ft: sops-nix + secrets

2026-09-27 22:06:34 +02:00
parent ff14cb6a8b
commit 623edfd8b4
14 changed files with 158 additions and 122 deletions
--- a/secrets/default.nix
+++ b/secrets/default.nix
@@ -0,0 +1,48 @@
+# All sops secrets are edclared here (ssot).
+# Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
+let
+  # make secrets readable by our processes
+  djaiOnly = {
+    format = "binary";
+    owner = "djai";
+    mode = "0400";
+  };
+in
+{
+  # machine's age key, also used by `sops edit`.  
+  sops.age.keyFile = "/home/djai/.config/sops/age/keys.txt";
+  # gotta make these lists empty or sops-nix will try to import our ssh keys 
+  sops.age.sshKeyPaths = [ ];
+  sops.gnupg.sshKeyPaths = [ ];
+
+  sops.secrets = {
+    # ssh config (exposes hostnames/ips/ports)
+    "ssh-config" = djaiOnly // {
+      sopsFile = ./ssh-config.bin; # TODO: actually use this
+    };
+
+    # npm caddy certificates
+    "npm-certificate-private" = djaiOnly // {
+      sopsFile = ./npm-certificate-private.bin;
+    };
+    "npm-certificate-shared" = djaiOnly // {
+      sopsFile = ./npm-certificate-shared.bin;
+    };
+    "npm-certificate-public" = djaiOnly // {
+      sopsFile = ./npm-certificate-public.bin;
+    };
+
+    # wireguard tunnels
+    "wg-config-nixbook" = djaiOnly // {
+      sopsFile = ./wg-config-nixbook.bin;
+    };
+    "wg-config-tuxcomp" = djaiOnly // {
+      sopsFile = ./wg-config-tuxcomp.bin;
+    };
+
+    # thunderbird's logins.json + key4.db as a tarball, seeded on fresh hosts.
+    "thunderbird-creds" = djaiOnly // {
+      sopsFile = ./thunderbird-creds.bin;
+    };
+  };
+}
--- a/secrets/npm-certificate-private.bin
+++ b/secrets/npm-certificate-private.bin
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:qGohcsnq4S1YGThawZO6USuV5p1lGRMFZ/b44C/7uFMSM/K7DH4vmZMngt47BKVRXzKD8axa/t7wLp3py1lVG50/RQf6OTfE+JXEn3KOPb+Hw2YBn+IAbPU/zlxarBS5LjvLowmvZoGnU3SK5kZZnT7V9sGmEUEL8DRzhFBCQXMB8XV0cMxT6Z6+OoMTTIFD7mbXo1IkHumZ8CcWo2FVeLiiOpgs00L88PaxkwRgmxumgB7jJl9/xk6zlBsS2Wl4KCsC9tAvvPlvt9rFztC6GC/q/6xHksCsYNa8cU+vWlKYpoNtQFCrdPqmpDIeSygXxjm3gHRDJm/4BgrzC/MUGMXX360Uoq32nlToRAWK1