finn.markwitz
3ab8bfbb91
Wires sops-nix into every machine via machines/core/sops.nix so hosts decrypt with their existing SSH host key. Adds a devShell exposing sops/age/ssh-to-age for the operator workflow, which also fixes .envrc's previously no-op `use flake`.
32 lines
981 B
Nix
32 lines
981 B
Nix
# sops-nix plumbing — applied to every machine.
|
|
# See docs/secrets.md for the day-to-day workflow.
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
# Each host defaults to its own secrets/<hostname>.yaml. Override per-secret
|
|
# with sops.secrets.<name>.sopsFile for shared files.
|
|
sops.defaultSopsFile = lib.mkDefault (../../secrets + "/${config.networking.hostName}.yaml");
|
|
sops.defaultSopsFormat = "yaml";
|
|
sops.validateSopsFiles = true;
|
|
|
|
# Decrypt with the host's own SSH host key, converted to age.
|
|
# Explicit rather than inheriting the openssh-derived default, so this does
|
|
# not silently break if services.openssh is ever disabled.
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
sops.age.generateKey = false;
|
|
|
|
# Age only. The default here is the RSA host key imported as a GPG key,
|
|
# which is deprecated and an extra failure surface.
|
|
sops.gnupg.sshKeyPaths = [ ];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
sops
|
|
age
|
|
ssh-to-age
|
|
];
|
|
}
|