From b54be3998fa2c35436c32f85a1d7d0e0ce079208 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Tue, 18 Feb 2025 21:47:38 -0500 Subject: [PATCH] flake: migrate to agenix-rekey --- flake.lock | 33 +++++++ flake.nix | 24 ++++- hosts/Infini-DESKTOP/default.nix | 2 + hosts/Infini-DL360/default.nix | 4 + hosts/Infini-DL360/forgejo.nix | 2 +- hosts/Infini-DL360/secrets/authentik-ldap.age | 11 +++ hosts/Infini-DL360/secrets/authentik.age | 10 +++ hosts/Infini-DL360/secrets/default.nix | 17 ++++ hosts/Infini-DL360/secrets/freshrss.age | 11 +++ hosts/Infini-DL360/secrets/hedgedoc.age | Bin 0 -> 553 bytes hosts/Infini-DL360/secrets/hydra.age | 9 ++ hosts/Infini-DL360/secrets/ovpn.age | 10 +++ hosts/Infini-DL360/secrets/radicale-ldap.age | 10 +++ hosts/Infini-DL360/secrets/searx.age | Bin 0 -> 449 bytes hosts/Infini-DL360/secrets/vaultwarden.age | Bin 0 -> 625 bytes hosts/Infini-FRAMEWORK/default.nix | 2 + hosts/Infini-OPTIPLEX/default.nix | 2 + hosts/Infini-RASPBERRY/default.nix | 3 + hosts/Infini-SD/default.nix | 2 + hosts/Infini-SERVER/default.nix | 2 + hosts/hermes/default.nix | 2 + hosts/hestia/default.nix | 2 + hosts/iris/default.nix | 4 +- lib/default.nix | 1 + lib/secrets.nix | 13 +++ modules/global/general.nix | 2 +- modules/global/packages.nix | 1 - modules/global/security.nix | 2 +- secrets/binary-cache-private-key.age | Bin 3064 -> 502 bytes secrets/binary-cache-public-key | 1 - secrets/borg-password.age | 63 ++------------ secrets/borg-ssh-key.age | Bin 3381 -> 856 bytes secrets/default.nix | 82 +++--------------- secrets/dns-cloudflare.age | 10 +++ secrets/{ => old}/authentik-ldap.age | 0 secrets/{ => old}/authentik.age | Bin secrets/old/binary-cache-private-key.age | Bin 0 -> 3064 bytes secrets/old/borg-password.age | 56 ++++++++++++ secrets/old/borg-ssh-key.age | Bin 0 -> 3381 bytes secrets/{ => old}/cloudflare.age | 0 secrets/{ => old}/freshrss.age | 0 secrets/{ => old}/hedgedoc.age | Bin secrets/{ => old}/hydra.age | 0 secrets/{ => old}/infinidoge-password.age | 0 secrets/{ => old}/ovpn.age | 0 secrets/{ => old}/personal-smtp-password.age | 0 secrets/{ => old}/radicale-ldap.age | Bin secrets/{ => old}/root-password.age | 0 secrets/{ => old}/searx.age | 0 secrets/{ => old}/smtp-password.age | 0 secrets/{ => old}/vaultwarden.age | Bin secrets/secrets.nix | 52 ----------- secrets/smtp-noreply.age | Bin 0 -> 509 bytes shell.nix | 5 +- users/infinidoge/default.nix | 16 +++- users/infinidoge/keys/backup_age.pub | 7 ++ users/infinidoge/keys/primary_age.pub | 7 ++ users/infinidoge/password.age | Bin 0 -> 493 bytes users/infinidoge/smtp-personal.age | Bin 0 -> 488 bytes users/root/default.nix | 5 +- users/root/password.age | 11 +++ 61 files changed, 306 insertions(+), 190 deletions(-) create mode 100644 hosts/Infini-DL360/secrets/authentik-ldap.age create mode 100644 hosts/Infini-DL360/secrets/authentik.age create mode 100644 hosts/Infini-DL360/secrets/default.nix create mode 100644 hosts/Infini-DL360/secrets/freshrss.age create mode 100644 hosts/Infini-DL360/secrets/hedgedoc.age create mode 100644 hosts/Infini-DL360/secrets/hydra.age create mode 100644 hosts/Infini-DL360/secrets/ovpn.age create mode 100644 hosts/Infini-DL360/secrets/radicale-ldap.age create mode 100644 hosts/Infini-DL360/secrets/searx.age create mode 100644 hosts/Infini-DL360/secrets/vaultwarden.age create mode 100644 lib/secrets.nix delete mode 100644 secrets/binary-cache-public-key create mode 100644 secrets/dns-cloudflare.age rename secrets/{ => old}/authentik-ldap.age (100%) rename secrets/{ => old}/authentik.age (100%) create mode 100644 secrets/old/binary-cache-private-key.age create mode 100644 secrets/old/borg-password.age create mode 100644 secrets/old/borg-ssh-key.age rename secrets/{ => old}/cloudflare.age (100%) rename secrets/{ => old}/freshrss.age (100%) rename secrets/{ => old}/hedgedoc.age (100%) rename secrets/{ => old}/hydra.age (100%) rename secrets/{ => old}/infinidoge-password.age (100%) rename secrets/{ => old}/ovpn.age (100%) rename secrets/{ => old}/personal-smtp-password.age (100%) rename secrets/{ => old}/radicale-ldap.age (100%) rename secrets/{ => old}/root-password.age (100%) rename secrets/{ => old}/searx.age (100%) rename secrets/{ => old}/smtp-password.age (100%) rename secrets/{ => old}/vaultwarden.age (100%) delete mode 100644 secrets/secrets.nix create mode 100644 secrets/smtp-noreply.age create mode 100644 users/infinidoge/keys/backup_age.pub create mode 100644 users/infinidoge/keys/primary_age.pub create mode 100644 users/infinidoge/password.age create mode 100644 users/infinidoge/smtp-personal.age create mode 100644 users/root/password.age diff --git a/flake.lock b/flake.lock index 02d2d91..2d9724a 100644 --- a/flake.lock +++ b/flake.lock @@ -29,6 +29,38 @@ "type": "github" } }, + "agenix-rekey": { + "inputs": { + "devshell": [ + "devshell" + ], + "flake-parts": [ + "flake-parts" + ], + "nixpkgs": [ + "nixpkgs" + ], + "pre-commit-hooks": [ + "git-hooks" + ], + "treefmt-nix": [ + "treefmt-nix" + ] + }, + "locked": { + "lastModified": 1739816852, + "narHash": "sha256-QG8aA6hWsi6pqaidaz5a5SL+dM1mT9LMWMrmc1hrOrU=", + "owner": "oddlama", + "repo": "agenix-rekey", + "rev": "5f56d711ffe2aca62cfeeada9ec56692a13b9061", + "type": "github" + }, + "original": { + "owner": "oddlama", + "repo": "agenix-rekey", + "type": "github" + } + }, "authentik-nix": { "inputs": { "authentik-src": "authentik-src", @@ -954,6 +986,7 @@ "root": { "inputs": { "agenix": "agenix", + "agenix-rekey": "agenix-rekey", "authentik-nix": "authentik-nix", "blank": "blank", "conduwuit": "conduwuit", diff --git a/flake.nix b/flake.nix index dd1e558..d676c13 100644 --- a/flake.nix +++ b/flake.nix @@ -26,6 +26,7 @@ ### Nix Libraries agenix.url = "github:ryantm/agenix"; + agenix-rekey.url = "github:oddlama/agenix-rekey"; devshell.url = "github:numtide/devshell"; disko.url = "github:nix-community/disko/latest"; flake-parts.url = "github:hercules-ci/flake-parts"; @@ -78,6 +79,11 @@ systems.url = "github:nix-systems/default"; ## Follow common + agenix-rekey.inputs.devshell.follows = "devshell"; + agenix-rekey.inputs.flake-parts.follows = "flake-parts"; + agenix-rekey.inputs.nixpkgs.follows = "nixpkgs"; + agenix-rekey.inputs.pre-commit-hooks.follows = "git-hooks"; + agenix-rekey.inputs.treefmt-nix.follows = "treefmt-nix"; agenix.inputs.darwin.follows = "blank"; agenix.inputs.home-manager.follows = "home-manager"; agenix.inputs.nixpkgs.follows = "nixpkgs"; @@ -222,13 +228,28 @@ ] ++ (self.lib.leaves ./users/modules); }; } + ( + { config, pkgs, ... }: + { + age.rekey = { + storageMode = "local"; + generatedSecretsDir = ./secrets/generated; + localStorageDir = ./. + "/secrets/rekeyed/${config.networking.hostName}"; + agePlugins = with pkgs; [ + age-plugin-fido2-hmac + age-plugin-yubikey + ]; + }; + } + ) # --- Universe Modules --- ./secrets private.nixosModules.secrets # --- Library Modules --- - inputs.agenix.nixosModules.age + inputs.agenix.nixosModules.default + inputs.agenix-rekey.nixosModules.default inputs.disko.nixosModules.disko inputs.home-manager.nixosModules.home-manager inputs.impermanence.nixosModules.impermanence @@ -273,6 +294,7 @@ ./pkgs ./shell.nix ./templates + inputs.agenix-rekey.flakeModule inputs.devshell.flakeModule inputs.treefmt-nix.flakeModule ]; diff --git a/hosts/Infini-DESKTOP/default.nix b/hosts/Infini-DESKTOP/default.nix index f82a1e3..58d06a4 100644 --- a/hosts/Infini-DESKTOP/default.nix +++ b/hosts/Infini-DESKTOP/default.nix @@ -14,6 +14,8 @@ info.loc.home = true; + age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7uX1myj9ghv7wMoL038oGDCdScdyLd7RvYdnoioSBh root@Infini-DESKTOP"; + persist = { directories = [ "/srv" diff --git a/hosts/Infini-DL360/default.nix b/hosts/Infini-DL360/default.nix index 11c5439..bc6dd7b 100644 --- a/hosts/Infini-DL360/default.nix +++ b/hosts/Infini-DL360/default.nix @@ -10,6 +10,8 @@ ./hardware-configuration.nix ./disks.nix + ./secrets + ./web.nix private.nixosModules.minecraft-servers @@ -37,6 +39,8 @@ info.loc.purdue = true; + age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPjmvE76BcPwZSjeNGzlguDQC67Yxa3uyOf5ZmVDWNys root@Infini-DL360"; + boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; boot.binfmt.addEmulatedSystemsToNixSandbox = true; diff --git a/hosts/Infini-DL360/forgejo.nix b/hosts/Infini-DL360/forgejo.nix index b0979e4..f900003 100644 --- a/hosts/Infini-DL360/forgejo.nix +++ b/hosts/Infini-DL360/forgejo.nix @@ -27,7 +27,7 @@ in lfs.enable = true; - secrets.mailer.PASSWD = secrets.smtp-password; + secrets.mailer.PASSWD = secrets.smtp-noreply; settings = { server = { ROOT_URL = "https://${domain}/"; diff --git a/hosts/Infini-DL360/secrets/authentik-ldap.age b/hosts/Infini-DL360/secrets/authentik-ldap.age new file mode 100644 index 0000000..03da50f --- /dev/null +++ b/hosts/Infini-DL360/secrets/authentik-ldap.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> piv-p256 CT7K2Q AmrcqFPgfqImIMZx45MXeqD5XP2MCpnIIXTjfVZXFOtv +IgBH5MFAJJ5vP82Jtvmr/NcaCK1F/qSWQHM1PbtKu5Q +-> piv-p256 5utyxg A80LKCGYw597lm0Oo8kBKLIWcwnOCjDr3FiyIDrAmkSZ +R9tdgHAfuVNs2nXD+ml7l/jjXvf0cD2b5wALOVzEH9o +-> BLl-grease d)6dWO5 2P +/fvI/IO/OJV/4sF+ENnj1AQx9fRf0cLMy90ASBvl9Cdwtdnrx4ly8ZOS57rSNSO1 +JJFsEd9M3lKRElvYsXADC0cOBsK5hg +--- BNRWm9qA1JnQ71Yf9vAeVa7B5qzUf00mjVHJeFCKjQQ +4r( &@ O ֛SA?,{ɚPD(m|`7 8mf2p; 9n}DUbć(u?A V(4"h֓R;,6?8 +ȉ \ No newline at end of file diff --git a/hosts/Infini-DL360/secrets/authentik.age b/hosts/Infini-DL360/secrets/authentik.age new file mode 100644 index 0000000..e2bd084 --- /dev/null +++ b/hosts/Infini-DL360/secrets/authentik.