nixos

commit d048d54dbfe1b10fa4572b99a222bee1b4ba558b
parent 74093c43498951224008cf194d8104dc9400a542
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed,  9 Aug 2023 15:37:35 +0200

Fix permissions and darling erasure paths

Diffstat:
M
nixos/worker-1/configuration.nix
 | 
15
+++++++++------

1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -175,7 +175,7 @@
 
 
   environment.etc."ssh/ssh_host_rsa_key" = {
-    mode = "0644";
+    mode = "0600";
     source = config.sops.secrets.ssh_host_rsa_key.path;
   };
 
@@ -217,14 +217,17 @@
   # Darling Erasure
   environment.etc = {
     nixos.source = "/persist/etc/nixos";
-    adjtime.source = "/persist/etc/adjtime";
     NIXOS.source = "/persist/etc/NIXOS";
     machine-id.source = "/persist/etc/machine-id";
+    "secrets/initrd/ssh_host_ed25519_key" = {
+      mode = "0600";
+      source = "/persist/etc/secrets/initrd/ssh_host_ed25519_key";
+    };
+    "secrets/initrd/ssh_host_ed25519_key.pub" = {
+      mode = "0644";
+      source = "/persist/etc/secrets/initrd/ssh_host_ed25519_key.pub";
+    };
   };
-  systemd.tmpfiles.rules = [
-    "L /etc/secrets/initrd/ssh_host_ed25519_key - - - - /persist/etc/secrets/initrd/ssh_host_ed25519_key"
-    "L /etc/secrets/initrd/ssh_host_ed25519_key.pub - - - - /persist/etc/secrets/initrd/ssh_host_ed25519_key.pub"
-  ];
   security.sudo.extraConfig = ''
     # rollback results in sudo lectures after each reboot
     Defaults lecture = never