finn.markwitz
a00916864c
Proves the sops-nix pipeline end to end on mibook: encrypts a throwaway secret to the operator + mibook host keys, declares it in machines/mibook/secrets.nix, and verifies it decrypts to /run/secrets/placeholder (root:root, 0400) on nixos-rebuild switch. Also removes the dead `let secrets = config.sops.secrets;` binding from both environments.nix files — leftover from an earlier abandoned plan, never referenced.
Private NixOS Configuration
Structure
.
├── images # custom image generations
├── machines # machine definitions
├── modules # own nix-options, to modularize services/hardware/...
├── overlays # overlays
├── pkgs # own packages, which are not available in nixpkgs
└── environments # summarize module collections into single options
Commands
# Rebuild (switch/boot/test)
sudo nixos-rebuild switch --flake '.#jupiter'
# Update Flake
nix flake update
# Channel list
sudo nix-channel --list
# Channel update
sudo nix-channel --update