commit 25935c191200f4cc48278ac6068d5f4b51efd88b
parent fc526f214a340dae1ae4a811170120bd63ea2690
Author: vin <vin@vineetk.net>
Date: Mon, 3 Mar 2025 00:48:14 -0500
start using agenix
Diffstat:
7 files changed, 150 insertions(+), 14 deletions(-)
diff --git a/.gitignore b/.gitignore
@@ -1 +1 @@
-*~
-\ No newline at end of file
+*~
diff --git a/flake.lock b/flake.lock
@@ -1,5 +1,26 @@
{
"nodes": {
+ "agenix": {
+ "inputs": {
+ "darwin": "darwin",
+ "home-manager": "home-manager",
+ "nixpkgs": "nixpkgs",
+ "systems": "systems"
+ },
+ "locked": {
+ "lastModified": 1736955230,
+ "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
+ "owner": "ryantm",
+ "repo": "agenix",
+ "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
+ "type": "github"
+ },
+ "original": {
+ "owner": "ryantm",
+ "repo": "agenix",
+ "type": "github"
+ }
+ },
"blobs": {
"flake": false,
"locked": {
@@ -16,6 +37,28 @@
"type": "gitlab"
}
},
+ "darwin": {
+ "inputs": {
+ "nixpkgs": [
+ "agenix",
+ "nixpkgs"
+ ]
+ },
+ "locked": {
+ "lastModified": 1700795494,
+ "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+ "owner": "lnl7",
+ "repo": "nix-darwin",
+ "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+ "type": "github"
+ },
+ "original": {
+ "owner": "lnl7",
+ "ref": "master",
+ "repo": "nix-darwin",
+ "type": "github"
+ }
+ },
"everblush-gtk": {
"inputs": {
"flake-parts": "flake-parts",
@@ -75,6 +118,27 @@
"home-manager": {
"inputs": {
"nixpkgs": [
+ "agenix",
+ "nixpkgs"
+ ]
+ },
+ "locked": {
+ "lastModified": 1703113217,
+ "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+ "owner": "nix-community",
+ "repo": "home-manager",
+ "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nix-community",
+ "repo": "home-manager",
+ "type": "github"
+ }
+ },
+ "home-manager_2": {
+ "inputs": {
+ "nixpkgs": [
"nixpkgs"
]
},
@@ -109,16 +173,16 @@
},
"nixpkgs": {
"locked": {
- "lastModified": 1738801271,
- "narHash": "sha256-d/4tG8DUwSUL1EVfnlevlWA3zjtlzQOx+8xSUhhpby8=",
- "owner": "nixos",
+ "lastModified": 1703013332,
+ "narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
+ "owner": "NixOS",
"repo": "nixpkgs",
- "rev": "f6c5b2b731ab9fae53cc985efd63eb18e7c170a3",
+ "rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
"type": "github"
},
"original": {
- "owner": "nixos",
- "ref": "nixos-unstable-small",
+ "owner": "NixOS",
+ "ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
@@ -174,6 +238,22 @@
},
"nixpkgs_2": {
"locked": {
+ "lastModified": 1738801271,
+ "narHash": "sha256-d/4tG8DUwSUL1EVfnlevlWA3zjtlzQOx+8xSUhhpby8=",
+ "owner": "nixos",
+ "repo": "nixpkgs",
+ "rev": "f6c5b2b731ab9fae53cc985efd63eb18e7c170a3",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nixos",
+ "ref": "nixos-unstable-small",
+ "repo": "nixpkgs",
+ "type": "github"
+ }
+ },
+ "nixpkgs_3": {
+ "locked": {
"lastModified": 1732014248,
"narHash": "sha256-y/MEyuJ5oBWrWAic/14LaIr/u5E0wRVzyYsouYY3W6w=",
"owner": "NixOS",
@@ -189,9 +269,10 @@
},
"root": {
"inputs": {
+ "agenix": "agenix",
"everblush-gtk": "everblush-gtk",
- "home-manager": "home-manager",
- "nixpkgs": "nixpkgs",
+ "home-manager": "home-manager_2",
+ "nixpkgs": "nixpkgs_2",
"nixpkgs-stable": "nixpkgs-stable",
"simple-nixos-mailserver": "simple-nixos-mailserver"
}
@@ -200,7 +281,7 @@
"inputs": {
"blobs": "blobs",
"flake-compat": "flake-compat",
