From 031b8a7f09b59055959284e5d6317400884ad15e Mon Sep 17 00:00:00 2001 From: Devin Finlinson Date: Fri, 4 Sep 2026 03:59:02 -0600 Subject: trying out sops-nix for secrets management documented here: https://github.com/Mic92/sops-nix?tab=readme-ov-file --- .sops.yaml | 21 +++++++++++++++++++ flake.nix | 4 +++- modules/nixos/sops.nix | 15 +++++++++++++ modules/nixos/system-packages.nix | 2 ++ secrets/biski/api.yaml | 28 +++++++++++++++++++++++++ secrets/example.yaml | 44 +++++++++++++++++++++++++++++++++++++++ 6 files changed, 113 insertions(+), 1 deletion(-) create mode 100644 .sops.yaml create mode 100644 modules/nixos/sops.nix create mode 100644 secrets/biski/api.yaml create mode 100644 secrets/example.yaml diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..201bcc5 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,21 @@ +# https://github.com/Mic92/sops-nix?tab=readme-ov-file#generate-a-key-for-yourself +keys: + - &defin_zenbook age1elwua27zpyazka2l2k3djq7nc0dsclvhd8yknc07u3uqj0hnkfasmmfz6w + - &root_zenbook age1yxfe6zpmxckth5dzp0emzfjrrxhjs7h6x33ally8ka4sxawqw9zqkkxpgm + - &server_biski age1k38l2drejmpr9dd24zy0dglzny0703yxg8ff29q2yyjlmmpu7g6q60hz4x +creation_rules: + - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ + key_groups: + - age: + - *defin_zenbook + - *server_biski + - *root_zenbook + # pgp: + # - *insert_here + - path_regex: secrets/biski/[^/]+\.(yaml|json|env|ini)$ + key_groups: + - age: + - *defin_zenbook + - *server_biski + # pgp: + # - *insert_here diff --git a/flake.nix b/flake.nix index f421e00..2100ba8 100644 --- a/flake.nix +++ b/flake.nix @@ -308,6 +308,9 @@ ./modules/nixos/system-packages.nix ./modules/nixos/tailscale.nix + sops-nix.nixosModules.sops + ./modules/nixos/sops.nix + ./modules/users/defin.nix ./modules/users/root.nix # # Let 'nixos-version --json' know the Git revision of this flake. (for containers?) @@ -343,7 +346,6 @@ khad = lib.nixosSystem { # Main desktop modules = minimalModuleConfig ++ [ ./machines/khad # lix-module.nixosModules.default - sops-nix.nixosModules.sops home-manager.nixosModules.home-manager { home-manager.users.defin = import ./home-manager/gaming.nix; } ]; }; diff --git a/modules/nixos/sops.nix b/modules/nixos/sops.nix new file mode 100644 index 0000000..41e828e --- /dev/null +++ b/modules/nixos/sops.nix @@ -0,0 +1,15 @@ +{config, ... }: { + # This will add secrets.yml to the nix store + # You can avoid this by adding a string to the full path instead, i.e. + # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; + sops.defaultSopsFile = ../../secrets/example.yaml; + # This will automatically import SSH keys as age keys + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + # This is using an age key that is expected to already be in the filesystem + sops.age.keyFile = "/var/lib/sops-nix/key.txt"; + # This will generate a new key if the key specified above does not exist + sops.age.generateKey = true; + # This is the actual specification of the secrets. + # sops.secrets.example-key = {}; + # sops.secrets.example_array = {}; +} diff --git a/modules/nixos/system-packages.nix b/modules/nixos/system-packages.nix index 6430915..b29388b 100644 --- a/modules/nixos/system-packages.nix +++ b/modules/nixos/system-packages.nix @@ -3,7 +3,9 @@ environment.systemPackages = with pkgs; [ #For root age + sops nix-tree + ssh-to-age nushell bat # helix diff --git a/secrets/biski/api.yaml b/secrets/biski/api.yaml new file mode 100644 index 0000000..caae5b7 --- /dev/null +++ b/secrets/biski/api.yaml @@ -0,0 +1,28 @@ +porkbun: + api: + secret: ENC[AES256_GCM,data:FH1VvwBOJRr77WV8/1Q7/ad2zSIAEZc9eJC5JMXNbUzg1gVXsfOvd1dH8Lk5ftsmbaIRROukZoX45KVZK6RDcf8UzqE=,iv:8ylwfaSp78ffGQtuyUCr9J2H4A+cugQqpsTCitTyu8M=,tag:kxEyPmYZMvkzKYoIyduBNA==,type:str] + api_key: ENC[AES256_GCM,data:52HK2eKMvxC0abGN1A03yDaNKzQ5f+6vfsP33wqO4T8pW99sVzkM//tZ2Je0meNs2xeyYpAVXjIZDZSVuma55pw+TRY=,iv:GfeIyftzgBCUD8ervmFnp6sg6Jh3oTSveZVcu1xoGLk=,tag:1twFOpl/Qrlewphxl8AQ1A==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMkpmTjNmaHZxaXZJUmta + WlYrOTZ2YlpMV0thbnJseHMrYm1nSm90QlZzCjErd0JydFRaSE1DMEJKK1FaN0R5 + cWoza2dVV0RiRm1FQnZubGI2Q1BBRmMKLS0tIGpEV3dPc1ZNaW9pQlpaZEdyUTFI + V2dSc1lzbGo4NWlXSHROQnpYUVVWM3cK96NnR47/zh/zAjCcty9J9B27B9J2LFUF + zXU2+pk2tryJIsp5FVFmHd5gSKtDDxgQ3WddtbhujbqOCMTACnCfhw== + -----END AGE ENCRYPTED FILE----- + recipient: age1elwua27zpyazka2l2k3djq7nc0dsclvhd8yknc07u3uqj0hnkfasmmfz6w + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiQmIrcEREQTFTS2FoSVhr + b1FFRkVTRHpmZDNvSmdxZUZudm90c0VvU2dJCkN0MGxsYVpwbVlHNDNYaUZyNTV4 + OWNnOVFYT1h1V2dhS0NoU0VUV1hqVE0KLS0tIHp3QkpMZ0w4QStpQnZJS1h4U1Rk + SHlkZmdGL09mK0dpOE9HcFBPcmR2V0UKRZvKwe7VXv1vl0wJ3ORyEcZtiZOlWQkI + 7JwzL+SjWbB17oHEhjQ9Boide6aznwYT0rkUWCjZaOu9QsqWsrB+VQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1k38l2drejmpr9dd24zy0dglzny0703yxg8ff29q2yyjlmmpu7g6q60hz4x + lastmodified: "2026-09-04T09:34:44Z" + mac: ENC[AES256_GCM,data:i7KKPzBkoaN5/c7gf4IFVQgjhM4ODUF/CCDupWW4cresNbaiYFZl+CUh6s9eht1mBseCKT7PtTSMogd4KV7c0p3d10hxRQPgqUEC2BplHD8bNRqb+jrjm3xtyy5WgntqVg7qi4WdUn1dD/q5jLW7/aaCI6aRTtsMcaEyVET8TTU=,iv:1mPNAQoxCwTC0D4N1+pBTdjeXXUIddDUA+b0Hpobng8=,tag:GZ0ZQ68XPmQsBikcU31rzg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3 diff --git a/secrets/example.yaml b/secrets/example.yaml new file mode 100644 index 0000000..492c0dc --- /dev/null +++ b/secrets/example.yaml @@ -0,0 +1,44 @@ +hello: ENC[AES256_GCM,data:TxSuMQ4JdDl2zjDXOgUpJLXltEzfTkyI3TE78dssxf9d2zUu5wclK0CS1tT6yQ==,iv:nMMJAAyZBr48v9b5bLcFgxaPkK1Nx7o9sTWbIBCAR2U=,tag:sBmWH18ya19eF9qvTRRX0w==,type:str] +example_key: ENC[AES256_GCM,data:MfVINYFL1yKbLdH7Hg==,iv:G6787F+lwGTpfg9QQLLSu7FvGTVNp+btJADNTizpNXs=,tag:vIxSCMLDxeDbJFAp9Q0j+w==,type:str] +#ENC[AES256_GCM,data:7/cjr5hO1GmlOmNPdcFK/A==,iv:9YtMaHUUhUsPbSrbc4MPVDodB6iZgotJ4u4X2hUqT+Q=,tag:VHBbaS69StjSywCTaY73gA==,type:comment] +example_array: + - ENC[AES256_GCM,data:WSmXVvOS90gP6Svg/yU=,iv:AQqXt2R/0AtPzpVxHGfMBljxEQz/f7w1DLyMyhyFzv8=,tag:zDZH+n85toJhcBpLjxZdWg==,type:str] + - ENC[AES256_GCM,data:QIQuAGMC6hHonrmg7+I=,iv:K7wsLv2qlE3+d/GTElOu45wSMRfqNv4ZA8/fNQZhIHs=,tag:6/WJXqSLYRC+te7vAWuofQ==,type:str] + - ENC[AES256_GCM,data:UBGVYrK0H8PgB3iVdrE=,iv:aDnq0JAb0CCyjWbirOo+Hq52fn4AAaNudPuYab2jRwY=,tag:xI+6nNm/4vJt2xvysRK6Mw==,type:str] +example_number: ENC[AES256_GCM,data:R7S5j/IgOY/u4A==,iv:yo3AyKMhkPsKl+hvZPBlK0CN2g646OFX0hOFD6JWt5A=,tag:4S2Uhvr+gD66yM8VtK+6dQ==,type:float] +example_booleans: + - ENC[AES256_GCM,data:eNR8Jw==,iv:exL/Ga5Jdp44EGMsYnP0U0NohRY09m8BCrXZKgDTa4o=,tag:lDeNoSpdbU3JoTjE1a0qmg==,type:bool] + - ENC[AES256_GCM,data:WcVg9i8=,iv:vKEFlnk1d1dwVCuAnSqxNtdHW4aCRb1HqpxmL820n3Q=,tag:IEq9zGhH3Ghk0M510izUzA==,type:bool] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzeUZMbGc5SXVIcTFwREE4 + N0hLdUZ2ZmoxdTh6S3VMT0F6ZEZlNHhuZWk0CnNIOUEycFdpVzZLMC9seXFLSEd0 + WnJjWm9rWmU5VjJBMjEycThPTHFva1UKLS0tIElCMlRWQ0gvNnEwUTgzVUNHcDVq + elJvemdKejB0amIyTnpZR2dHK1liemsKnOPViyGNcJ+WU6U1nfPglGs/l/n6oUiz + Raa2Kixa4naTCnuSweQD0yiu/I9ZxRi3ytibvFLsQGRB9p8egLl+bw== + -----END AGE ENCRYPTED FILE----- + recipient: age1elwua27zpyazka2l2k3djq7nc0dsclvhd8yknc07u3uqj0hnkfasmmfz6w + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4aG1tZXpvZDNrNm1nY2o1 + VEs2cEpMMHZwYUY1OSswN21QVTNiMGZycXh3CndZQUhGd2hqcm5jYWJrdXRERHNM + SjBUZVNhYkp1cW5GUTZLaEljMWFGVWcKLS0tIHd5RUpuTmhrdFZRNEd0bFl5VUtO + bk0ra2U1OVZkN01iZ1dkbXdwUnV3Z0EKheToYSNedDspJ2UKPq22+EHYsoH7JqiV + APq/wHPmVv5UtdB/xsWKaOY9tXMhEI8D+o7ROdOEWd8BMc6sdmleTA== + -----END AGE ENCRYPTED FILE----- + recipient: age1k38l2drejmpr9dd24zy0dglzny0703yxg8ff29q2yyjlmmpu7g6q60hz4x + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUTHhWQ3lPV0tNYk9NWW1v + ckh3TnBzMHUwRDlBQjNlT1RMRGpzZXV5dFN3Cm1FSkplZGcwa1NPdzdGa3FKMlJo + N0hRSjlYQWdGWHRnbVM3VVdRMCtTaUUKLS0tIC9RNUFMNlNYVitBM1dFdm44cGJ5 + MVBTcHdOTkxBeWxVODlSaGtDZUtodVUKwLok7EHhzQwiZJgq88WQQQ1iZxYWphS+ + XWJHk8uD3ipcOx079o8zhnFJ15E7MmBr81i9MHGy5cDnkaeI8TBJBA== + -----END AGE ENCRYPTED FILE----- + recipient: age1yxfe6zpmxckth5dzp0emzfjrrxhjs7h6x33ally8ka4sxawqw9zqkkxpgm + lastmodified: "2026-09-04T09:31:35Z" + mac: ENC[AES256_GCM,data:ba6NogjnL6zr9/3soWp4I/xDWh/+zqbZreWPN5kfPLNeDEVf46fsB7CEHXPtYl7K1KTuZwpfu17Zka2PBqL+IW/l8HiwY/y0tSaXdPZrc68YRnmSTot8CYKkfrIh27DJ0ueEHyTdJcfDsndQYWbGhgJ1rlpv2kTAtvNy/7OlEsM=,iv:P9lLDLWxug4xiid6qV+Sde7X4xIotQuVYFPi8mSolpU=,tag:Z/0A7FUCt1nrpLSnFna1Rg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3 -- cgit v1.3.1