35 lines
915 B
Nix
35 lines
915 B
Nix
# All sops secrets are edclared here (ssot).
|
|
# Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
|
|
let
|
|
# make secrets readable by our processes
|
|
rootOnly = {
|
|
format = "binary";
|
|
mode = "0400";
|
|
};
|
|
djaiOnly = rootOnly // {
|
|
owner = "djai";
|
|
};
|
|
in
|
|
{
|
|
# machine's age key, also used by `sops edit`.
|
|
sops.age.keyFile = "/home/djai/.config/sops/age/keys.txt";
|
|
# gotta make these lists empty or sops-nix will try to import our ssh keys
|
|
sops.age.sshKeyPaths = [ ];
|
|
sops.gnupg.sshKeyPaths = [ ];
|
|
|
|
sops.secrets = {
|
|
# ssh config (exposes hostnames/ips/ports)
|
|
"ssh-config" = djaiOnly // {
|
|
sopsFile = ./ssh-config.bin;
|
|
};
|
|
|
|
# wireguard tunnels
|
|
"wg-config-nixbook" = djaiOnly // {
|
|
sopsFile = ./wg-config-nixbook.bin;
|
|
};
|
|
"wg-config-tuxcomp" = djaiOnly // {
|
|
sopsFile = ./wg-config-tuxcomp.bin;
|
|
};
|
|
};
|
|
}
|