From 903041b6e1efa16b0a0666870754ff73330c3c97 Mon Sep 17 00:00:00 2001 From: Simon Bruder Date: Sat, 12 Dec 2020 16:50:25 +0100 Subject: [PATCH] Use pass for secrets management Fixes #4 --- lib/krops.nix | 4 ++++ machines/nunotaba/krops.nix | 2 +- machines/nunotaba/secrets/wg-home_private_key | Bin 67 -> 0 bytes machines/sayuri/hardware-configuration.nix | 2 +- machines/sayuri/secrets/data_luks_key | Bin 4118 -> 0 bytes machines/sayuri/secrets/wg-home_private_key | Bin 67 -> 0 bytes modules/restic.nix | 4 ++-- modules/wireguard/home.nix | 2 +- secrets/restic_password | Bin 71 -> 0 bytes secrets/s3_credentials | Bin 124 -> 0 bytes 10 files changed, 9 insertions(+), 5 deletions(-) delete mode 100644 machines/nunotaba/secrets/wg-home_private_key delete mode 100644 machines/sayuri/secrets/data_luks_key delete mode 100644 machines/sayuri/secrets/wg-home_private_key delete mode 100644 secrets/restic_password delete mode 100644 secrets/s3_credentials diff --git a/lib/krops.nix b/lib/krops.nix index ff301c2..ab4ed97 100644 --- a/lib/krops.nix +++ b/lib/krops.nix @@ -17,6 +17,10 @@ let }; config.file = toString ../.; nixos-config.symlink = "config/machines/${hostname}/configuration.nix"; + secrets.pass = { + dir = toString ~/.password-store; + name = "nixos/machines/${hostname}"; + }; } // extraSources) ]; in diff --git a/machines/nunotaba/krops.nix b/machines/nunotaba/krops.nix index 3e5a158..8ea98a9 100644 --- a/machines/nunotaba/krops.nix +++ b/machines/nunotaba/krops.nix @@ -1,3 +1,3 @@ -import ../../lib/krops.nix { +import ../../lib/krops.nix rec { hostname = "nunotaba"; } diff --git a/machines/nunotaba/secrets/wg-home_private_key b/machines/nunotaba/secrets/wg-home_private_key deleted file mode 100644 index e0d4ee0d1ab34b7b611f3a25147d4a86902d7a05..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 67 zcmV-J0KESIM@dveQdv+`0O5U|hVdFfAai8pRRx8>1`8b&qy6#hG$t; }; }; }; diff --git a/machines/sayuri/secrets/data_luks_key b/machines/sayuri/secrets/data_luks_key deleted file mode 100644 index cac47d4ea98567ba7db3b76a445bd2ffbf8a11bb..