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> piv-p256 CT7K2Q AwjgvoXQnw3dGl+3NzZwbtobCzYQqSEwu3o68itzJXk3 +9J7aPKsJ/dZOoCKNGZWnxOH8a2TNX5D9hBStFgqDOH4 +-> piv-p256 5utyxg AyFGfXw60hWpTNvCXaVNTk0UN8WX8dEwIOMYkwtHLXJF +Zy5cd5saG4jfF5ZXkZ9TJpvscxfgDV2xGALY1yyY66w +-> m(-grease [FxH /SCRkN 2\> +HvqiMVBno3sBsl9eg4Lkr7F/f/dB8pxihcekBG0ntbQApRwxawj37/wjXKOYAX43 +OL4wHohhU91u+4eOv8E1K3OOpXy3aVn7WTjk/6ftA2oxLCy1QzQKpg +--- fpnPuiVpzrB09e3CvSUY/Y7tQyCc6v6FuRkml07bqD4 +D\LUxZ5Em}"&&&* TwV2pZYsştW;ZBO, Yů|mM$`t:ja}1)Yxt*IŜZC|-~quO]V^Ivk:R%ߊI'YXZ1iV=bɂI*Yeq \ No newline at end of file diff --git a/hosts/Infini-DL360/secrets/default.nix b/hosts/Infini-DL360/secrets/default.nix new file mode 100644 index 0000000..7310880 --- /dev/null +++ b/hosts/Infini-DL360/secrets/default.nix @@ -0,0 +1,17 @@ +{ lib, ... }: +let + inherit (lib.our.secrets) withGroup withOwnerGroup; +in +{ + age.secrets = { + authentik-ldap.rekeyFile = ./authentik-ldap.age; + authentik.rekeyFile = ./authentik.age; + freshrss = withOwnerGroup "freshrss" ./freshrss.age; + hedgedoc = withOwnerGroup "hedgedoc" ./hedgedoc.age; + hydra = withGroup "hydra" ./hydra.age; + ovpn.rekeyFile = ./ovpn.age; + radicale-ldap = withOwnerGroup "radicale" ./radicale-ldap.age; + searx.rekeyFile = ./searx.age; + vaultwarden.rekeyFile = ./vaultwarden.age; + }; +} diff --git a/hosts/Infini-DL360/secrets/freshrss.age b/hosts/Infini-DL360/secrets/freshrss.age new file mode 100644 index 0000000..abc5413 --- /dev/null +++ b/hosts/Infini-DL360/secrets/freshrss.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> piv-p256 CT7K2Q AzMC4XpUhKiVaI2xhQRTQoyV+RjMz5Aoj3gZsgc8PBK3 +CGLI4lL+4xWaMviHW7FofruIZVFES0H/WFSzsbXDjcY +-> piv-p256 5utyxg AieYOjyIS2APXJfkY/qJ0UmoIuHwO3oIH8MSHh5o2M37 +GCEG5cxBQ5k/3UGm76bNtsPsHzv5yGSJ7iEn3h3wops +-> -W-grease Gh{uU +RobG9ho0acfDe+0qEBmtRyejJy7E272b3vzuegQ2twAl2xTYinWOx286sVpRPc7W +vJNCu9BCDGlIFnQoP2R1gm2eQrI6InNOOh3Q/IZ736ieAhbDvJbm/3BWqRmRRylY +dfEg +--- 3XHaD7Zc6JTUxZl/ouKGxmCVvkbjLw2E+TDAf6PwLLo +u,MρHS3JkY5`5;mFfuh$a1Jr|HVRa5)b`YN(k}Ee z%m{KU4G)XTC@C@X&33HHHxD-`a?dVt_Xu>fEDsOOvnb2sGBY$W@Gy-u@Nx7HNem20 z^oS_7NHR#ys&EW8G)dFWc1$b}2?{KVEDz2{vCFiyq_QGi!7;bYJE z(lsWi$`3UiEesPYGQG!LVBc*l7hZ1muG5tPKB{~ zj%!kwvu9Rfewa%#m#(g^f=NVZu0cg$zLR;OS5;nBWJW@hN5AFEY!zp}e*O>VidU*#UsNu!-@CopnYF*ldTLQ% z#ezF)ZZmGZqOP~(#0L(B|0x?@X>WU>m(<`ii?gh^Z|C&;jfT#1zrF~ZUt3+XscU<@ zNUEsdX*Pk$2j+f!^)X0j%e-m6b>c6T80YQ_HBSndwt431vUTF0Ee_pU8p$Yn_xq>l oRR{jWv)Sl0?BBFuhGN(Az>O;}@9cb9&#^hW<#*1kH piv-p256 CT7K2Q Ai6/RXPumKBsTij/p4Yzze3wuc+lCeCjrficqXR6a+cX +gGZZ+9hfSefCPpgkEyxiGLBw6HeIRlihlHpRW0flyHs +-> piv-p256 5utyxg AmJA1H1XKyJf8SH9aGgJGwgBCsW5c0VbYOih82p73tS7 +MclhdvYabgDkKl+K+rFxiRvbLLudscVAENFacJraIvA +-> ^4f5%t8(-grease ? G +aNFXQBBqAcfPE5+Wpw +--- Rvpkl3gKIXx96JuQEJZYvKm/ZkXDMl/7TCDECeTBa+o +@nUej tHbu撻K̝(չr_lmDZ(6㚓hƘm;k `Ru:[x['*iij ysʶ~`wk}28 \ No newline at end of file diff --git a/hosts/Infini-DL360/secrets/ovpn.age b/hosts/Infini-DL360/secrets/ovpn.age new file mode 100644 index 0000000..546f54e --- /dev/null +++ b/hosts/Infini-DL360/secrets/ovpn.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> piv-p256 CT7K2Q A0NnbNjIggIuH4ZTAs8YyN3zn3V6OAsKrC04WaTveFAD +fiS6e/cndp7XPg6N9FoFDYJVHzQA1R64QNWyDjrmVJs +-> piv-p256 5utyxg A1EojHMF4AIcObYpGSRE/8Z2gOmtf9l5d9ZV36RC9jHy +WbYaIRWeSUbeaZDqQK4rqOTXy0kWQsG3gbC4dWsUNa4 +-> LJP-grease ,) +qNMbqpxba5Q8KRzrglBoMGsTZdWFTc6wTIFeX74MIDVqE2yPVUVNXcCzM6U3b+/y +XqtVvPgkILD6 +--- 66jeuKk3OHoA9g4muxmythBRKRc/zq4937NDiLC0cM0 + l1a*:I҃%gUcbp r5,"Dn%H|ߐ \ No newline at end of file diff --git a/hosts/Infini-DL360/secrets/radicale-ldap.age b/hosts/Infini-DL360/secrets/radicale-ldap.age new file mode 100644 index 0000000..d78aa2c --- /dev/null +++ b/hosts/Infini-DL360/secrets/radicale-ldap.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> piv-p256 CT7K2Q ApL+8SFBLjq2WTsInFVio8n4RN/U7Cy1I2hvFxNBA2Vu +IUk5Vd0iqcqPVG8JKmEoTmPePeRpO/+e/mA2MWWatVI +-> piv-p256 5utyxg A2ndIHeH3WUg1D6Og35thBxlL8Oji+vc2Ru7B6aSZwMd +loQZbjmAoS1hhiRKkr6wgGmE9Olzstw4zfGCkd0IK7Y +-> AQvw>-grease `Pf +PpONBRKybtkIwA3qrv0X0WaHlHcTd3VeDNOF0MUu4M+qrO1bI71sDL1+sPz/Hm/2 +bkOFCT1xxYFwBQYaRrWY5/3qSKWi +--- zp9aNIrYy+Z55Fp+bQ4D0BhLkOAwx5gb5vH4+qkXJmY +ވ7=1uF`d b򑏩 dgNMq^bEhIO{:!FW܌jycDzk )cpݶd \ No newline at end of file diff --git a/hosts/Infini-DL360/secrets/searx.age b/hosts/Infini-DL360/secrets/searx.age new file mode 100644 index 0000000000000000000000000000000000000000..5ff279aa99a5479e981af6a4cafdb02d69f1eb98 GIT binary patch literal 449 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14$Sl(>Ffuh$a1Jr|HVRa5tPIMk(hsTf z%{TG!&5HCcERP6s*47WnaZS=U%u3F+^eamXsR%LBwg`3RGBofr4T(NP2KyQiXekWhj@3+kL4k>0Qd_ zoD!KCZoe{|@a>&y3cpQK>-?n#|L&cST-LTTqs4Hl=L-L+KWop{xakKOC2hN6mDRbc fn1kavzp2%SW~1l*(q6iH>*IpDkLsDaFfuh$a1Jr|HVRa5G%Gd@Om?fv z@lG!AC@3&2P4V~8&kb?