46 lines
1.2 KiB
Nix
46 lines
1.2 KiB
Nix
# All sops secrets are edclared here (ssot).
|
|
# Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
|
|
let
|
|
# make secrets readable by our processes
|
|
rootOnly = {
|
|
format = "binary";
|
|
mode = "0400";
|
|
};
|
|
djaiOnly = rootOnly // {
|
|
owner = "djai";
|
|
};
|
|
in
|
|
{
|
|
# machine's age key, also used by `sops edit`.
|
|
sops.age.keyFile = "/home/djai/.config/sops/age/keys.txt";
|
|
# gotta make these lists empty or sops-nix will try to import our ssh keys
|
|
sops.age.sshKeyPaths = [ ];
|
|
sops.gnupg.sshKeyPaths = [ ];
|
|
|
|
sops.secrets = {
|
|
# ssh config (exposes hostnames/ips/ports)
|
|
"ssh-config" = djaiOnly // {
|
|
sopsFile = ./ssh-config.bin; # TODO: actually use this
|
|
};
|
|
|
|
# npm caddy certificates
|
|
"npm-certificate-private" = rootOnly // {
|
|
sopsFile = ./npm-certificate-private.bin;
|
|
};
|
|
"npm-certificate-shared" = rootOnly // {
|
|
sopsFile = ./npm-certificate-shared.bin;
|
|
};
|
|
"npm-certificate-public" = rootOnly // {
|
|
sopsFile = ./npm-certificate-public.bin;
|
|
};
|
|
|
|
# wireguard tunnels
|
|
"wg-config-nixbook" = djaiOnly // {
|
|
sopsFile = ./wg-config-nixbook.bin;
|
|
};
|
|
"wg-config-tuxcomp" = djaiOnly // {
|
|
sopsFile = ./wg-config-tuxcomp.bin;
|
|
};
|
|
};
|
|
}
|