djaidjai/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ft: certificates

Browse Source
This commit is contained in:
Djai Hougee
2026-09-27 22:46:38 +02:00
parent 623edfd8b4
commit 532832e693
8 changed files with 56 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
flake.lock generated
View File

@@ -59,11 +59,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1790185690, "lastModified": 1790463110,
"narHash": "sha256-xJ+X4hBtOcAFGBOe5nAMyMUeF9foJBmIOu3NjBqBycU=", "narHash": "sha256-hKlVl12B1dF0Q5vd9dY3lIJM5mFGWYSlXwSLAqHZ1+s=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "4975466d324710c576dc11ad614684e6bd8cad8e", "rev": "e158d9ed9b51c98974c5e66e1ba1c9e0255fecaa",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -106,11 +106,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1790247521, "lastModified": 1790498116,
"narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=", "narHash": "sha256-rs9meAYxW3zzrh43yaW7htrqCD+X9+pupDPHN86fumI=",
"owner": "Mic92", "owner": "Mic92",
"repo": "sops-nix", "repo": "sops-nix",
"rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f", "rev": "5efb5a6f4f5ab192817d28557dd4d650fa14d866",
"type": "github" "type": "github"
}, },
"original": { "original": {

9
modules/certificates.nix
View File

@@ -1,9 +0,0 @@
{ config, ... }:
{
security.pki.certificateFiles = [
config.sops.secrets."npm-certificate-private".path
config.sops.secrets."npm-certificate-shared".path
config.sops.secrets."npm-certificate-public".path
];
}

9
modules/certificates/default.nix Normal file
View File

@@ -0,0 +1,9 @@
{ ... }:
{
security.pki.certificateFiles = [
./npm-public.cert
./npm-shared.cert
./npm-private.cert
];
}

11
modules/certificates/npm-private.cert Normal file
View File

@@ -0,0 +1,11 @@
-----BEGIN CERTIFICATE-----
MIIBpDCCAUmgAwIBAgIQKYWQSCfwVkoBcMlYoDWFEjAKBggqhkjOPQQDAjAwMS4w
LAYDVQQDEyVDYWRkeSBMb2NhbCBBdXRob3JpdHkgLSAyMDI2IEVDQyBSb290MB4X
DTI2MDgxMTEzNTEwMVoXDTM2MDYxOTEzNTEwMVowMDEuMCwGA1UEAxMlQ2FkZHkg
TG9jYWwgQXV0aG9yaXR5IC0gMjAyNiBFQ0MgUm9vdDBZMBMGByqGSM49AgEGCCqG
SM49AwEHA0IABMrJos0wgv1gdxCUCAtOu3H9AXgrcT1Uq5I/VRWKj3n9CxTMPV0I
uwfibHXcl4ISIF4ZucH7X4XpViuoCwcOmYajRTBDMA4GA1UdDwEB/wQEAwIBBjAS
BgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBTe+quCrAEMQfGzyCMrxaHIMlEc
uTAKBggqhkjOPQQDAgNJADBGAiEAldwjyoBJvOu42CW6G/p+Qp9hHS6P7lxXlgtL
qhJQAFICIQCX5VDTPxD5DTYRKlV1R77hiIQyVhevrC+Ho+BitCoo8g==
-----END CERTIFICATE-----

11
modules/certificates/npm-public.cert Normal file
View File

@@ -0,0 +1,11 @@
-----BEGIN CERTIFICATE-----
MIIBpTCCAUqgAwIBAgIRAMcXyr7hVrTNVbzI/i1qgy4wCgYIKoZIzj0EAwIwMDEu
MCwGA1UEAxMlQ2FkZHkgTG9jYWwgQXV0aG9yaXR5IC0gMjAyNiBFQ0MgUm9vdDAe
Fw0yNjA4MDkyMTU0MDJaFw0zNjA2MTcyMTU0MDJaMDAxLjAsBgNVBAMTJUNhZGR5
IExvY2FsIEF1dGhvcml0eSAtIDIwMjYgRUNDIFJvb3QwWTATBgcqhkjOPQIBBggq
hkjOPQMBBwNCAAQboPA+AwV7f/1DHIss14y2oRSGlZliIco/ZPiX3hf5KabdEicc
r927AqvOetD3BbandJrQ688nS4bNNcjRdTOHo0UwQzAOBgNVHQ8BAf8EBAMCAQYw
EgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUS69zAYDPn70bjJKC03FMpiLb
AiowCgYIKoZIzj0EAwIDSQAwRgIhAKQeq43JpGDJhqM7Lb+qacW3BULnRwLXqu4W
i8x0efjMAiEAxXImIk0WBMrDdn7LXLtypLKZOESWwgnUC8WHqCHXIBM=
-----END CERTIFICATE-----