%$o2HD%*qQZE-g3C%gAskOAK)3DoZysGPTUk3-e1(t+Gh+ z3d%4nGS0}(@G5aJ_DKuL^fmGV1 z%CsOrU)v}mGfX=<+@dlu*T`4j5oDKIzLi#lZhBE_VsWZMfmN=xf>)f0dxCwiLZo_) zj)H2gXAxI;xTR-NQgV5olUJx~qMuoEm1#hxk7G!Bse4(lQ?Or7IhU@ku7anTZ$`3@ zm%m@Gvs*=^Q-(#bqqA#KN=}qF%OTE2gjezK2iMT$X0KG)&SFYiiO*Xe$JWParY zkMr~E{k_d8+s}U&kx#xGk>s>jtWA;GC1Z-k)0){GOE>&;%YXc4=fNDE&4uwV=Qw06 zJknL3Hr>GI%gy)V&z;O=r>>XKoH-@e)kFOMYDIT3HMw8QEut#Ux!Z|7sji#0y+CC_ zPDM!YRq^#L&bfXcZ#-3yVKU_2XYG0L(0+4{x*47uTawSI{GZh|e`BvghjWmX{_Ds+ zOJ7_S`Mo5hH@)oYy4epH=G*^}Jin#$zz+9IzY@Qg@@!f0d$!ZhvNsynOD*eKo!03e zZ7Qz*;T`jJ?LHBA#n89Dsl{HaTxWFG^#%!i`fx`tX5aKDYxeFf*|f>M)9zPSeZhex + age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBanlhzmtBf5stg2yYdxqb9FzFZmum/rlWod/akWQI3c root@hestia"; + modules.hardware.form.server = true; modules.backups.enable = false; # hestia is a backup target boot.loader.timeout = 1; diff --git a/hosts/iris/default.nix b/hosts/iris/default.nix index 87cb452..0a3e051 100644 --- a/hosts/iris/default.nix +++ b/hosts/iris/default.nix @@ -1,13 +1,15 @@ { ... }: { imports = [ - ./hardware-configuration.nix + #./hardware-configuration.nix ./disks.nix ]; system.stateVersion = "25.05"; networking.hostId = "8ab8acd3"; # "iris00" in base64->hex + age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGsdARqD3MibvnpcUxOZVtstIu9djk+umwFR5tzqKATH root@iris"; + modules.hardware.form.server = true; modules.backups.enable = false; # testing server boot.loader.timeout = 1; diff --git a/lib/default.nix b/lib/default.nix index a13185c..55ace2d 100644 --- a/lib/default.nix +++ b/lib/default.nix @@ -126,6 +126,7 @@ lib.makeExtensible ( disko = import ./disko.nix { inherit lib; }; filesystems = import ./filesystems.nix { inherit lib self; }; + secrets = import ./secrets.nix; } // (import ./digga.nix { inherit lib; }) // (import ./hosts.nix { inherit lib; }) diff --git a/lib/secrets.nix b/lib/secrets.nix new file mode 100644 index 0000000..246254d --- /dev/null +++ b/lib/secrets.nix @@ -0,0 +1,13 @@ +{ + withOwnerGroup = name: rekeyFile: { + owner = name; + group = name; + mode = "440"; + inherit rekeyFile; + }; + withOwner = owner: rekeyFile: { inherit owner rekeyFile; }; + withGroup = group: rekeyFile: { + inherit group rekeyFile; + mode = "440"; + }; +} diff --git a/modules/global/general.nix b/modules/global/general.nix index 55b850e..f3035c1 100644 --- a/modules/global/general.nix +++ b/modules/global/general.nix @@ -57,7 +57,7 @@ accounts = rec { noreply = { user = outgoing; - passwordeval = "cat ${secrets.smtp-password}"; + passwordeval = "cat ${secrets.smtp-noreply}"; }; default = noreply // { from = withSubaddress "%U-%H"; diff --git a/modules/global/packages.nix b/modules/global/packages.nix index 7484612..80d3388 100644 --- a/modules/global/packages.nix +++ b/modules/global/packages.nix @@ -17,7 +17,6 @@ [ universe-cli - agenix bat cloc cryptsetup diff --git a/modules/global/security.nix b/modules/global/security.nix index d4461b1..fea807f 100644 --- a/modules/global/security.nix +++ b/modules/global/security.nix @@ -19,7 +19,7 @@ in defaults = { email = "infinidoge@inx.moe"; dnsProvider = "cloudflare"; - environmentFile = config.secrets.cloudflare; + environmentFile = config.secrets.dns-cloudflare; }; }; pki.certificateFiles = [ diff --git a/secrets/binary-cache-private-key.age b/secrets/binary-cache-private-key.age index bdf033d5de03d33f9835ac4f56d10bed96b1017a..aae97466e6b54359a145aff017a3bdc480267028 100644 GIT binary patch delta 487 zcmew%{*8HpWPL$qnQnoRshNUvh`F~>pn{{ZzNxc$q@ll`L8W1ivq?oonRk`8c2Q|^ zP-R(Zs)uP#frUYuXP`xyyD^uKn|Gmmeuk63S46IFda;XJx_*V5yOCv9g+Y2mQE+l) zMpT(&NtS7GVLq3xodVo0)6$a4igX3XOpp4a%m{bmaBcI_+;HQ9z+i9h@CeJoh|FBq zAWLr#Z++*eq8t~u+zOvkt}Gw-+=3|Wuw)}Q_h7fmGVRplVsB4(=VH^W%!*t?w~DAj zqo^WZKkwvpkY#q2HhP&3im|%sMX8C!sazJmp&^MDenyokPL`%FCMjtZ{_X{C_1dBS z1u0dPMaKFj89teLF4@MJX~vZ$#>H;NntZU{YaW4sS3(8E4C^GO2O7i#2bx(FFbwsx)g&Ovq{2MYEYC8?q|&{hyfisGG7#Oi zbWbn8Bu9m+a)ZheSHpbYz#La|pQvyTC#Q@Y{fyjP@6b$3pTJNfN7E8xZ}Wo8^lUC~ z7yZ<9m;B<~qAKI`bk|_Nq)_bu|IEt7$RvaEvM}SUs1)B)?aE-&N{o2R$nw#zELR9A z3il23)i(1BaLTnv&GR(0@X1I`PAl>V57rJhaY^UlN@iJ3hHr&sRB>)po^zP5K`~cIk%eE7nL&nUfuCVvl~HPh zuXCw~Ymt$+g-LdiMUZPwazsT|KtZ8FAx0_*H3>*fOIL7qGfFfIOv?_A%J3<1^^QzS z3~>7FD*!SPUp&YG1s@uN%Yh9EcVtn2`(z}_m0$d)3!)- z%JYv1%E0d11`r5pJbo3tdbmmr_6$2{|r~t(!5+_W2d5wupG;R@+u=Y zFW;Q9;H;!zU-Xc44>1ZZNmrfa^xzqbcymYa1IXC*S9oq53)>43w87M2{JWw_X#ieax8Q=$t|f&bv5wu z^+dNV-_f_SEM1|{!ZR~F-#9ca%fcYFD%;$kq{2DNCD1dZ%*`*t(LAC!SUaH9A}Uxv zyPPY)y)rAgG9;OUOt=KEf&CoeA$-l}qBc~v^DBHrV48yiCPmipK zbOqx|(-NOx$GnQrBK?rUYy%(n5c53kJP*sXw5-r4z7GrE_JvnUoc{IR_h+7*=@X zW;=(Jo2EJDg}Vl5hvk>&ggKT+dK6{kR#gP$WTV@bYwl%knXXV+lpPu5>m3@E6pFHsT?&??Ml^5dcshy`EVeakc7RpsnSXEvTW@#SclCN*%=^GeOnC)2^ zks6ujSK?lf?BZ8uoMON<@`jgjAsg3ZH|(-r)@TrAT)+!Ou$Onn?HQqu}Ey+VsK zB0NJ)QvHew@|+5S%S|jRd@X#OO}G+s%e|b9O2VSjvnxCb{T$89v)s+nEpkH&lM-{y z3iNX=a=rXr0-W-~i_!h&>YE>sTCQMNs9)$|;pLPWVOZi3nj2uIUyzxUWEhd`R^a89 zTI%NP5tUmS8c-f?5Xt3N<{6ygA7+weS(2Vrm||$CooMXr?U+{?Q0k?hR8$gDm7Qjo zmX+sWhEXbKRz(@R1u7IJItFT+hx-PmrMmf~h9yO6rv?