darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(deploy flash): auto-install sops age key onto the SD boot partition

Browse Source 
- after dd, if ~/.config/homelab/<config>/age.txt exists, mount the FAT boot
  partition and drop it as sops-age.txt (mercury). Key stays off-repo + out of
  the store + out of the image; no manual mount step.
This commit is contained in:
erik
2026-07-13 21:02:34 +02:00
parent 1937d59b2c
commit 2f89a5c5e7
3 changed files with 27 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/mercury/secrets.nix
+3 -3
View File
@@ -3,9 +3,9 @@
# sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
#
# SD images have no `--extra-files` step, so mercury uses a DEDICATED age key
# (not ssh-host-key-derived) placed on the FAT boot partition after flashing:
# mount the boot partition, copy ~/.config/homelab/mercury/age.txt to it as
# sops-age.txt, unmount. The key never enters the repo or the nix store.
# placed on the FAT boot partition. `./deploy flash mercury <dev>` does this
# automatically (copies ~/.config/homelab/mercury/age.txt -> sops-age.txt).
# The key never enters the repo, the nix store, or the image itself.
{
sops.defaultSopsFile = ../../secrets/mercury.yaml;
sops.age.keyFile = "/boot/firmware/sops-age.txt";