diff options
| -rw-r--r-- | hosts/ganymede/caddy-tailscale-authkey.age (renamed from secrets/caddy-tailscale-authkey.age) | 0 | ||||
| -rw-r--r-- | hosts/ganymede/config.nix | 12 | ||||
| -rw-r--r-- | hosts/ganymede/williams-psk.age (renamed from secrets/williams-psk.age) | 0 | ||||
| -rw-r--r-- | lib/nix-furnace/mkSystem.nix | 2 | ||||
| -rw-r--r-- | modules/secrets/nixos/default.nix | 17 | ||||
| -rw-r--r-- | modules/secrets/options.nix | 32 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/caddy.nix | 6 | ||||
| -rw-r--r-- | secrets.nix (renamed from secrets/secrets.nix) | 1 | ||||
| -rw-r--r-- | secrets/default.nix | 9 |
9 files changed, 62 insertions, 17 deletions
diff --git a/secrets/caddy-tailscale-authkey.age b/hosts/ganymede/caddy-tailscale-authkey.age index f2a7de6..f2a7de6 100644 --- a/secrets/caddy-tailscale-authkey.age +++ b/hosts/ganymede/caddy-tailscale-authkey.age diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 8e751eb..b2feb60 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -1,7 +1,12 @@ -{ +{config, ...}: { collinux = { user.name = "collin"; + secrets = { + "williams-psk".file = ./williams-psk.age; + "caddy-tailscale-authkey".file = ./caddy-tailscale-authkey.age; + }; + terminal = { programs = { git = { @@ -30,7 +35,10 @@ selfhost = { adguard.enable = true; - caddy.enable = true; + caddy = { + enable = true; + envFile = config.collinux.secrets."caddy-tailscale-authkey".path; + }; }; }; }; diff --git a/secrets/williams-psk.age b/hosts/ganymede/williams-psk.age index 1f26949..1f26949 100644 --- a/secrets/williams-psk.age +++ b/hosts/ganymede/williams-psk.age diff --git a/lib/nix-furnace/mkSystem.nix b/lib/nix-furnace/mkSystem.nix index b3daf3a..e547eb2 100644 --- a/lib/nix-furnace/mkSystem.nix +++ b/lib/nix-furnace/mkSystem.nix @@ -24,8 +24,6 @@ let ../../modules/options.nix ../../hosts/${hostname}/config.nix (lazyImport ../../hosts/${hostname}/nixos.nix) - inputs.agenix.nixosModules.default - ../../secrets/default.nix ] ++ (listModules |> (builtins.map (modName: [ diff --git a/modules/secrets/nixos/default.nix b/modules/secrets/nixos/default.nix new file mode 100644 index 0000000..e5e6662 --- /dev/null +++ b/modules/secrets/nixos/default.nix @@ -0,0 +1,17 @@ +{ + inputs, + config, + ... +}: let + cfg = config.collinux.secrets; +in { + imports = [ + inputs.agenix.nixosModules.default + ]; + + age = { + identityPaths = ["/etc/ssh/ssh_host_ed25519_key"]; + secretsDir = "/run/secrets.d"; + secrets = cfg; + }; +} diff --git a/modules/secrets/options.nix b/modules/secrets/options.nix new file mode 100644 index 0000000..de15f50 --- /dev/null +++ b/modules/secrets/options.nix @@ -0,0 +1,32 @@ +{lib, ...}: let + inherit (lib) mkOption; +in { + options = { + collinux.secrets = lib.mkOption { + type = lib.types.attrsOf ( + lib.types.submodule ({config, ...}: { + options = { + name = mkOption { + type = lib.types.str; + default = config._module.args.name; + }; + file = mkOption {type = lib.types.path;}; + mode = mkOption { + type = lib.types.str; + default = "0400"; + }; + owner = mkOption { + type = lib.types.str; + default = "0"; + }; + path = mkOption { + type = lib.types.str; + default = "/run/secrets.d/${config.name}"; + }; + }; + }) + ); + default = {}; + }; + }; +} diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix index 367585d..85a840a 100644 --- a/modules/services/nixos/selfhost/caddy.nix +++ b/modules/services/nixos/selfhost/caddy.nix @@ -8,9 +8,7 @@ in lib.mkIf cfg.enable (lib.mkMerge [ { - services.caddy = { - enable = true; - }; + services.caddy.enable = true; networking.firewall.allowedTCPPorts = [80 443]; environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff } @@ -22,7 +20,7 @@ in ]; hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus="; }; - environmentFile = config.age.secrets."caddy-tailscale-authkey".path; + environmentFile = cfg.envFile; }; }) ]) diff --git a/secrets/secrets.nix b/secrets.nix index 29b3d28..7d7cb19 100644 --- a/secrets/secrets.nix +++ b/secrets.nix @@ -6,4 +6,5 @@ let in { "caddy-tailscale-authkey.age".publicKeys = [ganymede]; "williams-psk.age".publicKeys = [ganymede]; + "github-ssh-key.age".publicKeys = [mercury ganymede jupiter]; } diff --git a/secrets/default.nix b/secrets/default.nix deleted file mode 100644 index b9e8c6f..0000000 --- a/secrets/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ - age = { - identityPaths = ["/etc/ssh/ssh_host_ed25519_key"]; - secrets = { - "caddy-tailscale-authkey".file = ./caddy-tailscale-authkey.age; - "williams-psk".file = ./williams-psk.age; - }; - }; -} |