}XJ4Y0_x<*BLqy)O<`K9Gp zMj4w#7;qJ4}o8%d~l_ymhMH!VxdZd(Qy9K9u`TLrCn)>?WJ3G1+VC3#9 zza$HnKn3$ize4ZyVhaO5LzmP-%hd41GDp+OH1o0)&vHwBZ@0*Ra`UJpUsETie6A?h z;xu1p6JyijOv{|mR1fo%u%cXpEK7sH6z{z9AdhSppNv2sbGQ5;j2z(ZWaJwas8D6# zS!(R>WE_y6oR*jpkyxBmZV~EeqMf3jmFb#iU|D6Flp5k!6j&AJ$dzd79Tiq$P*#+Z znVX(xW}1>1o>G;Qno?|LUJ_!OQREk4nw6Rs=pF-pEV*Maf zSFYP2p*Px(u^i&cORN#?auHcdr5@uHBX`bxjU92AxQBq*x zS7un0=BS^nZD8r0W#DXF;2ssFofPa^%;m1{>6@ZmZ0_b5;O&@H;G7zeQEpjWTIK7S zoEKb_U*P7E=NPJ=R$x?xkpqgn3xcWw6&x*{^4)#CJi|=Q4N}dW{WIL7TqAr!iVZ7* ziu03-O3e!W^MZoYbMkZ2xsq}`v`g}HT#NNhE&TP34Z@rPoh)67%nPebTnrLD+)^_f z)BO?)jC}nua)5=tOI2aHLUNKvj(Lb#gjxrZ}G z9Z=#`S(;w1;GCFZT;QMOTpD5Qmt;^JVrr0Qn&YV*o>^X6lHy_zRFds%;F(xjmg^kK zl@;!mn-}GgQf5$AT;-%)lx<;DVwn`0;}embWEq<6k!e)!ljvUX_LtQGvJhKeAJp7D`0}Hi- z3*2(U%gfC@Lqqa&ObT*cBg)JZ(~Pt|y|mLjic8WWlPin4baizVJS|+(GxV!0{c`hD zOnt*5vYiu?jf;Wv`n7aB ssh-ed25519 sQ/0YA 5/8hTMh6CloNFOxL7nqpRWx6EHXfJ22s5Qm+lkFStwU -5Virolfv5xEn9d2We37ciIrIT6hLSZF78iAwkHl16KI --> ssh-ed25519 aYlTiQ JSJJ4EC6v8VcSS13n6h0+K+sApNulYBphu7Ny+dYZhU -PAIeYvIlsPbBSUs5t2KUxXu9sk1Yb/rSIKPlEZHj3Ls --> ssh-ed25519 i9xGKA YhZ3NCliAzg62D4LrfCNpcSwoJ+wKe+avbdUCQXMj1M -pVOnIU43mqtFY0pRiSQBUigdoxq532p7wv0nS2MWPYs --> ssh-ed25519 ydxrGg OYE8RmU2XB3Vi5yxW2TExllNbUBzo6fFUWRUrfAl6Xc -j1vTMqWvAu894eZzGA5wEk+3EvyQUBk/m3Xho5bDgAE --> ssh-ed25519 oqB+OQ bWopOtx5LLDGCQ2/TgxM4tpKWYjH9QODfDpxx9in01E -4NT1npZomt0mSQSpLtTvFxLvV5NPMphG8J8LKcL5Wjw --> ssh-ed25519 gIJNbA QnW3sLf5LcofKLuAZz2f5y7qZMMVfmgNDXM6wBY57CQ -l9Dl5+IJ7CswosXwijyOepxS5P6g+bA8wUfNQVF01fA --> ssh-ed25519 hjL/yw IqwsP6XXOoVgTdGMcgm+Ev0pvAHgRIEwaWcTaB6hNVQ -olJ4WbQW58vI0TjkHww+iCTUgio7kZmPlcvJEc4IQGE --> ssh-ed25519 Ig0rsg 3ZiWNnm9DFiAKnwpyYQiSP5kZgNwLArraC32lqKtITQ -1e74EWfTnOS7UdSJfMxTlzbr58fIn+rw/qeN6TxAKWk --> ssh-ed25519 U4Pefg yXsLnpVhhud1LAp+rgMqa4UH7mHsEbgrEb7SZzvyGDA -UjF3i1PLn/jqMeStZmRcV/hA8SGkQkAOJ4E04W0d2Mg --> ssh-ed25519 SqmlZQ 44N/cMPg4R/6ntv/ZleB3tpjdyIi4F8HSJy03zyj1DA -3SyM8OnvcbT2/PGiBj1EcTUr4q2T6H0+s+9UP4cpZps --> ssh-ed25519 GT2Stg 9vBE4i87f287MpgTama/5g6wQseDfng/fj6fKLKP1QY -d7JvhmUrIOxxKEr3trtv4NRJKdLlf+LBbECpxnIpTxk --> ssh-ed25519 oAMyvg fjJmTln1QI4uw4TE4YMq0E8b0q/sZ2TLIgEP0zYlLyE -7VHmeg6zpnzKWL5AC8qx6wAvYcdxulAMh/zPKt4eS1w --> ssh-ed25519 VIHjXg XdmRVbvEvARws7bCPn529MTPT1p/cb0U62hOtAfW33A -8c0OrrMRip7KjeE2+VtbU/QDWl7KiVTvbv+lSIs7UNg --> ssh-ed25519 VEv3zg Umgx52XORKFXYdEsGzvKfvUy6SHJoJbvAKX3NHrVxko -o3Phua7fSn5alLQDdU2PJBFvJBDqF+H+F3V/s4v4EgE --> ssh-ed25519 m7J79g CkPOHoXFHcMMk/xlmCAMd2ikZWJCqPhW7UvtymJ9FiE -p+agR0jOtshNZjF0Gox3Njr7qwMzsk2nsstSUaScOH4 --> ssh-ed25519 2S7Wcg XqhSc/NbSCGTMU8kZCk2Xu7fAFg+hQ4W4wSwzx9e9jA -rNepa1tbXPRCfTSaAKgs+aLvCyRloAb340Ufw8DVi9w --> ssh-ed25519 EMoPew bK7hR3fKibZb47MyOR5n3gfyh7HzpDqC3ZlcaSigNQM -NsYE8aU/wic0N1tVFbWykRfghsGmws4Xg8kdrJLisps --> ssh-ed25519 izZ3FQ 7UWEjg98xHo/9s9+onUSbrMh0uPLTDQVEbPgPAWVu3k -GrBRLSIBdCHIHZNQIORZGFk93/l01CgOhfDx1eJqgvo --> ssh-ed25519 zNb8DQ XuvULuWzBe3DRVrEHM6fShYGh5MexG6XNxNpznJr1Fk -MBOeY+DZ4HQ69ifOKr+2gv5Bkpg5WQa7zKm+NeC8Wec --> ssh-ed25519 GB2MZQ C6bFo1mneQHotAZLSn6sClt35+uUwPJLuHOYoE3aRkw -DeDM1yv2FZo0dUXttP0d62fRgU/A8MJ99oHpGhr0Y/M --> ssh-ed25519 FelIjw E7fL8omx+HGv75MUsC/IZAXQNw4G1vb7LLT6FdTdkU0 -I7ix1MlBnH+wT9PxL64b5EYex3yjk3+U1EO0WLhzPjU --> ssh-ed25519 TRpHkw LHWFmWM6uKa7+MLlxKsdhBA5HmjsCnBz81MR2hIJCDQ -IJOsuUtXmp91t226YrW+5lvAGiLygv598b0zCVBNHTc --> ssh-ed25519 rKpRzQ Qk96yw6dOkE7zIcBo/6SXpO9o6OrPykkT4knw8fj/0k -SCa84kZ/e/vs4caIklF2LqwkVHgxbLoyWQIdXYsKC8I --> ssh-ed25519 8/Dzqw blUGZhhmVedopPKAbFNPfSxc58OoS5o5oW5plYltTiI -WPFPl6bXvewmISOp8/S1ronk9jT8O57qNPZUCFvTxxE --> ssh-ed25519 tJyugw UUi6VCLSfg3oyutzwg+xskDCtE1mFQTvHrGBkXuIT1Q -+rk2mBJRrYrUfsv4o0keEAKsXahjEIintcoA+38RL/o --> ssh-ed25519 lpPUYw TFf9vRCAv2005EC1giIkVfy/AwpU/t5WPX3bSLDDHgw -vbLC5pesZRyuw/vMAv2X1ZYVNwrYUx+P/ZV8BLrpELo ---- EpxlXztYxi3N6dCswIYXZxAxmFv3XYSkU34LmUIM0fE -3%"xR@(qOEL^S%#48mEe(J -AN>DE+&@8b5~l- M#8 2=vP 4|[}Oy \ No newline at end of file +-> piv-p256 CT7K2Q Atat1p1wMEaZVi0DxSmUYN3H79RO1XK26pmJFnrMUW+N +4IUFdkcSJnVthch8NgWV/mRsPqs5/NbxRgTP1DTq6Js +-> piv-p256 5utyxg AhOyUzfDfgFTgoSZ/Ram2/AKwXT0RoJ/g4cGvQoCHwMR +7W5e76JbGDvEiUwbJrOK2/9pSzEKUk+4LAtnJd6Au9A +-> A(v,}OT8-grease iv$<6^ +qJk7RvKMoJ/OCb1L15x8ur6Q5MxpDcXkwA +--- FrURRINPBWKnkfeCAsUecvz0nSlH8cUmpuxzgpUc9sA +wm 56#x&g@ nM2]-9``$86Eܐto0 zED>pn_v|gkO}2Yf4afPG+`&zHeH2n!86%p|**4 zadEz{OPNQOd0DQjwo##DNB~!GkXx9GaY%SsvRPP4c~WV*Q*e2ZwpV(ZSBiUzUtWl5 ziCeB^ah|6^b~cx;odVo0)6$a4igX3X?Cknf6E_q8pp3FKGh^Rm?V=KoV&9Um5+}ca zNbRtQEHC%eLW^Y6upFZ@uH=Z|96vXoZ1YUNs=T0xvOMo1!_Y!Q$727;0;9sDq6m-R z0%ubnx1?+nkY#F`y6Hu!iN&c3>7my86}C1C`CJ+0VFg}k7Cz=td1d-}6)qk=^@Uj_ zo`w4U0ZA@JnQ3WJp{YiBA?Xobmid|4mKpy3UgoLB1{Jv$rX@vTW!gDhC4SyMW+r8s zUfE`uriDKG`ud(ed6A|O6{Qs=>E&Fyy1EK(+Wsj)2E~yj0Y!nHhJnd}5y62*hMu00 zeqn_rDJBM9#o2**xtSpu`X*c|_5UU)E&1TOFZ0Q}>*v0ERaZ_q{-QdoWy5I=kFSjE z?B+}N_vQS*Bl=9D*>r7oU-S;wa?#p^)q18$YPFH!JGE@~T#?