xVVxUGQ+xZMZrnluRkJUYujQcevHBAIFgSnjMpGvksmbUX4QxKW1pqIUzy0Q7e3qcSFmHJD7yYmVVBx7V4RksCE7lSvQD2H6jrCFPJGsKIhu/dAgQzotKKgfotjCi7vqTt6ZF/skpQVLl0PewglQ+aQTFcuqWovk7K2oPW7WfGfeVWygWCtMJ1Rbu5BJARZXH9bHk0qnl6ptcSdZpbJGtmKtFwNVY2zxIHIhg+wastquDytSry92ILM5W31hYuk2eyxA1fZvkfPQuhkRknaKQqlKFSVG1EFu4giclJHRx+DMEhSCqzgMBRG5I1SpzGL04BZNgsD2ZdFlwwJQm8g/+vi0ngAApFXL5UHl7+K388BE79niN/e8brHszURu6GqWWnJYPh+lVXpZEq6EiEAMjrtirYMalJHgGUM8wONy1KUFiPIoP99Z/I0xYfS+XKwxEYpW57uvJe8WswNlT2xWa20yycwChvV/u0=,iv:hX9+zPsymhI8DySZV9TMnrsWZBmtEF6LvyxWQ2cuPuA=,tag:Cyyv3oPaN/NIIm5zb6F9iw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVUEpIWXRvTStYdVBzN205\nSFBGVkc4SS9GWnpiSlJSSGhXZ0tRUkxDMGlrClM4SE96SHVYOTgwVnNyZTlqSlpI\nckdoeFNESXRQMkk4ekRHY0U3b2R1b2cKLS0tIDNZdTZIcDJMdEVsNTlrSWU0azB1\nNkVnR3puQVpHKy81NGNWZkVBVUN5Y1kKRGiETG0GLigaBxGoY1NxHLgg4erj/uBM\nSlyLHOU9eq7z47EqHQ7W3qOwTvM4dW1k2MkpepxoGXRqs5FqI3FH1Q==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:51:40Z",
+		"mac": "ENC[AES256_GCM,data:VAcgp/EqsghoMyGhkMujPtGFfLy9dswbEEzsNZPS53Q0azQH+xy9aDYjn4r3+y/VI9ogQIUIRijDTRVMhcyFbewEHLJSM8CqtZOL7N4eSOxQ3ayq06E1UIXlVVTIH+ss0VZJXDLnQyd/gZnGDxYneuUsJqfTFDFNpLKOf6pv7IU=,iv:aokwJDSRaDQVIsEh12SMhXfMsARX3xytkVU2Ff4+SKM=,tag:vCdsAQ6Cf6Lbd5XkiIZyhg==,type:str]",
+		"version": "3.13.3"
+	}
+}
--- a/secrets/npm-certificate-public.bin
+++ b/secrets/npm-certificate-public.bin
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:FyRde2ms6MPYsUQZ0fplSyeQsJBVAFCc0hdAO52DFRRcRUyUtjcdJ0b/X7iHGttvF7pu1CJ4dTYo3YMYmYvPG16GiRR9NnyHxhoSWQUuPJ0YhS/l/8m0t3pksFBHGPv02yLzCR4YMa4kxPprol8IEws+hg10wVOIBK4obWovA6u76TWf/TTugxbzCohrP2kwLmY9grXEvI5c5LPdVh8lwRUWGHmIGfEK8q7o3LVUipj/phapcCFu1urOpCTamTBqmQrWRP4chONuf7WK3EzcsKm9vZpe+YP5zoMa8biuhcuoMdqINM3ZlspAXVQvMdPXqvFkgrhLB1K5kDC6eaPQL6oUBxzxFsBagOBHJpNSsZ5aydBabCbn/UeufBjyEFDkYYWLE3UYXB3aI+NDac4aS1a4cLY2hybAzSz8tu9XZ7Le+zpsZYifFQqbdBYMSUKv+INZAGNkLXwkfeful3GKFDnGo4+EZGSxbXOUosjCBpc8md4o0OUYQv3H6A5OCOEDQck9WSO9PzQSWkM8l5mmch2vaz9FcTc+RTDMfYGeoLHkfHeYx9pjRcjd97bOjFnUHdgPNzrjcOdUZ5TYndxRklyvSSWylkpSRP+IjCfIGKmVkQkVulJ1bEr/JqCDb5MNwIVj11ugmE1LqydflrzjQ+AR0PiVpIQeBbd/zo10UKxBNq3ozvEixYeGg8N74eNnXEBXlk0efnV18VwZ5V2zKUm0IHkCui2YiBRX9YCOvXi5y7VdLf32za1gvKIpgAJfLuI7KpzPuqwcHbtKQfas/e+BN27SQFriViGu+gtoWkjVABqC5p3S9/nTqcC4opYMMKwKoRj7Xiw=,iv:CWrpdT7KYoLZ9Eh7WUeb1fT2pwDUjnYIMHGS3tqIXSU=,tag:Z/PdZLpvIym7pb5ActewhA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEY3JlOXk4Y0FXZkE4Vk4z\nV0ZxZDk0Z0hEMlFsR0ErMkhxQ0d2VGc0S0NVCkNWR28rd2VPbkdmMXcxSE9Scklt\nZUNQZ2NYT3ZpUHM4UWxrYUZoVkNXdncKLS0tIE1XczdiemdlVW9seDJKMTYwMHla\nUjdsSk1YeDdmTkc3ZnlYd2JSbzZyTkUKw7XRqJkaiywps4wAiMAzFtvZW58MQUH7\n3Ckhk3syc2tgCWRjPU3mkxKbDhg/IjnZFc+IJdqfSxnmHvQRHprc0A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:52:00Z",
+		"mac": "ENC[AES256_GCM,data:vyoVS5zuO8xzg8WpLZ16CAi0nIfFDRgC0jCArHzpdZgBSqZ9oYKXcn0mF7V3N5ipUa3jwShNRCxCiuHdpFOSW9xYah3m6gusSYia6y3cLQH3pXd1+K4UXi13EYIqSmj7Kg3rw0TcXmTA7BouWl0pVZK3dRZogtdDjFZycKderKs=,iv:JSN+RKXuSagkgl57++FwxkAFrTrV911RWDe6bMAvah4=,tag:Q1OkVROXTnGU5pUIv2Ws3Q==,type:str]",
+		"version": "3.13.3"
+	}
+}
--- a/secrets/npm-certificate-shared.bin
+++ b/secrets/npm-certificate-shared.bin
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:5H1G+TdTbbCOI2pe/SFsj19forEa0VNpGsdkDPRP8D1hoXDCechA5plZbXm8PdoGoEk5iZCzjPppIpJ6D0Y+QDf4fmUubnSXWPYJyLpxuO9QC4a0f2BBKO5MPveGXtLwsoclo44zBuzE5GqlUobNd7x612wYOXv3cmDEwHoAi3xAq/ny9emg+sZGr+dj6tXVil2GK4isRV93UC8FfiWlPC4aitJFFR3ikNuUam7UDwugjzV7W4b6zrFzFUzzlMT/z2XoV71VfGmVDonC+/M0fCODKEHXPMpSm9EJ1eMgYfWheB489y35jAvAFKVH9qAUwsEh24pCnkeaJES4aYStSaWgdQzpZ3PSbCLprxgENVA61uSYzDTxZXB/q+YSm9c4E4MnSUbiE7YATcN7iN8nRQANPlg0gOK3GutkWWM2072mDlqyBwYPY9PyUBA7X7YPY8ZKXZFkKOu2pvCgFXUESdf5TZzSpMecV1KDXEtvcUQyQn8VnP4giOsU9/3TE0wqB5emtmqwbJPfsQEwMuJZO9MVdHe6rvSBtuuMerQSJOT11vsZi2QYNwkaHuV7ezYQAEq1oGrEcg34RqY+4gPupFFDtvwYcUZCM95e3oJrvtg603OS+H+1Ff/grFAtE1BF3sxc9ap/U8XvOJGLNn09NWjE/On3LIwp4MdQi8JfTdYPeG5qhGHO1mWtRyhgVzP0vxkqzhybS5nFuUbDpAXmrmNN5GcAVMg7SgF2qaGwwIa8ARKu6KPT9A1etgLX6OX5ai9+5bQU+Wh1Vau3ZEwqMb3WY6/IqJ2LWccKKwt8zJrSfPg40aHovHWgDo4tC2c6B3Xjeg==,iv:Hg3U4qFWvRkGDMLyL6sP+7KlL0msJMqIfKgp6DhoSLg=,tag:tUS4freYJNuOtE+63koqZQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bzdpZm9vZU12bjZ6dnJK\nR0h3M3hMMlNteUtmdktpalZvMExZZXBwMFZzCnZqbm9JNDgyalZORHN3Slp4OUpi\nMnRYVm9KRjFKYjJlSXdKbUVuT0o5a0kKLS0tIEFxNW1NSm9NaTVJRC94WnNvTkww\nZnV0SzNqT0g0Qms4WHdVQWY1akVuM00Kag5BlPZX197XU+FiSE7pjfLxJJjaAF79\nWO+YuaVOWgX6e5/FRt+34HE07XoYlO3dIN2FyZOA+Fg2EftksY+BZg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:51:50Z",
