diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..a202329 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,7 @@ +keys: + - &nixbook age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5 +creation_rules: + - path_regex: secrets/.*\.bin$ + key_groups: + - age: + - *nixbook diff --git a/README.md b/README.md index 276b7ce..4c47690 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,6 @@ NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp). - ## Layout | Path | Contents | @@ -45,12 +44,3 @@ To add a machine, give it a key before its first boot with `mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`, put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on every `.bin` from a machine that can already decrypt them. - -`thunderbird-creds.bin` isn't text: it's a tarball of Thunderbird's -`logins.json` and `key4.db`, and it only seeds profiles that have no -`logins.json` yet. To update it, change the password in Thunderbird, close -Thunderbird, and update the tarball: - -```sh -tar -C ~/.thunderbird/main -cf - logins.json key4.db | sops encrypt --filename-override secrets/thunderbird-creds.bin --output secrets/thunderbird-creds.bin /dev/stdin -``` diff --git a/hosts/nixbook/default.nix b/hosts/nixbook/default.nix index fc43853..17cb296 100644 --- a/hosts/nixbook/default.nix +++ b/hosts/nixbook/default.nix @@ -22,34 +22,4 @@ # explicitly override videoDrivers (nvidia doesnt like us on nixbook ) services.xserver.videoDrivers = lib.mkForce [ "intel" ]; - - # BELOW IS OLD!! remove as we make more modular - # TODO: move certs to secrets, make this a module not a host based thing - # custom certificates - # security.pki.certificateFiles = [ - # ./certs/npm-caddy-private.crt - # ./certs/npm-caddy-public.crt - # ./certs/npm-caddy-shared.crt - # ]; - - # TODO: move to secrets - # tunnel - networking.wg-quick.interfaces = { - npm = { - address = [ "10.8.0.3/32" ]; - privateKeyFile = "/root/wireguard-keys/npm"; - peers = [ - { - publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ="; - presharedKeyFile = "/root/wireguard-keys/npm_preshared"; - allowedIPs = [ - "10.9.11.0/24" - "10.8.0.0/24" - ]; - endpoint = "wg-easy.u.djairo.dev:51820"; - persistentKeepalive = 25; - } - ]; - }; - }; } diff --git a/hosts/nixbook/wireguard.nix b/hosts/nixbook/wireguard.nix new file mode 100644 index 0000000..3c9687c --- /dev/null +++ b/hosts/nixbook/wireguard.nix @@ -0,0 +1,8 @@ +{ ... }: + +{ + networking.wg-quick.interfaces.npm = { + configFile = config.sops.secrets."wg-config-nixbook".path; + autostart = true; + }; +} diff --git a/modules/certificates.nix b/modules/certificates.nix new file mode 100644 index 0000000..44ca5c3 --- /dev/null +++ b/modules/certificates.nix @@ -0,0 +1,9 @@ +{ config, ... }: + +{ + security.pki.certificateFiles = [ + config.sops.secrets."npm-certificate-private".path + config.sops.secrets."npm-certificate-shared".path + config.sops.secrets."npm-certificate-public".path + ]; +} diff --git a/modules/default.nix b/modules/default.nix index 2644bf8..8b734b3 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -1,9 +1,10 @@ { imports = [ - # ../secrets # TODO: uncomment + ../secrets ./apps.nix ./audio ./base.nix + ./certificates.nix ./desktop ./dev.nix ./email.nix diff --git a/modules/email.nix b/modules/email.nix index 7806b2f..5d4d7a7 100644 --- a/modules/email.nix +++ b/modules/email.nix @@ -3,84 +3,3 @@ { programs.thunderbird.enable = true; } - -# TODO: use thunderbird seeding config - -# Thunderbird with all mail accounts declared. Thunderbird can't read passwords -# from a command, so its credential store (logins.json + key4.db) is kept in -# sops and copied into a fresh profile once. The Microsoft 365 account still -# needs its OAuth consent once per machine. - -# let -# realName = "Djai Hougee"; -# profile = "/home/djai/.thunderbird/main"; -# -# # without this thunderbird picks OAuth2 for gmail.com accounts, but these need app passwords -# passwordAuth = id: { -# "mail.server.server_${id}.authMethod" = 3; -# "mail.smtpserver.smtp_${id}.authMethod" = 3; -# }; -# -# oauthAuth = id: { -# "mail.server.server_${id}.authMethod" = 10; -# "mail.smtpserver.smtp_${id}.authMethod" = 10; -# }; -# -# account = flavor: address: auth: { -# inherit flavor address realName; -# userName = address; -# thunderbird = { -# enable = true; -# settings = auth; -# }; -# }; -# in -# { -# # Only seeds a profile that has no logins.json yet, so the live store (with -# # Thunderbird's own token refreshes) is never overwritten. -# systemd.services.thunderbird-seed-creds = { -# description = "Seed Thunderbird credential store from sops (first run only)"; -# wantedBy = [ "multi-user.target" ]; -# after = [ -# "sops-install-secrets.service" -# "home-manager-djai.service" -# ]; -# serviceConfig = { -# Type = "oneshot"; -# User = "djai"; -# RemainAfterExit = true; -# }; -# script = '' -# set -eu -# secret="${config.sops.secrets."thunderbird-creds".path}" -# if [ ! -d "${profile}" ]; then -# echo "profile ${profile} not present yet; skipping seed" -# exit 0 -# fi -# if [ -e "${profile}/logins.json" ]; then -# echo "logins.json already present; leaving live store untouched" -# exit 0 -# fi -# if [ ! -r "$secret" ]; then -# echo "secret $secret not readable; skipping" -# exit 0 -# fi -# ${pkgs.gnutar}/bin/tar -C "${profile}" -xf "$secret" -# echo "seeded Thunderbird credential store into ${profile}" -# ''; -# }; -# -# home-manager.users.djai = { -# programs.thunderbird = { -# enable = true; -# profiles.main.isDefault = true; -# }; -# -# accounts.email.accounts = { -# djai = account "kolabnow.com" "ljxjah@mykolab.com" passwordAuth // { -# primary = true; -# }; -# uni = account "gmail.com" "d.hougee@student.rug.nl" oauthAuth; -# }; -# }; -# } diff --git a/secrets/default.nix b/secrets/default.nix new file mode 100644 index 0000000..d3fedbc --- /dev/null +++ b/secrets/default.nix @@ -0,0 +1,48 @@ +# All sops secrets are edclared here (ssot). +# Each secret is a file stored in this directory as binary files (edit with `sops edit `) +let + # make secrets readable by our processes + djaiOnly = { + format = "binary"; + owner = "djai"; + mode = "0400"; + }; +in +{ + # machine's age key, also used by `sops edit`. + sops.age.keyFile = "/home/djai/.config/sops/age/keys.txt"; + # gotta make these lists empty or sops-nix will try to import our ssh keys + sops.age.sshKeyPaths = [ ]; + sops.gnupg.sshKeyPaths = [ ]; + + sops.secrets = { + # ssh config (exposes hostnames/ips/ports) + "ssh-config" = djaiOnly // { + sopsFile = ./ssh-config.bin; # TODO: actually use this + }; + + # npm caddy certificates + "npm-certificate-private" = djaiOnly // { + sopsFile = ./npm-certificate-private.bin; + }; + "npm-certificate-shared" = djaiOnly // { + sopsFile = ./npm-certificate-shared.bin; + }; + "npm-certificate-public" = djaiOnly // { + sopsFile = ./npm-certificate-public.bin; + }; + + # wireguard tunnels + "wg-config-nixbook" = djaiOnly // { + sopsFile = ./wg-config-nixbook.bin; + }; + "wg-config-tuxcomp" = djaiOnly // { + sopsFile = ./wg-config-tuxcomp.bin; + }; + + # thunderbird's logins.json + key4.db as a tarball, seeded on fresh hosts. + "thunderbird-creds" = djaiOnly // { + sopsFile = ./thunderbird-creds.bin; + }; + }; +} diff --git a/secrets/npm-certificate-private.bin b/secrets/npm-certificate-private.bin