&)A>?ao;N6Dvrfmzow&0y=x*GfKAvtbld41; zsV(sZNsk^+%riRPv$j`Y&0Vt-MuC5$wz+@*wPC}ZMeApmtgP3*Uu&=|;nW%DBvp4# z+b^&6r)``VBjKvy@pkv0>A%@x>pT9K_)QHt{`$%ByHkxjzlHzZIO(4IIrEi43Nx># lJrTLqEgE@ek4x&|*XK`08^3TnvGaZI&Lo#4*Gb#W>QP3F=L$;v7#j;z#nHVN=6 z$_)q($@I-lkM!~{%u6jV^!6)sF)S)D(hn~WcSN@>F)}A4Gf*L?$}%dTz$r7y-=r|n z*Ff7S!#N<))y2igG{V?3)iJa@%RSN9wJgfVC6vpRHLFY=OC}Z zu!!)KjH4JzUJ46OHtPoP7#hvXc!f^Ma!S z(u@kq!;;Z$%P(}&_77BWHx4Q@@lDIqwhZx&^vVbbF|u?ru?+Lgt}srlG;j-WGfOrw zHY+kN3AW&}aEfp-aVab^aWgRT^$7O1$n_~TO7bZycMR|~OwI~4wFoUU%Sg>K3^qZx zE#1@0FUe8CxWv6Or!YMvBrqx^EH@;l#5lvO*fq~2v@*0XJSx{REZp0@%r~UUAUK~Z zC@bC6Jjq!*JR;ja!Y#-n)i~55&o9tPJ3PrvyPz!1Bvjix$}FeAEW{Pvwu~$v{mOC$ z&&1M_9Cz(}L&LJl01xe|0I$3>caKCPA2Sc{Ff)I*^yKi2q zG>J4w(GM>PNb~aXj0$rtw{*cslfi|#IZ=TMx$gS@scGS9PLcVkz8*3Ug@dkZmCI@IT4kvVc7;;x%qk81{FpHDcV`i#!mWP!I_!HZcb&HRe65ixy4@E zjt1^kNhJ}++GZHGxrZ19m!vCbhdLD&ghZBRCsr0zMmpyDq~wMbCRJsX8|4}q8<$jS zyCj7>rF)0wx`lGNI+dm7rkkZ?x@fy3n}>TOYA1#T>AR$chnnc8ha@^idgX95fS<3nfcD?Y2mpRMyW}@sihbtSD0&=aaFoPez93) zc|o>;o0(^-Q&vR2M|Opyc}A*!L}`^tdALETr)yzRV0dXxrkep*aaf?Cvy-K9xG7VDQe4RqF zQj?7eom_lMECalXJ)#OqJ@QIYBOUWXGgIC5!;BocJX5uUk^|Fy@;u#)11wE4B3(+| zDnl~L@+>^G^YeU+z1#yT0+K4-gF-QKw^6WpcyhXeM^sdvOPOh~SAls{a%gIvcXmic zaaOTqVOF+jsJ?fVyLpkfznOVTZf-i4r(>{Fgk?~QYnrQpqo1}>x?xFhrMatrm7$AS zV1}_%Vz_&Np^uN7uM0-W}%lemG19n=#!J_72s)E85&Zlonzo(Xqi|V zpq*mqr*Gz1VVIVgU+&9gk!ECERT$--8*E`z8Jh3qWTx-pQ<<(G8J?Z)9B2`lUg_iG z>*VX4x-yZWT%CRi+_D9*M3c z$*Eb!MiyM=PL72^d1i^(A)yhG#fDBvK9$)K`r$6ceu-gaEnB~YQ7fhClwdDr$yw3gmQ%@8ta#*CmZP} z6=#()kU9M1Co)%~l>13{-@91Be=Is{| zP-bqD8&DJ!Wl|KF>=J6|=3Nq+WEfzW>ByDp=8{uUm|mP%mL25cn{8g{l4lT{S7BCc z7@Fae>FA-I>t~W-8EBeoff15L-UUHbfeOW`6|UyRd8Q>{j-@HaN!j7y;f`L~g@r!; zjv3zG6Km~!Nnn=k)G}auKM1A-W3&v z9{MI_DN!Ysq39uLq3=>vSgzokoSRitpzRu3VCa_<6qK!>l}P4_6p~eCY?hf5Z0QwI9_;Mv zf>E26cvY6Bmn)<@YkQexIHnZ^rW(1pmX>7t`e%ihoA?!nMS5H4YkRnO7w2lH23Z!n z7jtEJq*hhr>gSm`78s?JXJ@#1C#Px~gq!CWC8wnLL}n+MJ7(wyxhGZVr=$BVryw9S zvRolE&$Xb;C^J0FJu1&JDk9V@rMM*0!X>bxq$oANxFRjmDIzq-!#L8XvYac`*(59} zTR+&*v`pVQBRnd~E7M!QD$Ky#$FR&er^>86JSe$5JJ7SL(1c4@S69IzyRb0dGSk$& zG|jm%&)qU3Dc#Gcz%9kiGtA4hGRw~**vTj~G$g;wHuE~tsc*W7NqRXKW=*Pd!zji)tJ<$ht@=}aylNNk z9KKK$Xv*AB{5>({nfa;RNxHokZT2yh9{-V%_&V-#?0)mtT_L*3 zk8^+38RvPkyk&d)cgwmoZ^h8L*Ix@sTNiPgXPww`NaUBP%I+_o8+K|g)w>iunLBvC zQEtWh^Z&i|72-bJu!y=obHkGsyMXH9+-FuTk`b;B8((saS){SVhZ_r3V7gw?Qm$ArY`MR#vb ztZ)*)qOP;S;DY(ml|R?-`M9U!uwPN*i;Zi|&xs$GTfh=x8r;BYf6(@E_(_|CHtY=> w*9zL2-hQmCwYl=X%(d6;-(x1S3Yo9Ai&(fK-pl=@&qk~Dr piv-p256 CT7K2Q A0qTlw/zQp903Xk08cjrAX7zoPL2xc6KCBD1ZQhpDP9H +kCuhwrAe91AXCEcXw7xGfb4ypYpAhCm/MCFv7cQJcXY +-> piv-p256 5utyxg A+dmEbRvkJuqaMp2ZaamaLTdRLWTlkBxwJDE0e4cP7jG +ai+6s1mDIsxx5bHcnZQscjjTQnV8/C146n2YJy4gF+w +-> kQ'0sT4p-grease kVUsHd] ^ 3z#4aLz zmwIUo\ +m88fb8byPiryipImWibRNuzZ/mXFVYe0bDeM +--- uRfolk520znGni9GMw2SxyYUqYsK0Mxw6WnTd23T9zY +/vjh겳7e*vkˠ~MQKKOJ0ύE分g[%mN\ ׮iьȻ95〈h°*. +*j5jZ? ^O}ZbkB|Y惃g@_C mJ,zaW4sS3(8E4C^GO2O7i#2bx(FFbwsx)g&Ovq{2MYEYC8?q|&{hyfisGG7#Oi zbWbn8Bu9m+a)ZheSHpbYz#La|pQvyTC#Q@Y{fyjP@6b$3pTJNfN7E8xZ}Wo8^lUC~ z7yZ<9m;B<~qAKI`bk|_Nq)_bu|IEt7$RvaEvM}SUs1)B)?aE-&N{o2R$nw#zELR9A z3il23)i(1BaLTnv&GR(0@X1I`PAl>V57rJhaY^UlN@iJ3hHr&sRB>)po^zP5K`~cIk%eE7nL&nUfuCVvl~HPh zuXCw~Ymt$+g-LdiMUZPwazsT|KtZ8FAx0_*H3>*fOIL7qGfFfIOv?_A%J3<1^^QzS z3~>7FD*!SPUp&YG1s@uN%Yh9EcVtn2`(z}_m0$d)3!)- z%JYv1%E0d11`r5pJbo3tdbmmr_6$2{|r~t(!5+_W2d5wupG;R@+u=Y zFW;Q9;H;!zU-Xc44>1ZZNmrfa^xzqbcymYa1IXC*S9oq53)>43w87M2{JWw_X#ieax8Q=$t|f&bv5wu z^+dNV-_f_SEM1|{!ZR~F-#9ca%fcYFD%;$kq{2DNCD1dZ%*`*t(LAC!SUaH9A}Uxv zyPPY)y)rAgG9;OUOt=KEf&CoeA$-l}qBc~v^DBHrV48yiCPmipK zbOqx|(-NOx$GnQrBK?rUYy%(n5c53kJP*sXw5-r4z7GrE_JvnUoc{IR_h+7*=@X zW;=(Jo2EJDg}Vl5hvk>&ggKT+dK6{kR#gP$WTV@bYwl%knXXV+lpPu5>m3@E6pFHsT?&??Ml^5dcshy`EVeakc7RpsnSXEvTW@#SclCN*%=^GeOnC)2^ zks6ujSK?lf?BZ8uoMON<@`jgjAsg3ZH|(-r)@TrAT)+!Ou$Onn?HQqu}Ey+VsK zB0NJ)QvHew@|+5S%S|jRd@X#OO}G+s%e|b9O2VSjvnxCb{T$89v)s+nEpkH&lM-{y z3iNX=a=rXr0-W-~i_!h&>YE>sTCQMNs9)$|;pLPWVOZi3nj2uIUyzxUWEhd`R^a89 zTI%NP5tUmS8c-f?5Xt3N<{6ygA7+weS(2Vrm||$CooMXr?U+{?Q0k?hR8$gDm7Qjo zmX+sWhEXbKRz(@R1u7IJItFT+hx-PmrMmf~h9yO6rv?}XJ4Y0_x<*BLqy)O<`K9Gp zMj4w#7;qJ4}o8%d~l_ymhMH!VxdZd(Qy9K9u`TLrCn)>?WJ3G1+VC3#9 zza$HnKn3$ize4ZyVhaO5LzmP-%hd41GDp+OH1o0)&vHwBZ@0*Ra`UJpUsETie6A?h z;xu1p6JyijOv{|mR1fo%u%cXpEK7sH6z{z9AdhSppNv2sbGQ5;j2z(ZWaJwas8D6# zS!(R>WE_y6oR*jpkyxBmZV~EeqMf3jmFb#iU|D6Flp5k!6j&AJ$dzd79Tiq$P*#+Z znVX(xW}1>1o>G;Qno?