infrastructure

commit 02008a2fa97e27dd4d20ad0915b9af140823d9c1
parent 5d8ab8aff756a180a68946b71cda773b5823ea11
Author: Silas Brack <silasbrack@gmail.com>
Date:   Thu,  3 Oct 2024 13:38:51 +0200

Add functioning sops

Diffstat:
M
infrastructure/.sops.yaml
 | 
9
+++++++--
M
infrastructure/hive.nix
 | 
38
++++++++++++++++++--------------------
M
infrastructure/vpn.nix
 | 
2
+-

3 files changed, 26 insertions(+), 23 deletions(-)
diff --git a/infrastructure/.sops.yaml b/infrastructure/.sops.yaml
@@ -1,8 +1,13 @@
 keys:
-  - &desktop age1s29qgfupgx7mqn9dk2rndp6xh63f5qan8vqa77ve603wd5m9a9rqkpq7re
-  - &thinkpad age10h669gfc0yfdrfj4gtnsrpdfvrsh55tn0cj8kuk5t3x5e079dpgs30cuxw
+  - &users:
+    - &desktop age1s29qgfupgx7mqn9dk2rndp6xh63f5qan8vqa77ve603wd5m9a9rqkpq7re
+    - &thinkpad age10h669gfc0yfdrfj4gtnsrpdfvrsh55tn0cj8kuk5t3x5e079dpgs30cuxw
+  - &hosts:
+    - &server age1e52v0cr69sycuh59hksx9nk5327vgkemkxqwngd25gtztxhkpups87yd5g
 creation_rules:
   - path_regex: secrets/sops/secrets.yaml
     key_groups:
       - age:
           - *desktop
+          - *thinkpad
+          - *server
diff --git a/infrastructure/hive.nix b/infrastructure/hive.nix
@@ -1,9 +1,14 @@
 let
   nixos_24_05 = builtins.fetchTarball {
-      name = "nixos-24.05";
-      url = "https://github.com/nixos/nixpkgs/archive/63dacb46bf939521bdc93981b4cbb7ecb58427a0.tar.gz";
-      sha256 = "1lr1h35prqkd1mkmzriwlpvxcb34kmhc9dnr48gkm8hh089hifmx";
-    };
+    name = "nixos-24.05";
+    url = "https://github.com/nixos/nixpkgs/archive/63dacb46bf939521bdc93981b4cbb7ecb58427a0.tar.gz";
+    sha256 = "1lr1h35prqkd1mkmzriwlpvxcb34kmhc9dnr48gkm8hh089hifmx";
+  };
+  sops_nix = "${builtins.fetchTarball {
+    url = "https://github.com/Mic92/sops-nix/archive/3198a242e547939c5e659353551b0668ec150268.tar.gz";
+    sha256 = "0b7x86lvjfkxpxnf2dl7mf8rvsyhsn0xjmgaw8m58286191wp3lb";
+  }}/modules/sops";
+
 in {
   meta = {
     nixpkgs = (import nixos_24_05) {};
@@ -30,8 +35,8 @@ in {
     deployment = {
       targetHost = "188.166.127.72";
       targetUser = "root";
-      keys."wireguard_server_key.private" = {
-        keyFile = ./secrets/wireguard-keys/server.private;
+      keys."sops.txt" = {
+        keyFile = ./secrets/server_age_private_key.txt;
       };
     };
     networking.hostName = name;
@@ -39,25 +44,18 @@ in {
 
     imports = [
       ./vpn.nix
+      sops_nix
       # ./_apps/hello.nix
       # ../apps/my-app/module.nix
     ];
     # networking.firewall.allowedTCPPorts = [ 8000 ];
     security.pki.certificateFiles = [ ./secrets/ca-certificate.crt ];
 
-    # # This will add secrets.yml to the nix store
-    # # You can avoid this by adding a string to the full path instead, i.e.
-    # # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
-    # sops.defaultSopsFile = ./secrets/example.yaml;
-    # # This will automatically import SSH keys as age keys
-    # sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-    # # This is using an age key that is expected to already be in the filesystem
-    # sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-    # # This will generate a new key if the key specified above does not exist
-    # sops.age.generateKey = true;
-    # # This is the actual specification of the secrets.
-    # sops.secrets.example-key = {};
-    # sops.secrets."myservice/my_subdir/my_secret" = {};
+    sops.defaultSopsFile = ./secrets/sops/secrets.yaml;
+    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    sops.secrets.server_wireguard_key = {
+      restartUnits = [ "wg-quick-wg0.service" ];
+    };
 
     users.users.silas = {
       isNormalUser = true;
@@ -79,7 +77,7 @@ in {
     # };
 
     # services.postgres = {
-    #   
+    #   enable = true;
     # };
 
     services.nginx = {
diff --git a/infrastructure/vpn.nix b/infrastructure/vpn.nix
@@ -26,7 +26,7 @@
     wg0 = {
       address = [ "10.100.0.1/24" ];
       listenPort = 51820;
-      privateKeyFile = "/run/keys/wireguard_server_key.private";
+      privateKeyFile = "/run/secrets/server_wireguard_key";
 
       postUp = ''
         ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT