Payas Relekar
629846a1f9
agenix uses age (a utility + standard) that encrypts secrets using ssh key.
This simplifies secrets management quite a bit compared to GPG (my attempts for
which have failed so far).
Changes included:
- Encrypt all current keys (mail, backups) using age, configured via
agenix
- All encrypted keys are committed to git repo and decrypted during boot
- None of the keys are used anywhere just yet. They will replace file
paths in future commit after testing
- Decrypted keys are available after boot under user name with read-only
permissions at default agenix location (as of this commit)
- The Nix variable path is provided by agenix and can be used instead of
having to recreate
- multiple keys can be specified for single key, but for now I am only
using one
For now, the code is dirty and can definitely use improvements. It is just at a
place where it is all working right now.
TODO: Get age + agenix in environment packages available at runtime in NixOS
Links:
- https://github.com/ryantm/agenix
- https://github.com/hlissner/dotfiles
43 lines
1.3 KiB
Nix
43 lines
1.3 KiB
Nix
{
|
|
description = "Payas' NixOS configuration (flake edition)";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
|
home-manager = {
|
|
url = "github:nix-community/home-manager";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
emacs-overlay = {
|
|
url = "github:nix-community/emacs-overlay";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
agenix = {
|
|
url = "github:ryantm/agenix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
};
|
|
|
|
outputs = { self, nixpkgs, home-manager, emacs-overlay, agenix, ... }: {
|
|
nixosConfigurations = {
|
|
enterprise = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
./hosts/enterprise/configuration.nix
|
|
./modules/agenix.nix
|
|
agenix.nixosModules.age
|
|
(import ./nix.nix)
|
|
(import ./hosts/enterprise/sound.nix)
|
|
(import ./hosts/enterprise/backup.nix)
|
|
(import ./cachix.nix)
|
|
{ nixpkgs.overlays = [ emacs-overlay.overlay ]; }
|
|
home-manager.nixosModules.home-manager
|
|
{
|
|
home-manager.useGlobalPkgs = true;
|
|
home-manager.useUserPackages = true;
|
|
home-manager.users.payas = import ./hosts/enterprise/home.nix;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|