+		"mac": "ENC[AES256_GCM,data:zHhYw6nyXhwE+yBwVAo2RhTKDQkM5zBr0eXXt/KhnKsOoQoa7lJdnv0eOtrb8WWm4TivkoFoW7hFPRzLSN/XsY+3Ocz2ojhlZXTQtPxQjlfiLR8pEV9JJ6P53WZLr7hZMobJCHAIi6PlJf7tHoYTs9UeO0v7BCtxV/WYMAJYQvo=,iv:Htg1o3BX13AbH+P2gJR1/mHff6CSp6NVrFi612i29zU=,tag:k/LmBy7jnlN2NEQerj2SKg==,type:str]",
+		"version": "3.13.3"
+	}
+}
--- a/secrets/ssh-config.bin
+++ b/secrets/ssh-config.bin
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:vEAyc4eVrWusSNtrmqUlDg7ybFCVVOsnLBNSlQXUHGaYp622Jtnlvrw=,iv:kWxgJhWGF3kI5p0D+n5b9QMc1EXKJ8y5ZLwIRbcrFVk=,tag:wGmFdL1s1pkXp8TN/+w27Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDMmRDUTBGdHFuckdqZnNj\ncGtmeko0bi9mU3FUVEJqaHVVc0cwaUZuUHdJCmRPdGFWUVFpczBlVzJ1dm10ajNt\nL21LZE45aDllQzJzY21yRHNpbU1SSkUKLS0tIGtwOVkzV2NvRE1LelhFaGl6b24v\ncFlyM0dRVlhHL1QvZGpIVXc5a1lZM2sK7Yeh16J6CoT+Tn8OMEMbA+rfSlsGrQco\nHdjWc09pq6os9WN/gxa5gq+T4UsnolOB/adLCOWUtWIb3lxXpv0FGA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T20:04:33Z",
+		"mac": "ENC[AES256_GCM,data:CC/TS4vliSrRmRnyNCaig/GO0pRQIUQUa9PIR8v1XOr0DtKE+0ozxptBIsg/gSWayrGvVJf2fIM0gD/iU1LHeeWplqD10kSLI/XtqVzT0oLC8H86PEc3BQo2L5WTv64XuTygXiU8MrgjiK3dFL21kIxKTllbhhd8Z3ULTE6rbk0=,iv:AY9h2Ihh6XaIGl7iyAgtMELV9woT3REg62CBBPKTkD4=,tag:bii6YbVjOtB8iUrkj6kALQ==,type:str]",
+		"version": "3.13.3"
+	}
+}
--- a/secrets/wg-config-nixbook.bin
+++ b/secrets/wg-config-nixbook.bin
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:uu+owewHj4IqtZie9lgEWeuDfMv6/fbLkd6Ff8GMPOuQkbnTSzNl7t2UEx9s6znapWlfsNMHRp4wHEzVM6IemPa7fSyi5GUrHx6YN1eUXb8o8sH8cXYhLs02eObtEtY81aJsNpyyU1aStxa/E9HZvm4oLv3Us8Hv32vJAXF3UyyFde/pdT3oO9XJlKsYcRPa+p0MjZ28g3IwT9SPVtCCEvtqxiTR0eICGH6kK8X4F8jvpSmqxkAbdfF83JW1H3ibaDOfDIXgZtSqOtByO7PiE1eqBYU161jwgeQIxInhtVL3WS6mGx+sCp9YHOhORlChr4ZmPF7Ypkn+vpZ8qWDRBq8aJTT29GC7GDvCN6FiB/s83mruodRFTwT3/Rbf12xqRk5xNm29WMzSua6juvQLjOexCulWnunh4Su1SGrdbxjSjSJ0VNsFQCwx,iv:Tv/DlMJ9pJgFQQJn9IRo