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4118 zcmV+x5b5s#M@dveQdv+`0N=o?S@nASE_09Pn+OOZ{!v|v89#WC;4JF&;bv}z;dL*H ztO{teT=R^OBsU3<_44{7Vc2}`>H13OiOMyo&-ZqWkCqqgL4$UQmJ%OQ+er2e>n^}= zY$uz_Apy5zVzfU_{x!^vbT~3bE}16j?^nUI3Zz~JI|;jfMRO)WZ=*qpm*uH6VB_&) z&hFZlt_L_}fB3F`YTr!`(0*(^*f91MsZaHoP*q9wi*ihf)T1-MX|l69QR}XMe$%_e0QVyX+q@s8lo>q#Sg}(C70m)^yTn zHZk`kPm<4VtjUouD#v4*>q`$~f~L~kuRemDZ5Hx9v;^t~Np_9gv{p@Bqf=args4tR zyU9Xwu&AeP>&Rkcd@xUj4`!a`f4R|nS_7w1B6Cbg=Tk78D@;80VvA2yHI(VMK1pR+i#!A$7W*=d~-k{Y5X^; z^tpY}g zAmSPHxf7jR?Gf>pgzw41E z_U7k3s-qUg{3!rrPI%r*$I#U$dYlPz~ORuR-In;x3Rz7O(~A zkGg(6*+IXkfMktLeBY2qV9;@v|I%y>lyt%)ut?8_3GMfB0Gkc@WHv?6Yp+qCZVO3v zf3fz-&CIetG?9K&(Y+vJ?EF_G1=SL?6b>Ag)!bd#SciO3Lp%6aAl9A8))*DW7pjR> zC%+~VF_o&ghky;WJvPrA?}(b5I zoe-FdeVl?QH1~2*aO$p_@EJrTAT~?-7nmqr0;3wok7{zzMd)x2ns@veqA)v#9;6VYsnEAI zY#CUhb%J7tP4l=ajm%zRkq$l;@^hQd5-NFrxZ&w5BEn&$Ey$cKt9YR>x)de@&P7AM zHX=fuY1V8n(yThyNNe580Lc!1@kp*6dlXe)qroy@ve|aL$xnEE#Q<%jeH);%3YnnJ zu3Q!3hcRG_DE0&goKic8*r4bUa4ZOs`w0NulP!6zZGW-SE20&f=An;4>aQgaAA1j@ zjLOlI;~~KAIvg^9JThyNmfIvzw)5a1C5fqEm;<8f-u6v|sdW9qF;&x&Z+lY_=v ze$xLQ*s@a6t=}mqaw`n(^Qf(RSy7!$h=FTBacUxwF&i{gqS#U2JZS)hU;d0q8u|6SH$w;U`O{+Woc5N7$p;VJgtAr;d<^` zkTsNhmcfCKo4RJAmH><2J1}Q9F>2g_G*-Q16s$54OJiviuY(Ew)qgc%(SzgNnduCu z3FHHouQtrIyJVcXzrZ&5TRCihswzJLryF!y=2#b_XlsgoX%e^l>$SXcwg+{{Lral@ zR(JeMXm+27FmMn4&W1DS5&af!LE;j7$sSUO#}h`qnTe!+yCCJF;S=iM%VOa@dn9Vo z)CehA6cuoNGn5~Gu&dyglpxHDia0kS!ck~&4%jD2a+dWCoLTPBiIzW0m#EaVCp8`z z913YAv^%ZlAb0!evqTxG+9Xk7q2Tl_Ci~C0o_*_~T)(iWmHSIT9BSVxy&$5b+O7iO zbEX(E!31d*!JJ#v`6&2t$Dp6<(k8L9Oh$wsKS&Tu=hE zvIr`0z(yiU7R12_O|XM&Gd*m9<5>iBE-&{=QI&Jn*BC zaML_VI}g_wo?W+3Qu`~Yi+ibjyxxL4o+e?JRK)vg)g1INR_GggL>Z$+$IGO$Stwh& z5OwP<;p2Rx;5Csh?}0&2VBG-B!#mQ3kjge%iOna2l(zRL{Bh9O5ovO?;W#-ha#3*A zrx?P>B~bIO5NGPX)0-r`8smQe>;?ucob<#PsC4yZPr1xnW@O9Z8iMq-;77b72RRlf zU4;=59sGV)4`VI`M(h!Bkh)?J!6e?O9_3vo&X-OWKX2FO0$s08Eilwh=`sU|fs`jp z{j_=5BRu9mF7VJyR6AwyeNRj(}qV)pkKhDcXx8Z>B-?r=F4mEyA*Sz*N9wc?a` zi%yY*BX!GYL$Q)SjLa}6GnY^OW}3Izo#7D<+Q5WHfcrhA4w{5{OgAbj`!W4UD|2o_ z_TidNq8K^2cP@a(IHD&j4o#cQPMh0OAYncuHLz9 zY$~~oDu8XKk5l9lhLJ!G7nARs4|v)@#`r&i;;EdyF}*H1UX-4;Kt|f~+#c1l_6u(i zm2U7XQ&8&~HiM%`Be|J@EBEcdi5udnH(npM3i7 zlap$a0sPUm5|Hpms5x2>Ul{ta`xx%XRd-j8HC(<5#yng@2&X#`oKgaFkF~2L5+@nQ zwDu?