6NtRCHpMGEqpHuMN4xKOoimveSstS1cRQoL2WaKmFPdTP3NrTWEzUXBWa2d1+LA5rkd8svZn7IdOtTUQFVjsmrcKvVWp3rE02I9nQJFS7RSbyFGg5kLlLqFPL21y9et5OHCuuYbCBAlB0DBrJ4HcQ8YLDWuZGxmkTyMRDLXo/yOmB5P0BIliiECxo2Uvaj4q1LOWs88GIQ5SWyoY4R/ioUY0z0lDF73jSnTta/pHbGBNPVnQUJnJbgN2eUYDJSiJzWXMbfAm+y22bwdGjUlXgblAKqBnsAHSLkBF3g+PUR5k7M4ke0LChxe7ylz091r9PlsProCjX9h9ldYq9gxtmakWBBucdoLN3c1EFgOR3PMIkoAyJ9j6wss8OvP2k5rNmxxdIx0MyMmI3B9WW+QFtsbJoFsmsYzAKw+MOzLIoAtQGD0ugyksNWduDGBnL8uGZnKt4aeRcgLY+rUR4Yvn5bdJciOnC9ejebkGb73JUfljxpuPqmlXNmYuYnoe/SL02P/avDoEAFOYoSAGQgF5XdCGpni9pnYGrOVnNtpgV8x/6ejelK4H4ephlT5xfUU7PGkAZxbDj0qu/026KIaMlrrkjB872n2KphNFpZcHT05AdFOUszE5VqY4CW+vB+jfJjB9voleoEOyM3pXnDavTnsjjBzEg5Gf14N7ozaVOSUyjGvUhwtStZsDW/ab+S4VKtnIgrAT3JpNoQA7WFy5co/joWEm+OaoXcAkimVHu9z7Mw0U04Cc+FJporDrepx3QVxZKlErT7fxnwpJtNQ,iv:N7DYME5Bw0yFS1ALl+IRvVIBT18CKN8592kZcruJ+yo=,tag:VsIZX/zX1pR3S8Et1FJRRA==,type:str]
+ssh_host_rsa_key_pub: ENC[AES256_GCM,data:sht6BwsKk+f42NpeiOUU9hapkzQmV8NDkfsW6RZqWZOFDjFne0vWNXN6vJWpcUHJklnghJ+wmTuXoumF0Pn3wKQ3zN0E/qFnW0IuIwTT6tfVW5ZrLJByaUCWbHImP4anFWUxqSWzLQc6vwvG5RQ5NjsBeIR3pZv5uARD01g1lFS6iV07waeYP5ktzOhrOG6W7t8XJOInEmozPO3SVfikhHHzDxNCIlX/y8LxdGx6yJsozvW1zPIdDMOw7NY2ehhZmC/1Js2pHqW3U8ZErg1AwPe7CgSxvCQHHCM2ApzRazfh8YcYvsEQ2kRE2luGffM4tD0pXzhRo7LgFt4X+JgUEGBBwwTPFD/n88xZ0j0nJDf5e83hfZo8XXkvFPskO3+iw1DWqQNnczZLSFlkjUkEsdCkNkT0EwWWEn9uul54NF5KAgXH7NGoGW+cbW63WKovGlRkZ2kkbWy7aanAOpy8kyq5Mf62sGhKytjhyqmcJqsH8y17Mdx6unFpWTUY44XDV5bcbVEw24X6I56znoOiq/tDBF/7vR2BBXfw6IOVc12jwcjNPsNxJ2Kot5CM/cvRaCtj/jPKkTxkonPOfeI9zWHVEdtq2Ajk6L32u1QvVLtohgeDQ7WxQQo+M+8AwdpiKcfUOxP7VAnbsVlwb40cEu93GYTm0obcbqHwT1pr1TktbQGPMezMfqTbaEmmrbL+48aRPEL76/PTDPFqFnRFvlPXAsctXcVFaFn71A2oE5LfXgqFg7kZc1pjBWq/Yl8fHayRr688l3kswVxX63alCRkWSOnbYMb+l2zuyW9OMHQzFab2VUCIrW0w4xAHEti3bvpSabLI9yVJXcQ8sljZuscPZ5kgPGcNJanRd3R/BQiGpSkCMBJKLVKFlxLzk+niR1iiUrAPUJuS5T9BvsAh72uhVhNnWdy8bpAcA2BX7djSUWacrMoHDOcBj2CY+rcpWXAXoU6/PZOVwQ7nIchn8zSA,iv:zteYROf+jdDUu86qpfmxrtBgCLXLVcW201VehtKqbxA=,tag:7CaxZ42CqZtc3OmsB1ux+A==,type:str]
+marcel_initial_password: ENC[AES256_GCM,data:kbLHtplwO8gS,iv:RTUHwM26cJVClSHeOkXT7ZQTgJniWAmPMZmrf5bgxos=,tag:xGQoMIlqczT4m4mIjO7KZg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvOGd2bkxjNUNFeGh3Q1NO
+            SVBPSkFTODRMU3FFYlBPdkJ4bVJpVzFzRFE4CkdpcGwydkoxcGtxRXNQZzIvSVpC
+            d29MYzNHTTB2cFYybTF1TW92aEF2TDgKLS0tIGRXNU1PNTUvaVgxd3FnMFlLc1lk
+            a1BmZFIzRStPTGNOU3NZK2NSbld3MFkKHLloAk+YtaEs3JCEMvgdPS9L972poOph
+            jZ2+46UWe16fqQJ8uKiTzrdrA49efdUCuw7k5//BNfgxelS5EeMnhw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-08-09T13:15:03Z"
+    mac: ENC[AES256_GCM,data:cJtDasBhGb2Bsmi748yMcYWBQUBTafGqq4G1jrddQ4jCJ/hwT+jUorsDXfrrq+Wk6TjbfdQHFbbggYaXnfQ5/B8HPvZPK00tefYdrOz/oXg64dqdN1/b1Wxe2FkLiHK27IP4zlQLI3dJu67SHhI+Hj7zkrXFw979vdrYU41rr0Y=,iv:flWI7ZiUgsdZdrTuIOCHH8wJutJcsqJZRAi/lD2tE2E=,tag:uN95Nsu1DkDfLgIJsiXOsw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3