3mmK+qjXuIhRTEwVzLlWKPQ=,tag:ZSEfapTOm5wMlJzHpy5qjA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiV3V6Uy9kcmo1N3NCTWpu\nQWRJTHlEM1hWNGlLSzk5MzlOc0c1ODZFYkRzClhLaEJtU3Z3aktod1lleFdLeFRZ\nWnNCWS93b3VoOFVWcXEyNHBEaXB3Wm8KLS0tIDJNVUVueXMzMU9kTjRubVpnRkkx\neVVFM2RPLzFabC9iVHozU0pXTkpZMVUK9l8dsll0BPwwx2vDcvNTiClp35p6g7+v\nlvdjAu7SscfS0OYWidr0ade/MhjBvrKSxjnbPXh994HXjwGotYZJHg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:54:01Z",
+		"mac": "ENC[AES256_GCM,data:LA/dh+KhuOmopCuvvYXuY4MKEctXdEy2DeZbWEVed5d58d4Rh3iS/oWLVXbfL6ff4e4cF4lKwXpvSatxrUY7ZKlM2nbD9EgqZMFuaEOqM2CeKKBIkGe5YE2OuS9tyhNOzVYYKMGL2fJVjqH2GXoVdmcCrB1elXTZ31sEV7OuQbA=,iv:KTQU8WOswO3wCUfvgPJFR00u9yUp+VaKfw0Wop3h/2A=,tag:S82Uj2aRXwTNNnAwMvRuBQ==,type:str]",
+		"version": "3.13.3"
+	}
+}
--- a/secrets/wg-config-tuxcomp.bin
+++ b/secrets/wg-config-tuxcomp.bin
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:kWithuLuVPw4zPHoB3QmBgycNNDoq+IlIvx4Xv+Y6N7Dyp+LoRophEm9B7mnIEYxRPA+L07vAKHkfr5gRK6nvsapNo2Ckp5iVKVr6M0eCbfbO/2QvXwRa4URmLYe6OSlTGAxBIw1kcaTpjzD18kj5rMfVoPq1pDR7Yt2kOzoz46AZWXmZmckOuEhum7FIYt++yL0dviKhSrZ36V6j2irQ9MdjmzIvoxysWyTSXjNXVPHEvCAa5Gi/EIeap8odnWnJzJiv2ARVZ154D8T8PWIRb7sbOgbNPeo9BDwB5d7RyhSXPlwA8hgPPggIoaVbTRtM5InxshfmsYWFUEApqemcPJWq9jYkmXaiAoQldVpM2/1eWKhpdsou39yYu4dpnnm1vtxKAPh7+NbJUP83gRzxKAlT8aTV3Sp/ydQua4Xc01gpVwZCqwvqxsX,iv:VjFrf0UXiWIFvQirwTjqSk7YHE9wj0LY26yNx8+8QGs=,tag:CqIsdFVQIw5atl+wAPu7bA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTbkZMc2c5YTNRV0VrZ2hn\ncElRaXlvMUl1NnZlOXB1bnJtTFEwc01CZ3hFClNPOXM0K1plaktqcDVhMjk4VnFP\nckphazRXSWtZcWxEbDR3NVlmUmJjUncKLS0tIGxoSGRDRVNqQ2QrNHFJeitHQjZW\nem9iNjcrb2VYc3ZQNEl1VDRRWFc2YjgKs40DWyILQgObJaKCDHBtBEwLt36sPrZ+\nBdVfZVXjNQD+2FwJNtaEhlsbKEJj0/XYvaE07xS8X3UeEelEvCvUeA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:54:24Z",
+		"mac": "ENC[AES256_GCM,data:xrl/yr7Uy3NPLhZzZRcslQGuZYY5ZTK7W4pYTt3XK5hmd4PWpg5Yvwl8WB3OZVC4D6dbJy8Cs8pC1ZpfUT6aoYETfMPYKjTrIUC4HsKN6YC8W1vKrqYkIHXWdcCNbDpQ/8rC/reFRW1Z4id616RI2m4lVQe5EOr8fexCSr6qyNk=,iv:aqecolbcJYfgY1arN+8p0bYo6hDpyrccSF91njPsVRE=,tag:AdmsE6avWbsYX1RmTZazhA==,type:str]",
+		"version": "3.13.3"
+	}
+}