From 532832e693f1881145b5e41b2dbaba24d8a3b77b Mon Sep 17 00:00:00 2001 From: Djai Hougee Date: Sun, 27 Sep 2026 22:46:38 +0200 Subject: [PATCH] ft: certificates --- flake.lock | 12 ++++++------ modules/certificates.nix | 9 --------- modules/certificates/default.nix | 9 +++++++++ modules/certificates/npm-private.cert | 11 +++++++++++ modules/certificates/npm-public.cert | 11 +++++++++++ modules/certificates/npm-shared.cert | 11 +++++++++++ modules/default.nix | 2 +- secrets/default.nix | 17 +++++++---------- 8 files changed, 56 insertions(+), 26 deletions(-) delete mode 100644 modules/certificates.nix create mode 100644 modules/certificates/default.nix create mode 100644 modules/certificates/npm-private.cert create mode 100644 modules/certificates/npm-public.cert create mode 100644 modules/certificates/npm-shared.cert diff --git a/flake.lock b/flake.lock index c2f4fdb..e470f95 100644 --- a/flake.lock +++ b/flake.lock @@ -59,11 +59,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1790185690, - "narHash": "sha256-xJ+X4hBtOcAFGBOe5nAMyMUeF9foJBmIOu3NjBqBycU=", + "lastModified": 1790463110, + "narHash": "sha256-hKlVl12B1dF0Q5vd9dY3lIJM5mFGWYSlXwSLAqHZ1+s=", "owner": "nixos", "repo": "nixpkgs", - "rev": "4975466d324710c576dc11ad614684e6bd8cad8e", + "rev": "e158d9ed9b51c98974c5e66e1ba1c9e0255fecaa", "type": "github" }, "original": { @@ -106,11 +106,11 @@ ] }, "locked": { - "lastModified": 1790247521, - "narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=", + "lastModified": 1790498116, + "narHash": "sha256-rs9meAYxW3zzrh43yaW7htrqCD+X9+pupDPHN86fumI=", "owner": "Mic92", "repo": "sops-nix", - "rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f", + "rev": "5efb5a6f4f5ab192817d28557dd4d650fa14d866", "type": "github" }, "original": { diff --git a/modules/certificates.nix b/modules/certificates.nix deleted file mode 100644 index 44ca5c3..0000000 --- a/modules/certificates.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ config, ... }: - -{ - security.pki.certificateFiles = [ - config.sops.secrets."npm-certificate-private".path - config.sops.secrets."npm-certificate-shared".path - config.sops.secrets."npm-certificate-public".path - ]; -} diff --git a/modules/certificates/default.nix b/modules/certificates/default.nix new file mode 100644 index 0000000..e5454cb --- /dev/null +++ b/modules/certificates/default.nix @@ -0,0 +1,9 @@ +{ ... }: + +{ + security.pki.certificateFiles = [ + ./npm-public.cert + ./npm-shared.cert + ./npm-private.cert + ]; +} diff --git a/modules/certificates/npm-private.cert b/modules/certificates/npm-private.cert new file mode 100644 index 0000000..dd3b139 --- /dev/null +++ b/modules/certificates/npm-private.cert @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBpDCCAUmgAwIBAgIQKYWQSCfwVkoBcMlYoDWFEjAKBggqhkjOPQQDAjAwMS4w +LAYDVQQDEyVDYWRkeSBMb2NhbCBBdXRob3JpdHkgLSAyMDI2IEVDQyBSb290MB4X +DTI2MDgxMTEzNTEwMVoXDTM2MDYxOTEzNTEwMVowMDEuMCwGA1UEAxMlQ2FkZHkg +TG9jYWwgQXV0aG9yaXR5IC0gMjAyNiBFQ0MgUm9vdDBZMBMGByqGSM49AgEGCCqG +SM49AwEHA0IABMrJos0wgv1gdxCUCAtOu3H9AXgrcT1Uq5I/VRWKj3n9CxTMPV0I +uwfibHXcl4ISIF4ZucH7X4XpViuoCwcOmYajRTBDMA4GA1UdDwEB/wQEAwIBBjAS +BgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBTe+quCrAEMQfGzyCMrxaHIMlEc +uTAKBggqhkjOPQQDAgNJADBGAiEAldwjyoBJvOu42CW6G/p+Qp9hHS6P7lxXlgtL +qhJQAFICIQCX5VDTPxD5DTYRKlV1R77hiIQyVhevrC+Ho+BitCoo8g== +-----END CERTIFICATE----- diff --git a/modules/certificates/npm-public.cert b/modules/certificates/npm-public.cert new file mode 100644 index 0000000..01bd097 --- /dev/null +++ b/modules/certificates/npm-public.cert @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBpTCCAUqgAwIBAgIRAMcXyr7hVrTNVbzI/i1qgy4wCgYIKoZIzj0EAwIwMDEu +MCwGA1UEAxMlQ2FkZHkgTG9jYWwgQXV0aG9yaXR5IC0gMjAyNiBFQ0MgUm9vdDAe +Fw0yNjA4MDkyMTU0MDJaFw0zNjA2MTcyMTU0MDJaMDAxLjAsBgNVBAMTJUNhZGR5 +IExvY2FsIEF1dGhvcml0eSAtIDIwMjYgRUNDIFJvb3QwWTATBgcqhkjOPQIBBggq +hkjOPQMBBwNCAAQboPA+AwV7f/1DHIss14y2oRSGlZliIco/ZPiX3hf5KabdEicc +r927AqvOetD3BbandJrQ688nS4bNNcjRdTOHo0UwQzAOBgNVHQ8BAf8EBAMCAQYw +EgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUS69zAYDPn70bjJKC03FMpiLb +AiowCgYIKoZIzj0EAwIDSQAwRgIhAKQeq43JpGDJhqM7Lb+qacW3BULnRwLXqu4W +i8x0efjMAiEAxXImIk0WBMrDdn7LXLtypLKZOESWwgnUC8WHqCHXIBM= +-----END CERTIFICATE----- diff --git a/modules/certificates/npm-shared.cert b/modules/certificates/npm-shared.cert new file mode 100644 index 0000000..6f1a881 --- /dev/null +++ b/modules/certificates/npm-shared.cert @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBozCCAUqgAwIBAgIRAJC2Mmysb+v6AixTRrQT1SUwCgYIKoZIzj0EAwIwMDEu +MCwGA1UEAxMlQ2FkZHkgTG9jYWwgQXV0aG9yaXR5IC0gMjAyNiBFQ0MgUm9vdDAe +Fw0yNjA4MTExNjI5MjFaFw0zNjA2MTkxNjI5MjFaMDAxLjAsBgNVBAMTJUNhZGR5 +IExvY2FsIEF1dGhvcml0eSAtIDIwMjYgRUNDIFJvb3QwWTATBgcqhkjOPQIBBggq +hkjOPQMBBwNCAATUTJTmZya4EOqpeplWrqaROhRCp1044NUsC9LnxBJuXDwlw+TP +YXz74j3HPE42n/9KZ8YwllZjrfLrv+z2TyGdo0UwQzAOBgNVHQ8BAf8EBAMCAQYw +EgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUMb3pwaVS7eWFEYibRyG8Cvx+ +B0gwCgYIKoZIzj0EAwIDRwAwRAIgWs70jRH/Ep/fpy0XomV9783GEcYHtOp8JjZS +HKXJEPYCIGQ166l7ui3W2PQGBarMQ+WNDs6RYsfpWtsS/BUB+aFv +-----END CERTIFICATE----- diff --git a/modules/default.nix b/modules/default.nix index 8b734b3..9bf8eb9 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -4,7 +4,7 @@ ./apps.nix ./audio ./base.nix - ./certificates.nix + ./certificates ./desktop ./dev.nix ./email.nix diff --git a/secrets/default.nix b/secrets/default.nix index d3fedbc..7c1fb30 100644 --- a/secrets/default.nix +++ b/secrets/default.nix @@ -2,11 +2,13 @@ # Each secret is a file stored in this directory as binary files (edit with `sops edit `) let # make secrets readable by our processes - djaiOnly = { + rootOnly = { format = "binary"; - owner = "djai"; mode = "0400"; }; + djaiOnly = rootOnly // { + owner = "djai"; + }; in { # machine's age key, also used by `sops edit`. @@ -22,13 +24,13 @@ in }; # npm caddy certificates - "npm-certificate-private" = djaiOnly // { + "npm-certificate-private" = rootOnly // { sopsFile = ./npm-certificate-private.bin; }; - "npm-certificate-shared" = djaiOnly // { + "npm-certificate-shared" = rootOnly // { sopsFile = ./npm-certificate-shared.bin; }; - "npm-certificate-public" = djaiOnly // { + "npm-certificate-public" = rootOnly // { sopsFile = ./npm-certificate-public.bin; }; @@ -39,10 +41,5 @@ in "wg-config-tuxcomp" = djaiOnly // { sopsFile = ./wg-config-tuxcomp.bin; }; - - # thunderbird's logins.json + key4.db as a tarball, seeded on fresh hosts. - "thunderbird-creds" = djaiOnly // { - sopsFile = ./thunderbird-creds.bin; - }; }; }