- "nixpkgs": "nixpkgs_2",
+ "nixpkgs": "nixpkgs_3",
"nixpkgs-24_11": "nixpkgs-24_11"
},
"locked": {
@@ -217,6 +298,21 @@
"repo": "nixos-mailserver",
"type": "gitlab"
}
+ },
+ "systems": {
+ "locked": {
+ "lastModified": 1681028828,
+ "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+ "owner": "nix-systems",
+ "repo": "default",
+ "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nix-systems",
+ "repo": "default",
+ "type": "github"
+ }
}
},
"root": "root",
diff --git a/flake.nix b/flake.nix
@@ -17,9 +17,11 @@
};
simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-24.11";
+
+ agenix.url = "github:ryantm/agenix";
};
- outputs = { self, home-manager, nixpkgs, nixpkgs-stable, everblush-gtk, simple-nixos-mailserver, ... }@inputs: {
+ outputs = { self, home-manager, nixpkgs, nixpkgs-stable, everblush-gtk, simple-nixos-mailserver, agenix, ... }@inputs: {
# TODO: deduplicate this
nixosConfigurations = {
demiurge = nixpkgs.lib.nixosSystem {
@@ -27,6 +29,7 @@
specialArgs = inputs;
modules = [
./hosts/demiurge
+ agenix.nixosModules.default
home-manager.nixosModules.home-manager {
home-manager.extraSpecialArgs = {
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
@@ -7,6 +7,21 @@
home-manager.nixosModules.default
];
+ # decrypt agenix secrets
+ age.secrets = {
+ tailscale_demiurge = {
+ file = ../../secrets/tailscale_demiurge.age;
+ owner = "root";
+ group = "root";
+ };
+
+ smallstep = {
+ file = ../../secrets/smallstep.age;
+ owner = "step-ca";
+ group = "step-ca";
+ };
+ };
+
# boot options
boot = {
loader = {
@@ -755,7 +770,7 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
enable = true;
address = "127.0.0.1";
port = 4433;
- intermediatePasswordFile = "/run/keys/smallstep-password";
+ intermediatePasswordFile = config.age.secrets.smallstep.path;
settings = {
root = "/var/lib/step-ca/certs/root_ca.crt";
@@ -799,7 +814,7 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
# vpn
tailscale = {
enable = true;
- authKeyFile = "/run/secrets/tailscale_key";
+ authKeyFile = config.age.secrets.tailscale_demiurge.path;
extraDaemonFlags = [ "--no-logs-no-support" ];
extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
openFirewall = true;
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -0,0 +1,12 @@
+let
+ vin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge";
+ users = [ vin ];
+
+ demiurge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICXDBcX7hXJCaKDRNaIAfycU83Y2J+uEB4wcALBOQpse";
+ saklas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM7RCmfdgJKPnaBi336ZcvDWboxPj8lTtW1eDTN5qR2R";
+ systems = [ demiurge saklas ];
+in
+{
+ "tailscale_demiurge.age".publicKeys = users ++ systems;
+ "smallstep.age".publicKeys = users ++ systems;
+}
diff --git a/secrets/smallstep.age b/secrets/smallstep.age
Binary files differ.
diff --git a/secrets/tailscale_demiurge.age b/secrets/tailscale_demiurge.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ Tgl9rg4GuKxgZMuHcwCw7ykOoZqRX3t4UN/E9qcMZSI
+LdVTcOS8pGeKwh/18QYtaGFuSRTKawDTtYyvurev0NE
+-> ssh-ed25519 F30WWA G0HHHxSzX7RznR8CLhlDOqev4a8eA5odn6IyJnEZaRA
+j9ivd4Jg3uAO13ffuouTlGyJDsTppBlHGFftzSncuKM
+-> ssh-ed25519 hc2ELA iCpXfQ7xRoQNkN0meAy3weOJkWOLY9dLNm9chmMGmlE
+6E7ZRjh7C+HrjyzGCVAf5Menk4UGXyIRrqOAb4nyOvI
+--- QgTpqSI1sMG0nNYu1jtZAKJ9pcvCVgivW7UW24+F9nw
+к!J%ngNheG/
+ej~TBEm`k⍾pIpR 5~96?+8>
+\ No newline at end of file