|LUJ_!OQREk4nw6Rs=pF-pEV*Maf zSFYP2p*Px(u^i&cORN#?auHcdr5@uHBX`bxjU92AxQBq*x zS7un0=BS^nZD8r0W#DXF;2ssFofPa^%;m1{>6@ZmZ0_b5;O&@H;G7zeQEpjWTIK7S zoEKb_U*P7E=NPJ=R$x?xkpqgn3xcWw6&x*{^4)#CJi|=Q4N}dW{WIL7TqAr!iVZ7* ziu03-O3e!W^MZoYbMkZ2xsq}`v`g}HT#NNhE&TP34Z@rPoh)67%nPebTnrLD+)^_f z)BO?)jC}nua)5=tOI2aHLUNKvj(Lb#gjxrZ}G z9Z=#`S(;w1;GCFZT;QMOTpD5Qmt;^JVrr0Qn&YV*o>^X6lHy_zRFds%;F(xjmg^kK zl@;!mn-}GgQf5$AT;-%)lx<;DVwn`0;}embWEq<6k!e)!ljvUX_LtQGvJhKeAJp7D`0}Hi- z3*2(U%gfC@Lqqa&ObT*cBg)JZ(~Pt|y|mLjic8WWlPin4baizVJS|+(GxV!0{c`hD zOnt*5vYiu?jf;Wv`n7aB ssh-ed25519 sQ/0YA 5/8hTMh6CloNFOxL7nqpRWx6EHXfJ22s5Qm+lkFStwU +5Virolfv5xEn9d2We37ciIrIT6hLSZF78iAwkHl16KI +-> ssh-ed25519 aYlTiQ JSJJ4EC6v8VcSS13n6h0+K+sApNulYBphu7Ny+dYZhU +PAIeYvIlsPbBSUs5t2KUxXu9sk1Yb/rSIKPlEZHj3Ls +-> ssh-ed25519 i9xGKA YhZ3NCliAzg62D4LrfCNpcSwoJ+wKe+avbdUCQXMj1M +pVOnIU43mqtFY0pRiSQBUigdoxq532p7wv0nS2MWPYs +-> ssh-ed25519 ydxrGg OYE8RmU2XB3Vi5yxW2TExllNbUBzo6fFUWRUrfAl6Xc +j1vTMqWvAu894eZzGA5wEk+3EvyQUBk/m3Xho5bDgAE +-> ssh-ed25519 oqB+OQ bWopOtx5LLDGCQ2/TgxM4tpKWYjH9QODfDpxx9in01E +4NT1npZomt0mSQSpLtTvFxLvV5NPMphG8J8LKcL5Wjw +-> ssh-ed25519 gIJNbA QnW3sLf5LcofKLuAZz2f5y7qZMMVfmgNDXM6wBY57CQ +l9Dl5+IJ7CswosXwijyOepxS5P6g+bA8wUfNQVF01fA +-> ssh-ed25519 hjL/yw IqwsP6XXOoVgTdGMcgm+Ev0pvAHgRIEwaWcTaB6hNVQ +olJ4WbQW58vI0TjkHww+iCTUgio7kZmPlcvJEc4IQGE +-> ssh-ed25519 Ig0rsg 3ZiWNnm9DFiAKnwpyYQiSP5kZgNwLArraC32lqKtITQ +1e74EWfTnOS7UdSJfMxTlzbr58fIn+rw/qeN6TxAKWk +-> ssh-ed25519 U4Pefg yXsLnpVhhud1LAp+rgMqa4UH7mHsEbgrEb7SZzvyGDA +UjF3i1PLn/jqMeStZmRcV/hA8SGkQkAOJ4E04W0d2Mg +-> ssh-ed25519 SqmlZQ 44N/cMPg4R/6ntv/ZleB3tpjdyIi4F8HSJy03zyj1DA +3SyM8OnvcbT2/PGiBj1EcTUr4q2T6H0+s+9UP4cpZps +-> ssh-ed25519 GT2Stg 9vBE4i87f287MpgTama/5g6wQseDfng/fj6fKLKP1QY +d7JvhmUrIOxxKEr3trtv4NRJKdLlf+LBbECpxnIpTxk +-> ssh-ed25519 oAMyvg fjJmTln1QI4uw4TE4YMq0E8b0q/sZ2TLIgEP0zYlLyE +7VHmeg6zpnzKWL5AC8qx6wAvYcdxulAMh/zPKt4eS1w +-> ssh-ed25519 VIHjXg XdmRVbvEvARws7bCPn529MTPT1p/cb0U62hOtAfW33A +8c0OrrMRip7KjeE2+VtbU/QDWl7KiVTvbv+lSIs7UNg +-> ssh-ed25519 VEv3zg Umgx52XORKFXYdEsGzvKfvUy6SHJoJbvAKX3NHrVxko +o3Phua7fSn5alLQDdU2PJBFvJBDqF+H+F3V/s4v4EgE +-> ssh-ed25519 m7J79g CkPOHoXFHcMMk/xlmCAMd2ikZWJCqPhW7UvtymJ9FiE +p+agR0jOtshNZjF0Gox3Njr7qwMzsk2nsstSUaScOH4 +-> ssh-ed25519 2S7Wcg XqhSc/NbSCGTMU8kZCk2Xu7fAFg+hQ4W4wSwzx9e9jA +rNepa1tbXPRCfTSaAKgs+aLvCyRloAb340Ufw8DVi9w +-> ssh-ed25519 EMoPew bK7hR3fKibZb47MyOR5n3gfyh7HzpDqC3ZlcaSigNQM +NsYE8aU/wic0N1tVFbWykRfghsGmws4Xg8kdrJLisps +-> ssh-ed25519 izZ3FQ 7UWEjg98xHo/9s9+onUSbrMh0uPLTDQVEbPgPAWVu3k +GrBRLSIBdCHIHZNQIORZGFk93/l01CgOhfDx1eJqgvo +-> ssh-ed25519 zNb8DQ XuvULuWzBe3DRVrEHM6fShYGh5MexG6XNxNpznJr1Fk +MBOeY+DZ4HQ69ifOKr+2gv5Bkpg5WQa7zKm+NeC8Wec +-> ssh-ed25519 GB2MZQ C6bFo1mneQHotAZLSn6sClt35+uUwPJLuHOYoE3aRkw +DeDM1yv2FZo0dUXttP0d62fRgU/A8MJ99oHpGhr0Y/M +-> ssh-ed25519 FelIjw E7fL8omx+HGv75MUsC/IZAXQNw4G1vb7LLT6FdTdkU0 +I7ix1MlBnH+wT9PxL64b5EYex3yjk3+U1EO0WLhzPjU +-> ssh-ed25519 TRpHkw LHWFmWM6uKa7+MLlxKsdhBA5HmjsCnBz81MR2hIJCDQ +IJOsuUtXmp91t226YrW+5lvAGiLygv598b0zCVBNHTc +-> ssh-ed25519 rKpRzQ Qk96yw6dOkE7zIcBo/6SXpO9o6OrPykkT4knw8fj/0k +SCa84kZ/e/vs4caIklF2LqwkVHgxbLoyWQIdXYsKC8I +-> ssh-ed25519 8/Dzqw blUGZhhmVedopPKAbFNPfSxc58OoS5o5oW5plYltTiI +WPFPl6bXvewmISOp8/S1ronk9jT8O57qNPZUCFvTxxE +-> ssh-ed25519 tJyugw UUi6VCLSfg3oyutzwg+xskDCtE1mFQTvHrGBkXuIT1Q ++rk2mBJRrYrUfsv4o0keEAKsXahjEIintcoA+38RL/o +-> ssh-ed25519 lpPUYw TFf9vRCAv2005EC1giIkVfy/AwpU/t5WPX3bSLDDHgw +vbLC5pesZRyuw/vMAv2X1ZYVNwrYUx+P/ZV8BLrpELo +--- EpxlXztYxi3N6dCswIYXZxAxmFv3XYSkU34LmUIM0fE +3%"xR@(qOEL^S%#48mEe(J +AN>DE+&@8b5~l- M#8 2=vP 4|[}Oy \ No newline at end of file diff --git a/secrets/old/borg-ssh-key.age b/secrets/old/borg-ssh-key.age new file mode 100644 index 0000000000000000000000000000000000000000..68eeafbb18d3f0f35b7f3c0b819f666f7167c5c3 GIT binary patch literal 3381 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH4%9b@bX3SFbI$TL zcXT%^%T0C(G0qS0DvAsb3o;KXaY^y^Cb#W>QP3F=L$;v7#j;z#nHVN=6 z$_)q($@I-lkM!~{%u6jV^!6)sF)S)D(hn~WcSN@>F)}A4Gf*L?$}%dTz$r7y-=r|n z*Ff7S!#N<))y2igG{V?3)iJa@%RSN9wJgfVC6vpRHLFY=OC}Z zu!!)KjH4JzUJ46OHtPoP7#hvXc!f^Ma!S z(u@kq!;;Z$%P(}&_77BWHx4Q@@lDIqwhZx&^vVbbF|u?ru?+Lgt}srlG;j-WGfOrw zHY+kN3AW&}aEfp-aVab^aWgRT^$7O1$n_~TO7bZycMR|~OwI~4wFoUU%Sg>K3^qZx zE#1@0FUe8CxWv6Or!YMvBrqx^EH@;l#5lvO*fq~2v@*0XJSx{REZp0@%r~UUAUK~Z zC@bC6Jjq!*JR;ja!Y#-n)i~55&o9tPJ3PrvyPz!1Bvjix$}FeAEW{Pvwu~$v{mOC$ z&&1M_9Cz(}L&LJl01xe|0I$3>caKCPA2Sc{Ff)I*^yKi2q zG>J4w(GM>PNb~aXj0$rtw{*cslfi|#IZ=TMx$gS@scGS9PLcVkz8*3Ug@dkZmCI@IT4kvVc7;;x%qk81{FpHDcV`i#!mWP!I_!HZcb&HRe65ixy4@E zjt1^kNhJ}++GZHGxrZ19m!vCbhdLD&ghZBRCsr0zMmpyDq~wMbCRJsX8|4}q8<$jS zyCj7>rF)0wx`lGNI+dm7rkkZ?x@fy3n}>TOYA1#T>AR$chnnc8ha@^idgX95fS<3nfcD?Y2mpRMyW}@sihbtSD0&=aaFoPez93) zc|o>;o0(^-Q&vR2M|Opyc}A*!L}`^tdALETr)yzRV0dXxrkep*aaf?Cvy-K9xG7VDQe4RqF zQj?7eom_lMECalXJ)#OqJ@QIYBOUWXGgIC5!;BocJX5uUk^|Fy@;u#)11wE4B3(+| zDnl~L@+>^G^YeU+z1#yT0+K4-gF-QKw^6WpcyhXeM^sdvOPOh~SAls{a%gIvcXmic zaaOTqVOF+jsJ?fVyLpkfznOVTZf-i4r(>{Fgk?~QYnrQpqo1}>x?xFhrMatrm7$AS zV1}_%Vz_&Np^uN7uM0-W}%lemG19n=#!J_72s)E85&Zlonzo(Xqi|V zpq*mqr*Gz1VVIVgU+&9gk!ECERT$--8*E`z8Jh3qWTx-pQ<<(G8J?Z)9B2`lUg_iG z>*VX4x-yZWT%CRi+_D9*M3c z$*Eb!MiyM=PL72^d1i^(A)yhG#fDBvK9$)K`r$6ceu-gaEnB~YQ7fhClwdDr$yw3gmQ%@8ta#*CmZP} z6=#()kU9M1Co)%~l>13{-@91Be=Is{| zP-bqD8&DJ!Wl|KF>=J6|=3Nq+WEfzW>ByDp=8{uUm|mP%mL25cn{8g{l4lT{S7BCc z7@Fae>FA-I>t~W-8EBeoff15L-UUHbfeOW`6|UyRd8Q>{j-@HaN!j7y;f`L~g@r!; zjv3zG6Km~!Nnn=k)G}auKM1A-W3&v z9{MI_DN!Ysq39uLq3=>vSgzokoSRitpzRu3VCa_<6qK!