From 2c121c5411a78a5e8fc98b145c9667c8528e238c Mon Sep 17 00:00:00 2001 From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com> Date: Tue, 30 Dec 2025 10:23:03 -0600 Subject: new secrets-management system --- hosts/ganymede/caddy-tailscale-authkey.age | 6 ++++++ hosts/ganymede/config.nix | 12 +++++++++-- hosts/ganymede/williams-psk.age | 5 +++++ lib/nix-furnace/mkSystem.nix | 2 -- modules/secrets/nixos/default.nix | 17 ++++++++++++++++ modules/secrets/options.nix | 32 ++++++++++++++++++++++++++++++ modules/services/nixos/selfhost/caddy.nix | 6 ++---- secrets.nix | 10 ++++++++++ secrets/caddy-tailscale-authkey.age | 6 ------ secrets/default.nix | 9 --------- secrets/secrets.nix | 9 --------- secrets/williams-psk.age | 5 ----- 12 files changed, 82 insertions(+), 37 deletions(-) create mode 100644 hosts/ganymede/caddy-tailscale-authkey.age create mode 100644 hosts/ganymede/williams-psk.age create mode 100644 modules/secrets/nixos/default.nix create mode 100644 modules/secrets/options.nix create mode 100644 secrets.nix delete mode 100644 secrets/caddy-tailscale-authkey.age delete mode 100644 secrets/default.nix delete mode 100644 secrets/secrets.nix delete mode 100644 secrets/williams-psk.age diff --git a/hosts/ganymede/caddy-tailscale-authkey.age b/hosts/ganymede/caddy-tailscale-authkey.age new file mode 100644 index 0000000..f2a7de6 --- /dev/null +++ b/hosts/ganymede/caddy-tailscale-authkey.age @@ -0,0 +1,6 @@ +age-encryption.org/v1 +-> ssh-ed25519 Jg4yWQ xYq/DjdgQ3LJhg797pf3LA39bU9akYBLd+RoH7RMPm4 +p9CQSoh2511x7c0WAUPut4hWA3k0AI5b2fQEol5Hqs4 +--- hkbJJSCnoSYIyHtbtuLKz+fN17anXp31b2MAADIpH/4 +Ћs hZ +NZzvnB繯xZ;qY-"`'O͜P`PiTBsWJTv[?3L܌vԻeh \ No newline at end of file diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 8e751eb..b2feb60 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -1,7 +1,12 @@ -{ +{config, ...}: { collinux = { user.name = "collin"; + secrets = { + "williams-psk".file = ./williams-psk.age; + "caddy-tailscale-authkey".file = ./caddy-tailscale-authkey.age; + }; + terminal = { programs = { git = { @@ -30,7 +35,10 @@ selfhost = { adguard.enable = true; - caddy.enable = true; + caddy = { + enable = true; + envFile = config.collinux.secrets."caddy-tailscale-authkey".path; + }; }; }; }; diff --git a/hosts/ganymede/williams-psk.age b/hosts/ganymede/williams-psk.age new file mode 100644 index 0000000..1f26949 --- /dev/null +++ b/hosts/ganymede/williams-psk.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 Jg4yWQ x4yUAZMn9eCey8YxPpdecYM/gjL81nLx8knzQcZDlV0 +5me7Z8K2hvNyTNY80GUM+rB9trko2x1MyUHRmCXl9vA +--- sQ2n7Rc6fd4QqfibSvSJGvTCKXygTeas4rVBlUXreVE +|wBAB:B-=VD؄}Epnq \ No newline at end of file diff --git a/lib/nix-furnace/mkSystem.nix b/lib/nix-furnace/mkSystem.nix index b3daf3a..e547eb2 100644 --- a/lib/nix-furnace/mkSystem.nix +++ b/lib/nix-furnace/mkSystem.nix @@ -24,8 +24,6 @@ let ../../modules/options.nix ../../hosts/${hostname}/config.nix (lazyImport ../../hosts/${hostname}/nixos.nix) - inputs.agenix.nixosModules.default - ../../secrets/default.nix ] ++ (listModules |> (builtins.map (modName: [ diff --git a/modules/secrets/nixos/default.nix b/modules/secrets/nixos/default.nix new file mode 100644 index 0000000..e5e6662 --- /dev/null +++ b/modules/secrets/nixos/default.nix @@ -0,0 +1,17 @@ +{ + inputs, + config, + ... +}: let + cfg = config.collinux.secrets; +in { + imports = [ + inputs.agenix.nixosModules.default + ]; + + age = { + identityPaths = ["/etc/ssh/ssh_host_ed25519_key"]; + secretsDir = "/run/secrets.d"; + secrets = cfg; + }; +} diff --git a/modules/secrets/options.nix b/modules/secrets/options.nix new file mode 100644 index 0000000..de15f50 --- /dev/null +++ b/modules/secrets/options.nix @@ -0,0 +1,32 @@ +{lib, ...