infrastructure

commit 5d8ab8aff756a180a68946b71cda773b5823ea11
parent 7d89c3af10626c4493cb7ad94c0a7a1200e88732
Author: Silas Brack <silasbrack@gmail.com>
Date:   Tue,  1 Oct 2024 07:50:39 +0200

Add sops support

Diffstat:
A
infrastructure/.sops.yaml
 | 
8
++++++++
M
infrastructure/hive.nix
 | 
13
+++++++++++++
M
infrastructure/shell.nix
 | 
2
+-

3 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/infrastructure/.sops.yaml b/infrastructure/.sops.yaml
@@ -0,0 +1,8 @@
+keys:
+  - &desktop age1s29qgfupgx7mqn9dk2rndp6xh63f5qan8vqa77ve603wd5m9a9rqkpq7re
+  - &thinkpad age10h669gfc0yfdrfj4gtnsrpdfvrsh55tn0cj8kuk5t3x5e079dpgs30cuxw
+creation_rules:
+  - path_regex: secrets/sops/secrets.yaml
+    key_groups:
+      - age:
+          - *desktop
diff --git a/infrastructure/hive.nix b/infrastructure/hive.nix
@@ -45,6 +45,19 @@ in {
     # networking.firewall.allowedTCPPorts = [ 8000 ];
     security.pki.certificateFiles = [ ./secrets/ca-certificate.crt ];
 
+    # # This will add secrets.yml to the nix store
+    # # You can avoid this by adding a string to the full path instead, i.e.
+    # # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
+    # sops.defaultSopsFile = ./secrets/example.yaml;
+    # # This will automatically import SSH keys as age keys
+    # sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    # # This is using an age key that is expected to already be in the filesystem
+    # sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+    # # This will generate a new key if the key specified above does not exist
+    # sops.age.generateKey = true;
+    # # This is the actual specification of the secrets.
+    # sops.secrets.example-key = {};
+    # sops.secrets."myservice/my_subdir/my_secret" = {};
 
     users.users.silas = {
       isNormalUser = true;
diff --git a/infrastructure/shell.nix b/infrastructure/shell.nix
@@ -1,5 +1,5 @@
 { pkgs ? import <nixpkgs> { } }:
 pkgs.mkShell {
-  buildInputs = with pkgs; [ curl morph colmena wireguard-tools ];
+  buildInputs = with pkgs; [ curl colmena wireguard-tools sops ];
 }