finn.markwitz
a00916864c
Proves the sops-nix pipeline end to end on mibook: encrypts a throwaway secret to the operator + mibook host keys, declares it in machines/mibook/secrets.nix, and verifies it decrypts to /run/secrets/placeholder (root:root, 0400) on nixos-rebuild switch. Also removes the dead `let secrets = config.sops.secrets;` binding from both environments.nix files — leftover from an earlier abandoned plan, never referenced.
13 lines
334 B
Nix
13 lines
334 B
Nix
# Secrets decrypted on mibook. sopsFile defaults to secrets/mibook.yaml
|
|
# via machines/core/sops.nix.
|
|
{ ... }:
|
|
{
|
|
# Pipeline smoke test — proves host-key decryption works end to end.
|
|
# Safe to delete once a real secret is in place.
|
|
sops.secrets.placeholder = {
|
|
mode = "0400";
|
|
owner = "root";
|
|
group = "root";
|
|
};
|
|
}
|