new file mode 100644 index 0000000..06cfd9c --- /dev/null +++ b/secrets/npm-certificate-private.bin @@ -0,0 +1,14 @@ +{ + "data": "ENC[AES256_GCM,data:qGohcsnq4S1YGThawZO6USuV5p1lGRMFZ/b44C/7uFMSM/K7DH4vmZMngt47BKVRXzKD8axa/t7wLp3py1lVG50/RQf6OTfE+JXEn3KOPb+Hw2YBn+IAbPU/zlxarBS5LjvLowmvZoGnU3SK5kZZnT7V9sGmEUEL8DRzhFBCQXMB8XV0cMxT6Z6+OoMTTIFD7mbXo1IkHumZ8CcWo2FVeLiiOpgs00L88PaxkwRgmxumgB7jJl9/xk6zlBsS2Wl4KCsC9tAvvPlvt9rFztC6GC/q/6xHksCsYNa8cU+vWlKYpoNtQFCrdPqmpDIeSygXxjm3gHRDJm/4BgrzC/MUGMXX360Uoq32nlToRAWK1xVVxUGQ+xZMZrnluRkJUYujQcevHBAIFgSnjMpGvksmbUX4QxKW1pqIUzy0Q7e3qcSFmHJD7yYmVVBx7V4RksCE7lSvQD2H6jrCFPJGsKIhu/dAgQzotKKgfotjCi7vqTt6ZF/skpQVLl0PewglQ+aQTFcuqWovk7K2oPW7WfGfeVWygWCtMJ1Rbu5BJARZXH9bHk0qnl6ptcSdZpbJGtmKtFwNVY2zxIHIhg+wastquDytSry92ILM5W31hYuk2eyxA1fZvkfPQuhkRknaKQqlKFSVG1EFu4giclJHRx+DMEhSCqzgMBRG5I1SpzGL04BZNgsD2ZdFlwwJQm8g/+vi0ngAApFXL5UHl7+K388BE79niN/e8brHszURu6GqWWnJYPh+lVXpZEq6EiEAMjrtirYMalJHgGUM8wONy1KUFiPIoP99Z/I0xYfS+XKwxEYpW57uvJe8WswNlT2xWa20yycwChvV/u0=,iv:hX9+zPsymhI8DySZV9TMnrsWZBmtEF6LvyxWQ2cuPuA=,tag:Cyyv3oPaN/NIIm5zb6F9iw==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVUEpIWXRvTStYdVBzN205\nSFBGVkc4SS9GWnpiSlJSSGhXZ0tRUkxDMGlrClM4SE96SHVYOTgwVnNyZTlqSlpI\nckdoeFNESXRQMkk4ekRHY0U3b2R1b2cKLS0tIDNZdTZIcDJMdEVsNTlrSWU0azB1\nNkVnR3puQVpHKy81NGNWZkVBVUN5Y1kKRGiETG0GLigaBxGoY1NxHLgg4erj/uBM\nSlyLHOU9eq7z47EqHQ7W3qOwTvM4dW1k2MkpepxoGXRqs5FqI3FH1Q==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5" + } + ], + "lastmodified": "2026-09-27T19:51:40Z", + "mac": "ENC[AES256_GCM,data:VAcgp/EqsghoMyGhkMujPtGFfLy9dswbEEzsNZPS53Q0azQH+xy9aDYjn4r3+y/VI9ogQIUIRijDTRVMhcyFbewEHLJSM8CqtZOL7N4eSOxQ3ayq06E1UIXlVVTIH+ss0VZJXDLnQyd/gZnGDxYneuUsJqfTFDFNpLKOf6pv7IU=,iv:aokwJDSRaDQVIsEh12SMhXfMsARX3xytkVU2Ff4+SKM=,tag:vCdsAQ6Cf6Lbd5XkiIZyhg==,type:str]", + "version": "3.13.3" + } +} diff --git a/secrets/npm-certificate-public.bin b/secrets/npm-certificate-public.bin new file mode 100644 index 0000000..f85c033 --- /dev/null +++ b/secrets/npm-certificate-public.bin @@ -0,0 +1,14 @@ +{ + "data": "ENC[AES256_GCM,data:FyRde2ms6MPYsUQZ0fplSyeQsJBVAFCc0hdAO52DFRRcRUyUtjcdJ0b/X7iHGttvF7pu1CJ4dTYo3YMYmYvPG16GiRR9NnyHxhoSWQUuPJ0YhS/l/8m0t3pksFBHGPv02yLzCR4YMa4kxPprol8IEws+hg10wVOIBK4obWovA6u76TWf/TTugxbzCohrP2kwLmY9grXEvI5c5LPdVh8lwRUWGHmIGfEK8q7o3LVUipj/phapcCFu1urOpCTamTBqmQrWRP4chONuf7WK3EzcsKm9vZpe+YP5zoMa8biuhcuoMdqINM3ZlspAXVQvMdPXqvFkgrhLB1K5kDC6eaPQL6oUBxzxFsBagOBHJpNSsZ5aydBabCbn/UeufBjyEFDkYYWLE3UYXB3aI+NDac4aS1a4cLY2hybAzSz8tu9XZ7Le+zpsZYifFQqbdBYMSUKv+INZAGNkLXwkfeful3GKFDnGo4+EZGSxbXOUosjCBpc8md4o0OUYQv3H6A5OCOEDQck9WSO9PzQSWkM8l5mmch2vaz9FcTc+RTDMfYGeoLHkfHeYx9pjRcjd97bOjFnUHdgPNzrjcOdUZ5TYndxRklyvSSWylkpSRP+IjCfIGKmVkQkVulJ1bEr/JqCDb5MNwIVj11ugmE1LqydflrzjQ+AR0PiVpIQeBbd/zo10UKxBNq3ozvEixYeGg8N74eNnXEBXlk0efnV18VwZ5V2zKUm0IHkCui2YiBRX9YCOvXi5y7VdLf32za1gvKIpgAJfLuI7KpzPuqwcHbtKQfas/e+BN27SQFriViGu+gtoWkjVABqC5p3S9/nTqcC4opYMMKwKoRj7Xiw=,iv:CWrpdT7KYoLZ9Eh7WUeb1fT2pwDUjnYIMHGS3tqIXSU=,tag:Z/PdZLpvIym7pb5ActewhA==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEY3JlOXk4Y0FXZkE4Vk4z\nV0ZxZDk0Z0hEMlFsR0ErMkhxQ0d2VGc0S0NVCkNWR28rd2VPbkdmMXcxSE9Scklt\nZUNQZ2NYT3ZpUHM4UWxrYUZoVkNXdncKLS0tIE1XczdiemdlVW9seDJKMTYwMHla\nUjdsSk1YeDdmTkc3ZnlYd2JSbzZyTkUKw7XRqJkaiywps4wAiMAzFtvZW58MQUH7\n3Ckhk3syc2tgCWRjPU3mkxKbDhg/IjnZFc+IJdqfSxnmHvQRHprc0A==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5" + } + ], + "lastmodified": "2026-09-27T19:52:00Z", + "mac": "ENC[AES256_GCM,data:vyoVS5zuO8xzg8WpLZ16CAi0nIfFDRgC0jCArHzpdZgBSqZ9oYKXcn0mF7V3N5ipUa3jwShNRCxCiuHdpFOSW9xYah3m6gusSYia6y3cLQH3pXd1+K4UXi13EYIqSmj7Kg3rw0TcXmTA7BouWl0pVZK3dRZogtdDjFZycKderKs=,iv:JSN+RKXuSagkgl57++FwxkAFrTrV911RWDe6bMAvah4=,tag:Q1OkVROXTnGU5pUIv2Ws3Q==,type:str]", + "version": "3.13.3" + } +} diff --git a/secrets/npm-certificate-shared.bin b/secrets/npm-certificate-shared.bin new file mode 100644 index 0000000..ba3870a --- /dev/null +++ b/secrets/npm-certificate-shared.bin @@ -0,0 +1,14 @@ +{ + "data": "ENC[AES256_GCM,data:5H1G+TdTbbCOI2pe/SFsj19forEa0VNpGsdkDPRP8D1hoXDCechA5plZbXm8PdoGoEk5iZCzjPppIpJ6D0Y+QDf4fmUubnSXWPYJyLpxuO9QC4a0f2BBKO5MPveGXtLwsoclo44zBuzE5GqlUobNd7x612wYOXv3cmDEwHoAi3xAq/ny9emg+sZGr+dj6tXVil2GK4isRV93UC8FfiWlPC4aitJFFR3ikNuUam7UDwugjzV7W4b6zrFzFUzzlMT/z2XoV71VfGmVDonC+/M0fCODKEHXPMpSm9EJ1eMgYfWheB489y35jAvAFKVH9qAUwsEh24pCnkeaJES4aYStSaWgdQzpZ3PSbCLprxgENVA61uSYzDTxZXB/q+YSm9c4E4MnSUbiE7YATcN7iN8nRQANPlg0gOK3GutkWWM2072mDlqyBwYPY9PyUBA7X7YPY8ZKXZFkKOu2pvCgFXUESdf5TZzSpMecV1KDXEtvcUQyQn8VnP4giOsU9/3TE0wqB5emtmqwbJPfsQEwMuJZO9MVdHe6rvSBtuuMerQSJOT11vsZi2QYNwkaHuV7ezYQAEq1oGrEcg34RqY+4gPupFFDtvwYcUZCM95e3oJrvtg603OS+H+1Ff/grFAtE1BF3sxc9ap/U8XvOJGLNn09NWjE/On3LIwp4MdQi8JfTdYPeG5qhGHO1mWtRyhgVzP0vxkqzhybS5nFuUbDpAXmrmNN5GcAVMg7SgF2qaGwwIa8ARKu6KPT9A1etgLX6OX5ai9+5bQU+Wh1Vau3ZEwqMb3WY6/IqJ2LWccKKwt8zJrSfPg40aHovHWgDo4tC2c6B3Xjeg==,iv:Hg3U4qFWvRkGDMLyL6sP+7KlL0msJMqIfKgp6DhoSLg=,tag:tUS4freYJNuOtE+63koqZQ==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bzdpZm9vZU12bjZ6dnJK\nR0h3M3hMMlNteUtmdktpalZvMExZZXBwMFZzCnZqbm9JNDgyalZORHN3Slp4OUpi\nMnRYVm9KRjFKYjJlSXdKbUVuT0o5a0kKLS0tIEFxNW1NSm9NaTVJRC94WnNvTkww\nZnV0SzNqT0g0Qms4WHdVQWY1akVuM00Kag5BlPZX197XU+FiSE7pjfLxJJjaAF79\nWO+YuaVOWgX6e5/FRt+34HE07XoYlO3dIN2FyZOA+Fg2EftksY+BZg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5" + } + ], + "lastmodified": "2026-09-27T19:51:50Z", + "mac": "ENC[AES256_GCM,data:zHhYw6nyXhwE+yBwVAo2RhTKDQkM5zBr0eXXt/KhnKsOoQoa7lJdnv0eOtrb8WWm4TivkoFoW7hFPRzLSN/XsY+3Ocz2ojhlZXTQtPxQjlfiLR8pEV9JJ6P53WZLr7hZMobJCHAIi6PlJf7tHoYTs9UeO0v7BCtxV/WYMAJYQvo=,iv:Htg1o3BX13AbH+P2gJR1/mHff6CSp6NVrFi612i29zU=,tag:k/LmBy7jnlN2NEQerj2SKg==,type:str]", + "version": "3.13.3" + } +} diff --git a/secrets/ssh-config.bin b/secrets/ssh-config.bin new file mode 100644 index 0000000..b88fe0f --- /dev/null +++ b/secrets/ssh-config.bin @@ -0,0 +1,14 @@ +{ + "data": "ENC[AES256_GCM,data:vEAyc4eVrWusSNtrmqUlDg7ybFCVVOsnLBNSlQXUHGaYp622Jtnlvrw=,iv:kWxgJhWGF3kI5p0D+n5b9QMc1EXKJ8y5ZLwIRbcrFVk=,tag:wGmFdL1s1pkXp8TN/+w27Q==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDMmRDUTBGdHFuckdqZnNj\ncGtmeko0bi9mU3FUVEJqaHVVc0cwaUZuUHdJCmRPdGFWUVFpczBlVzJ1dm10ajNt\nL21LZE45aDllQzJzY21yRHNpbU1SSkUKLS0tIGtwOVkzV2NvRE1LelhFaGl6b24v\ncFlyM0dRVlhHL1QvZGpIVXc5a1lZM2sK7Yeh16J6CoT+Tn8OMEMbA+rfSlsGrQco\nHdjWc09pq6os9WN/gxa5gq+T4UsnolOB/adLCOWUtWIb3lxXpv0FGA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5" + } + ], + "lastmodified": "2026-09-27T20:04:33Z", + "mac": "ENC[AES256_GCM,data:CC/TS4vliSrRmRnyNCaig/GO0pRQIUQUa9PIR8v1XOr0DtKE+0ozxptBIsg/gSWayrGvVJf2fIM0gD/iU1LHeeWplqD10kSLI/XtqVzT0oLC8H86PEc3BQo2L5WTv64XuTygXiU8MrgjiK3dFL21kIxKTllbhhd8Z3ULTE6rbk0=,iv:AY9h2Ihh6XaIGl7iyAgtMELV9woT3REg62CBBPKTkD4=,tag:bii6YbVjOtB8iUrkj6kALQ==,type:str]", + "version": "3.13.3" + } +} diff --git a/secrets/wg-config-nixbook.bin b/secrets/wg-config-nixbook.bin new file mode 100644 index 0000000..c665c8c --- /dev/null +++ b/secrets/wg-config-nixbook.bin @@ -0,0 +1,14 @@ +{ + "data": "ENC[AES256_GCM,data:uu+owewHj4IqtZie9lgEWeuDfMv6/fbLkd6Ff8GMPOuQkbnTSzNl7t2UEx9s6znapWlfsNMHRp4wHEzVM6IemPa7fSyi5GUrHx6YN1eUXb8o8sH8cXYhLs02eObtEtY81aJsNpyyU1aStxa/E9HZvm4oLv3Us8Hv32vJAXF3UyyFde/pdT3oO9XJlKsYcRPa+p0MjZ28g3IwT9SPVtCCEvtqxiTR0eICGH6kK8X4F8jvpSmqxkAbdfF83JW1H3ibaDOfDIXgZtSqOtByO7PiE1eqBYU161jwgeQIxInhtVL3WS6mGx+sCp9YHOhORlChr4ZmPF7Ypkn+vpZ8qWDRBq8aJTT29GC7GDvCN6FiB/s83mruodRFTwT3/Rbf12xqRk5xNm29WMzSua6juvQLjOexCulWnunh4Su1SGrdbxjSjSJ0VNsFQCwx,iv:Tv/DlMJ9pJgFQQJn9IRo3mmK+qjXuIhRTEwVzLlWKPQ=,tag:ZSEfapTOm5wMlJzHpy5qjA==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiV3V6Uy9kcmo1N3NCTWpu\nQWRJTHlEM1hWNGlLSzk5MzlOc0c1ODZFYkRzClhLaEJtU3Z3aktod1lleFdLeFRZ\nWnNCWS93b3VoOFVWcXEyNHBEaXB3Wm8KLS0tIDJNVUVueXMzMU9kTjRubVpnRkkx\neVVFM2RPLzFabC9iVHozU0pXTkpZMVUK9l8dsll0BPwwx2vDcvNTiClp35p6g7+v\nlvdjAu7SscfS0OYWidr0ade/MhjBvrKSxjnbPXh994HXjwGotYZJHg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5" + } + ], + "lastmodified": "2026-09-27T19:54:01Z", + "mac": "ENC[AES256_GCM,data:LA/dh+KhuOmopCuvvYXuY4MKEctXdEy2DeZbWEVed5d58d4Rh3iS/oWLVXbfL6ff4e4cF4lKwXpvSatxrUY7ZKlM2nbD9EgqZMFuaEOqM2CeKKBIkGe5YE2OuS9tyhNOzVYYKMGL2fJVjqH2GXoVdmcCrB1elXTZ31sEV7OuQbA=,iv:KTQU8WOswO3wCUfvgPJFR00u9yUp+VaKfw0Wop3h/2A=,tag:S82Uj2aRXwTNNnAwMvRuBQ==,type:str]", + "version": "3.13.3" + } +} diff --git a/secrets/wg-config-tuxcomp.bin b/secrets/wg-config-tuxcomp.bin new file mode 100644 index 0000000..3732f51 --- /dev/null +++ b/secrets/wg-config-tuxcomp.bin @@ -0,0 +1,14 @@ +{ + "data": "ENC[AES256_GCM,data:kWithuLuVPw4zPHoB3QmBgycNNDoq+IlIvx4Xv+Y6N7Dyp+LoRophEm9B7mnIEYxRPA+L07vAKHkfr5gRK6nvsapNo2Ckp5iVKVr6M0eCbfbO/2QvXwRa4URmLYe6OSlTGAxBIw1kcaTpjzD18kj5rMfVoPq1pDR7Yt2kOzoz46AZWXmZmckOuEhum7FIYt++yL0dviKhSrZ36V6j2irQ9MdjmzIvoxysWyTSXjNXVPHEvCAa5Gi/EIeap8odnWnJzJiv2ARVZ154D8T8PWIRb7sbOgbNPeo9BDwB5d7RyhSXPlwA8hgPPggIoaVbTRtM5InxshfmsYWFUEApqemcPJWq9jYkmXaiAoQldVpM2/1eWKhpdsou39yYu4dpnnm1vtxKAPh7+NbJUP83gRzxKAlT8aTV3Sp/ydQua4Xc01gpVwZCqwvqxsX,iv:VjFrf0UXiWIFvQirwTjqSk7YHE9wj0LY26yNx8+8QGs=,tag:CqIsdFVQIw5atl+wAPu7bA==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTbkZMc2c5YTNRV0VrZ2hn\ncElRaXlvMUl1NnZlOXB1bnJtTFEwc01CZ3hFClNPOXM0K1plaktqcDVhMjk4VnFP\nckphazRXSWtZcWxEbDR3NVlmUmJjUncKLS0tIGxoSGRDRVNqQ2QrNHFJeitHQjZW\nem9iNjcrb2VYc3ZQNEl1VDRRWFc2YjgKs40DWyILQgObJaKCDHBtBEwLt36sPrZ+\nBdVfZVXjNQD+2FwJNtaEhlsbKEJj0/XYvaE07xS8X3UeEelEvCvUeA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5" + } + ], + "lastmodified": "2026-09-27T19:54:24Z", + "mac": "ENC[AES256_GCM,data:xrl/yr7Uy3NPLhZzZRcslQGuZYY5ZTK7W4pYTt3XK5hmd4PWpg5Yvwl8WB3OZVC4D6dbJy8Cs8pC1ZpfUT6aoYETfMPYKjTrIUC4HsKN6YC8W1vKrqYkIHXWdcCNbDpQ/8rC/reFRW1Z4id616RI2m4lVQe5EOr8fexCSr6qyNk=,iv:aqecolbcJYfgY1arN+8p0bYo6hDpyrccSF91njPsVRE=,tag:AdmsE6avWbsYX1RmTZazhA==,type:str]", + "version": "3.13.3" + } +}