>jp?kVSr7t>8Gfy+yf4nV)XA;RCuD$!u140kx~--?X~C1w(|T+P#6L)3N76qGesB{0#wN7?;{Ub<15lN$(b4R0rABOR34h1mip|c$eXA# zevc^0&MR=5_LYYAHUps>x%@a|;MPIs>@vC97Z?(@HR430f8~|6hzG&vgFI7BI@RT? z0BZVuAfLgAyCQje=@7+>Ak^bc<}-{oXEsuzvBI#nHniGPp`uiDybR6h`w|Lh*}&7q!@B_Vi)}ke+Yv(BsS%I5-x|MpWx%Sj z0cUpMI66Q0DpdS7U=>eDc4C!s{L?VJc@ECCD4IQ()AqHaBnKElq8 zU#?OWL=SVI8Q<(uEW%^0Ua|6AS6gIk^PSVp@Rve&<}Z`_dD(K6r3@l^8wd2U+YvFs zi}kcxWdnMF3_$~k_V#jDDhWne5u_5Mm~TJ$WD|LO*>Ql0BMC}16lvmj<7G+>MT6ML z5FLWC2jMK2a;pCs{YP<(LH3U%7igWgd?U-MXy0kmqaaf1COT{HAUwg;C(OrF20(T0 zcYRE=Ffj+Lhjn)OevYa;dpT#e!N z0_#b8F#jGi8$6`~VTLRo_}i{iNpL;c3flNy2$ce^Xp?K+&;olgJ*~Qk8IDu3 zU|2eLc&B#9c;}gjJZ6eN!Q${qO0$z-thXC!9q%GXn3AEnzJNX9zKsaQl}IsFgD6nl z88Y)QLJmvDyipth;v>n_8nLVOQijKal_Mm$5EmrRWH~=DN5h;-uKOG5roLligB@K6 zOVzv2VCy0V%yTy$g*$<>lK)a8@5W8D&T0L8iN4O`)|J z;~_)(J?>8j@grX5gB)VLJ~C+YBZNg2yg~a{X=&#%g1Oyf@kmAeb{jphFPD0N#CC8b zajHGJ<*R<<^rDVDESO1#VnhT~P{hLryI-zmUaEKJK{v*i89A7TIi diff --git a/modules/restic.nix b/modules/restic.nix index 44c9b12..65eeea7 100644 --- a/modules/restic.nix +++ b/modules/restic.nix @@ -69,8 +69,8 @@ in config = lib.mkIf cfg.enable { services.restic.backups."${name}" = { - passwordFile = toString (../secrets/restic_password); - s3CredentialsFile = toString ../secrets/s3_credentials; + passwordFile = toString ; + s3CredentialsFile = toString ; repository = "s3:https://s3.eu-central-1.wasabisys.com/sbruder-restic"; paths = lib.mkDefault ( [ ] diff --git a/modules/wireguard/home.nix b/modules/wireguard/home.nix index 194d4b6..6eb3b69 100644 --- a/modules/wireguard/home.nix +++ b/modules/wireguard/home.nix @@ -14,7 +14,7 @@ in privateKeyFile = lib.mkOption { type = lib.types.str; description = "Private key file"; - default = toString (../../machines/. + "/${config.networking.hostName}" + /secrets/wg-home_private_key); + default = toString ; }; }; }; diff --git a/secrets/restic_password b/secrets/restic_password deleted file mode 100644 index a565a3025b656758af3dd602859c37349f3f301b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 71 zcmV-N0J#4EM@dveQdv+`09(E5tI~pzpJ+ClA>#4d_$v5q4b_kQih%;A?!D7l(1x!k d-Wg0a=><61Qt e@VS)ekk(TBh7xvwxOnYIfsST<>7$kS7PdMXAUH(;