}: let + inherit (lib) mkOption; +in { + options = { + collinux.secrets = lib.mkOption { + type = lib.types.attrsOf ( + lib.types.submodule ({config, ...}: { + options = { + name = mkOption { + type = lib.types.str; + default = config._module.args.name; + }; + file = mkOption {type = lib.types.path;}; + mode = mkOption { + type = lib.types.str; + default = "0400"; + }; + owner = mkOption { + type = lib.types.str; + default = "0"; + }; + path = mkOption { + type = lib.types.str; + default = "/run/secrets.d/${config.name}"; + }; + }; + }) + ); + default = {}; + }; + }; +} diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix index 367585d..85a840a 100644 --- a/modules/services/nixos/selfhost/caddy.nix +++ b/modules/services/nixos/selfhost/caddy.nix @@ -8,9 +8,7 @@ in lib.mkIf cfg.enable (lib.mkMerge [ { - services.caddy = { - enable = true; - }; + services.caddy.enable = true; networking.firewall.allowedTCPPorts = [80 443]; environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff } @@ -22,7 +20,7 @@ in ]; hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus="; }; - environmentFile = config.age.secrets."caddy-tailscale-authkey".path; + environmentFile = cfg.envFile; }; }) ]) diff --git a/secrets.nix b/secrets.nix new file mode 100644 index 0000000..7d7cb19 --- /dev/null +++ b/secrets.nix @@ -0,0 +1,10 @@ +let + # host keys + mercury = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN"; + jupiter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8"; + ganymede = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9"; +in { + "caddy-tailscale-authkey.age".publicKeys = [ganymede]; + "williams-psk.age".publicKeys = [ganymede]; + "github-ssh-key.age".publicKeys = [mercury ganymede jupiter]; +} diff --git a/secrets/caddy-tailscale-authkey.age b/secrets/caddy-tailscale-authkey.age deleted file mode 100644 index f2a7de6..0000000 --- a/secrets/caddy-tailscale-authkey.age +++ /dev/null @@ -1,6 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 Jg4yWQ xYq/DjdgQ3LJhg797pf3LA39bU9akYBLd+RoH7RMPm4 -p9CQSoh2511x7c0WAUPut4hWA3k0AI5b2fQEol5Hqs4 ---- hkbJJSCnoSYIyHtbtuLKz+fN17anXp31b2MAADIpH/4 -Ћs hZ -NZzvnB繯xZ;qY-"`'O͜P`PiTBsWJTv[?3L܌vԻeh \ No newline at end of file diff --git a/secrets/default.nix b/secrets/default.nix deleted file mode 100644 index b9e8c6f..0000000 --- a/secrets/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ - age = { - identityPaths = ["/etc/ssh/ssh_host_ed25519_key"]; - secrets = { - "caddy-tailscale-authkey".file = ./caddy-tailscale-authkey.age; - "williams-psk".file = ./williams-psk.age; - }; - }; -} diff --git a/secrets/secrets.nix b/secrets/secrets.nix deleted file mode 100644 index 29b3d28..0000000 --- a/secrets/secrets.nix +++ /dev/null @@ -1,9 +0,0 @@ -let - # host keys - mercury = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN"; - jupiter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8"; - ganymede = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9"; -in { - "caddy-tailscale-authkey.age".publicKeys = [ganymede]; - "williams-psk.age".publicKeys = [ganymede]; -} diff --git a/secrets/williams-psk.age b/secrets/williams-psk.age deleted file mode 100644 index 1f26949..0000000 --- a/secrets/williams-psk.age +++ /dev/null @@ -1,5 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 Jg4yWQ x4yUAZMn9eCey8YxPpdecYM/gjL81nLx8knzQcZDlV0 -5me7Z8K2hvNyTNY80GUM+rB9trko2x1MyUHRmCXl9vA ---- sQ2n7Rc6fd4QqfibSvSJGvTCKXygTeas4rVBlUXreVE -|wBAB:B-=VD؄}Epnq \ No newline at end of file -- cgit v1.3.1