11
modules/certificates/npm-shared.cert Normal file
View File

@@ -0,0 +1,11 @@
-----BEGIN CERTIFICATE-----
MIIBozCCAUqgAwIBAgIRAJC2Mmysb+v6AixTRrQT1SUwCgYIKoZIzj0EAwIwMDEu
MCwGA1UEAxMlQ2FkZHkgTG9jYWwgQXV0aG9yaXR5IC0gMjAyNiBFQ0MgUm9vdDAe
Fw0yNjA4MTExNjI5MjFaFw0zNjA2MTkxNjI5MjFaMDAxLjAsBgNVBAMTJUNhZGR5
IExvY2FsIEF1dGhvcml0eSAtIDIwMjYgRUNDIFJvb3QwWTATBgcqhkjOPQIBBggq
hkjOPQMBBwNCAATUTJTmZya4EOqpeplWrqaROhRCp1044NUsC9LnxBJuXDwlw+TP
YXz74j3HPE42n/9KZ8YwllZjrfLrv+z2TyGdo0UwQzAOBgNVHQ8BAf8EBAMCAQYw
EgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUMb3pwaVS7eWFEYibRyG8Cvx+
B0gwCgYIKoZIzj0EAwIDRwAwRAIgWs70jRH/Ep/fpy0XomV9783GEcYHtOp8JjZS
HKXJEPYCIGQ166l7ui3W2PQGBarMQ+WNDs6RYsfpWtsS/BUB+aFv
-----END CERTIFICATE-----

2
modules/default.nix
View File

@@ -4,7 +4,7 @@
./apps.nix ./apps.nix
./audio ./audio
./base.nix ./base.nix
./certificates.nix ./certificates
./desktop ./desktop
./dev.nix ./dev.nix
./email.nix ./email.nix

17
secrets/default.nix
View File

@@ -2,11 +2,13 @@
# Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`) # Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
let let
# make secrets readable by our processes # make secrets readable by our processes
djaiOnly = { rootOnly = {
format = "binary"; format = "binary";
owner = "djai";
mode = "0400"; mode = "0400";
}; };
djaiOnly = rootOnly // {
owner = "djai";
};
in in
{ {
# machine's age key, also used by `sops edit`. # machine's age key, also used by `sops edit`.
@@ -22,13 +24,13 @@ in
}; };
# npm caddy certificates # npm caddy certificates
"npm-certificate-private" = djaiOnly // { "npm-certificate-private" = rootOnly // {
sopsFile = ./npm-certificate-private.bin; sopsFile = ./npm-certificate-private.bin;
}; };
"npm-certificate-shared" = djaiOnly // { "npm-certificate-shared" = rootOnly // {
sopsFile = ./npm-certificate-shared.bin; sopsFile = ./npm-certificate-shared.bin;
}; };
"npm-certificate-public" = djaiOnly // { "npm-certificate-public" = rootOnly // {
sopsFile = ./npm-certificate-public.bin; sopsFile = ./npm-certificate-public.bin;
}; };
@@ -39,10 +41,5 @@ in
"wg-config-tuxcomp" = djaiOnly // { "wg-config-tuxcomp" = djaiOnly // {
sopsFile = ./wg-config-tuxcomp.bin; sopsFile = ./wg-config-tuxcomp.bin;
}; };
# thunderbird's logins.json + key4.db as a tarball, seeded on fresh hosts.
"thunderbird-creds" = djaiOnly // {
sopsFile = ./thunderbird-creds.bin;
};
}; };
} }