>l}P4_6p~eCY?hf5Z0QwI9_;Mv zf>E26cvY6Bmn)<@YkQexIHnZ^rW(1pmX>7t`e%ihoA?!nMS5H4YkRnO7w2lH23Z!n z7jtEJq*hhr>gSm`78s?JXJ@#1C#Px~gq!CWC8wnLL}n+MJ7(wyxhGZVr=$BVryw9S zvRolE&$Xb;C^J0FJu1&JDk9V@rMM*0!X>bxq$oANxFRjmDIzq-!#L8XvYac`*(59} zTR+&*v`pVQBRnd~E7M!QD$Ky#$FR&er^>86JSe$5JJ7SL(1c4@S69IzyRb0dGSk$& zG|jm%&)qU3Dc#Gcz%9kiGtA4hGRw~**vTj~G$g;wHuE~tsc*W7NqRXKW=*Pd!zji)tJ<$ht@=}aylNNk z9KKK$Xv*AB{5>({nfa;RNxHokZT2yh9{-V%_&V-#?0)mtT_L*3 zk8^+38RvPkyk&d)cgwmoZ^h8L*Ix@sTNiPgXPww`NaUBP%I+_o8+K|g)w>iunLBvC zQEtWh^Z&i|72-bJu!y=obHkGsyMXH9+-FuTk`b;B8((saS){SVhZ_r3V7gw?Qm$ArY`MR#vb ztZ)*)qOP;S;DY(ml|R?-`M9U!uwPN*i;Zi|&xs$GTfh=x8r;BYf6(@E_(_|CHtY=> w*9zL2-hQmCwYl=X%(d6;-(x1S3Yo9Ai&(fK-pl=@&qk~DrFfuh$a1Jr|HVRa5tPF7uu?Ti` z@(cBd3Jo`K@d_(*_VG;hG|O@^NKMuDGEC2R4RtI@&CoXDO3AKr4R?16w#aq~j7TXh zFHdwg$%-g*HuulSPAQHs3ra7mG&0D_2s86UvCFiyq_QGi!LcaK#30!@)IUErB-qT@ z!!w}NH8o$`DALul)WFy?IK|N@ILbTO)G^D%ldD48(bv_zAjm>HCp0i1w5lS~+a)?tZZ-!uX-Yy`A&) n)&3&DziNWYRXG0+Xq(`jC literal 0 HcmV?d00001 diff --git a/shell.nix b/shell.nix index 2aabb81..6accab5 100644 --- a/shell.nix +++ b/shell.nix @@ -24,9 +24,12 @@ devshell.name = "universe"; devshell.motd = ""; - devshell.packages = [ + devshell.packages = with pkgs; [ pythonEnv inputs'.disko.packages.disko + config.agenix-rekey.package + age-plugin-fido2-hmac + age-plugin-yubikey ]; env = [ diff --git a/users/infinidoge/default.nix b/users/infinidoge/default.nix index cd96e92..49ed655 100644 --- a/users/infinidoge/default.nix +++ b/users/infinidoge/default.nix @@ -43,7 +43,7 @@ in POP_SMTP_HOST = common.email.smtp.address; POP_SMTP_PORT = common.email.smtp.STARTTLS; POP_SMTP_USERNAME = common.email.withUser "infinidoge"; - POP_SMTP_PASSWORD = "$(cat ${secrets.personal-smtp-password})"; + POP_SMTP_PASSWORD = "$(cat ${secrets.smtp-personal})"; }; home.packages = @@ -110,10 +110,22 @@ in adb.enable = config.info.graphical; }; + age.rekey.masterIdentities = [ + ./keys/primary_age.pub + ./keys/backup_age.pub + ]; + + age.secrets = { + password-infinidoge.rekeyFile = ./password.age; + smtp-personal.rekeyFile = ./smtp-personal.age; + smtp-personal.owner = "infinidoge"; + }; + + user.hashedPasswordFile = mkIf config.modules.secrets.enable secrets.password-infinidoge; + user = { name = "infinidoge"; uid = 1000; - hashedPasswordFile = mkIf config.modules.secrets.enable config.secrets.infinidoge-password; description = "Infinidoge, primary user of the system"; group = "users"; isNormalUser = true; diff --git a/users/infinidoge/keys/backup_age.pub b/users/infinidoge/keys/backup_age.pub new file mode 100644 index 0000000..3c6f399 --- /dev/null +++ b/users/infinidoge/keys/backup_age.pub @@ -0,0 +1,7 @@ +# Serial: 26969244, Slot: 1 +# Name: BACKUP_AGE +# Created: Wed, 19 Feb 2025 01:58:28 +0000 +# PIN policy: Once (A PIN is required once per session, if set) +# Touch policy: Cached (A physical touch is required for decryption, and is cached for 15 seconds) +# Recipient: age1yubikey1q2dxqlvpp0jpjumgmm3rk952dqexy6r2ff4ul62luman3uga6s0l5llfumw +AGE-PLUGIN-YUBIKEY-1NJZFKQVZUM4H93SSLXN5A diff --git a/users/infinidoge/keys/primary_age.pub b/users/infinidoge/keys/primary_age.pub new file mode 100644 index 0000000..2eff10a --- /dev/null +++ b/users/infinidoge/keys/primary_age.pub @@ -0,0 +1,7 @@ +# Serial: 24623451, Slot: 1 +# Name: PRIMARY_AGE +# Created: Wed, 19 Feb 2025 00:53:27 +0000 +# PIN policy: Once (A PIN is required once per session, if set) +# Touch policy: Cached (A physical touch is required for decryption, and is cached for 15 seconds) +# Recipient: age1yubikey1q2mfklp6cectpmkefv6edr9elreeypdzwhpzsnwry9nzjq3epnswstkyq5w +AGE-PLUGIN-YUBIKEY-1TWUHWQVZPYLV4KGFG23L9 diff --git a/users/infinidoge/password.age b/users/infinidoge/password.age new file mode 100644 index 0000000000000000000000000000000000000000..25a8e84fb428af37cb0815057a0b6e13e9cce7ba GIT binary patch literal 493 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14$Sl(>Ffuh$a1Jr|HVRa5EcG+XurxIa z&DT!L%+C+0iqJ0c49y7%Ht=!Pwg~jpPD)P8G7r)>Ff@zc3NR@ub1Y2_tPD@~2shMs zcM1zF%5qNfb&E_*_x1EN&nwO@tuRbBFLuvIvCFiyq_QGi!7)FiEZj0LPd_KWB017a zzbMP3(BC4=Alo(Hsj?y@BrGG)J<2!HKiI=0lFKwV(9*Hc*)Q2FB{;&ZswCJY(KRB> z(5*5&G19`jv??n+IM}?xJE|@S_gYd_wv4%y~?chdWEFfuh$a1Jr|HVRa5H1-KKcXKhx z3lA&scP%vZ@-Ox^O?FK;NH=i`bP7uKj4BB)4zMf?PI1ZLD)bFW%E`zt%k~d-DGUlJ zc1`k6PB!x^^)w7BHOjOIH1$a`%QdPhEzGb$vCFiyq_QGi!Lh15BsAGDqawtmGCjB~ zIN3FzFf<}F(b(A0HPPlVXA+AVo+{rE|;#Zu0m>Vc3N1lS6Hw~N~Lj7nQ2Bvc5acSPo76`WT<&?zI(cR zd6HqUX|_*LITynx^Yeo4JRbyR piv-p256 CT7K2Q AooiXHg+vA2jBkxQ00aC81gCRIuo9Xe4c4uOaWCMU4X6 +4Aaaywj9vKAj/cv+yb6gFeiV+ROTeTxnPDrgAO29ODM +-> piv-p256 5utyxg Apti8vz8VE2kLk8pvWIYk0f+AnuHItXpH3x2MDs3iv+0 ++OhtPhXmsLZXimQuAIdB54OD1Qde18ZDVBUsGNafRR8 +-> M_nrH-grease hj"xH( *8 dX] +Ld3SIuXFJqz/gbDEnDxroU188XFJjoRkqHnYWpRLauCpcSbG2kHuKdYKDQ +--- Wp70IAXPdmf99j5ccFzGM8FDfcTl05nz01d5cc0tVgI +4,DXUڛ +Gx( E'(gK&hͽ$E/g{BJQaN,j'3(4jQھ) +[CAJf&Ͱaf ͸~Ր*ݥx9*I \ No newline at end of file