ft: certificates

flake.lock

@@ -59,11 +59,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790185690,
-        "narHash": "sha256-xJ+X4hBtOcAFGBOe5nAMyMUeF9foJBmIOu3NjBqBycU=",
+        "lastModified": 1790463110,
+        "narHash": "sha256-hKlVl12B1dF0Q5vd9dY3lIJM5mFGWYSlXwSLAqHZ1+s=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4975466d324710c576dc11ad614684e6bd8cad8e",
+        "rev": "e158d9ed9b51c98974c5e66e1ba1c9e0255fecaa",
         "type": "github"
       },
       "original": {
@@ -106,11 +106,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790247521,
-        "narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=",
+        "lastModified": 1790498116,
+        "narHash": "sha256-rs9meAYxW3zzrh43yaW7htrqCD+X9+pupDPHN86fumI=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f",
+        "rev": "5efb5a6f4f5ab192817d28557dd4d650fa14d866",
         "type": "github"
       },
       "original": {

modules/certificates.nix

@@ -1,9 +0,0 @@
-{ config, ... }:
-
-{
-  security.pki.certificateFiles = [
-    config.sops.secrets."npm-certificate-private".path
-    config.sops.secrets."npm-certificate-shared".path
-    config.sops.secrets."npm-certificate-public".path
-  ];
-}

modules/certificates/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+
+{
+  security.pki.certificateFiles = [
+    ./npm-public.cert
+    ./npm-shared.cert
+    ./npm-private.cert
+  ];
+}

modules/certificates/npm-private.cert

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBpDCCAUmgAwIBAgIQKYWQSCfwVkoBcMlYoDWFEjAKBggqhkjOPQQDAjAwMS4w
+LAYDVQQDEyVDYWRkeSBMb2NhbCBBdXRob3JpdHkgLSAyMDI2IEVDQyBSb290MB4X
+DTI2MDgxMTEzNTEwMVoXDTM2MDYxOTEzNTEwMVowMDEuMCwGA1UEAxMlQ2FkZHkg
+TG9jYWwgQXV0aG9yaXR5IC0gMjAyNiBFQ0MgUm9vdDBZMBMGByqGSM49AgEGCCqG
+SM49AwEHA0IABMrJos0wgv1gdxCUCAtOu3H9AXgrcT1Uq5I/VRWKj3n9CxTMPV0I
+uwfibHXcl4ISIF4ZucH7X4XpViuoCwcOmYajRTBDMA4GA1UdDwEB/wQEAwIBBjAS
+BgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBTe+quCrAEMQfGzyCMrxaHIMlEc
+uTAKBggqhkjOPQQDAgNJADBGAiEAldwjyoBJvOu42CW6G/p+Qp9hHS6P7lxXlgtL
+qhJQAFICIQCX5VDTPxD5DTYRKlV1R77hiIQyVhevrC+Ho+BitCoo8g==
+-----END CERTIFICATE-----

modules/certificates/npm-public.cert

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBpTCCAUqgAwIBAgIRAMcXyr7hVrTNVbzI/i1qgy4wCgYIKoZIzj0EAwIwMDEu
+MCwGA1UEAxMlQ2FkZHkgTG9jYWwgQXV0aG9yaXR5IC0gMjAyNiBFQ0MgUm9vdDAe
+Fw0yNjA4MDkyMTU0MDJaFw0zNjA2MTcyMTU0MDJaMDAxLjAsBgNVBAMTJUNhZGR5
+IExvY2FsIEF1dGhvcml0eSAtIDIwMjYgRUNDIFJvb3QwWTATBgcqhkjOPQIBBggq
+hkjOPQMBBwNCAAQboPA+AwV7f/1DHIss14y2oRSGlZliIco/ZPiX3hf5KabdEicc
+r927AqvOetD3BbandJrQ688nS4bNNcjRdTOHo0UwQzAOBgNVHQ8BAf8EBAMCAQYw
+EgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUS69zAYDPn70bjJKC03FMpiLb
+AiowCgYIKoZIzj0EAwIDSQAwRgIhAKQeq43JpGDJhqM7Lb+qacW3BULnRwLXqu4W
+i8x0efjMAiEAxXImIk0WBMrDdn7LXLtypLKZOESWwgnUC8WHqCHXIBM=
+-----END CERTIFICATE-----

modules/certificates/npm-shared.cert

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBozCCAUqgAwIBAgIRAJC2Mmysb+v6AixTRrQT1SUwCgYIKoZIzj0EAwIwMDEu
+MCwGA1UEAxMlQ2FkZHkgTG9jYWwgQXV0aG9yaXR5IC0gMjAyNiBFQ0MgUm9vdDAe
+Fw0yNjA4MTExNjI5MjFaFw0zNjA2MTkxNjI5MjFaMDAxLjAsBgNVBAMTJUNhZGR5
+IExvY2FsIEF1dGhvcml0eSAtIDIwMjYgRUNDIFJvb3QwWTATBgcqhkjOPQIBBggq
+hkjOPQMBBwNCAATUTJTmZya4EOqpeplWrqaROhRCp1044NUsC9LnxBJuXDwlw+TP
+YXz74j3HPE42n/9KZ8YwllZjrfLrv+z2TyGdo0UwQzAOBgNVHQ8BAf8EBAMCAQYw
+EgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUMb3pwaVS7eWFEYibRyG8Cvx+
+B0gwCgYIKoZIzj0EAwIDRwAwRAIgWs70jRH/Ep/fpy0XomV9783GEcYHtOp8JjZS
+HKXJEPYCIGQ166l7ui3W2PQGBarMQ+WNDs6RYsfpWtsS/BUB+aFv
+-----END CERTIFICATE-----

modules/default.nix

@@ -4,7 +4,7 @@
     ./apps.nix
     ./audio
     ./base.nix
-    ./certificates.nix
+    ./certificates
     ./desktop
     ./dev.nix
     ./email.nix

secrets/default.nix

@@ -2,11 +2,13 @@
 # Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
 let
   # make secrets readable by our processes
-  djaiOnly = {
+  rootOnly = {
     format = "binary";
-    owner = "djai";
     mode = "0400";
   };
+  djaiOnly = rootOnly // {
+    owner = "djai";
+  };
 in
 {
   # machine's age key, also used by `sops edit`.  
@@ -22,13 +24,13 @@ in
     };
 
     # npm caddy certificates
-    "npm-certificate-private" = djaiOnly // {
+    "npm-certificate-private" = rootOnly // {
       sopsFile = ./npm-certificate-private.bin;
     };
-    "npm-certificate-shared" = djaiOnly // {
+    "npm-certificate-shared" = rootOnly // {
       sopsFile = ./npm-certificate-shared.bin;
     };
-    "npm-certificate-public" = djaiOnly // {
+    "npm-certificate-public" = rootOnly // {
       sopsFile = ./npm-certificate-public.bin;
     };
 
@@ -39,10 +41,5 @@ in
     "wg-config-tuxcomp" = djaiOnly // {
       sopsFile = ./wg-config-tuxcomp.bin;
     };
-
-    # thunderbird's logins.json + key4.db as a tarball, seeded on fresh hosts.
-    "thunderbird-creds" = djaiOnly // {
-      sopsFile = ./thunderbird-creds.bin;
-    };
   };
 }