sora/nixconfig
1
0
Fork 1
Code Issues 2 Pull Requests Actions Releases Activity

Fix sops

Browse Source
This commit is contained in:
soraefir
2026-05-11 19:04:16 +02:00
parent ee1dec3d44
commit 370416edba
2 changed files with 27 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
modules/server/sops/default.nix
View File

@@ -7,12 +7,11 @@ let
in{ in{
sops.secrets = { sops.secrets = {
CUSTOM = { CUSTOM = {
mode = "0644"; mode = "0444";
sopsFile = ./server.yaml; sopsFile = ./server.yaml;
}; };
} // (lib.genAttrs (map (name: lib.toUpper name) allApps) (name: { } // (lib.genAttrs (map (name: lib.toUpper name) allApps) (name: {
owner = "postgres"; mode = "0444";
mode = "0644";
sopsFile = ./server.yaml; sopsFile = ./server.yaml;
})); }));
} }

37
modules/shared/sops/default.nix
View File

@@ -1,17 +1,28 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
listNames = config.syscfg.server.db; isCI = builtins.elem config.syscfg.hostname [ "ci" "sandbox" ];
containerNames = lib.mapAttrsToList (name: cfg: name) keyFilePath = (if isCI then
(lib.filterAttrs (name: cfg: ((cfg.db or false) || (cfg.sops or false))) config.syscfg.server.containers); "/var/lib/sops-nix/mock-key.txt"
allApps = lib.unique (listNames ++ containerNames); else
in{ "/var/lib/sops-nix/age-key.txt");
sops.secrets = { sopsFilePath = (if isCI then ./mock.yaml else ./common.yaml);
CUSTOM = { in {
mode = "0444"; environment.systemPackages = with pkgs; [ sops ];
sopsFile = ./server.yaml; environment.sessionVariables.SOPS_AGE_KEY_FILE = keyFilePath;
sops.defaultSopsFile = sopsFilePath;
sops.age.keyFile = keyFilePath;
sops.age.generateKey = true;
sops.secrets = lib.mkMerge [
{
wifi = { };
"${config.syscfg.hostname}_ssh_priv" = {
mode = "0400";
owner = config.users.users.${config.syscfg.defaultUser}.name;
group = config.users.users.${config.syscfg.defaultUser}.group;
}; };
} // (lib.genAttrs (map (name: lib.toUpper name) allApps) (name: { "${config.syscfg.hostname}_wg_priv" = { };
mode = "0444"; }
sopsFile = ./server.yaml; ];
}));
} }