darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(mercury): sops age key on root fs (/var/lib/sops-nix/age.txt)

Browse Source 
Pi's vfat partition isn't mounted at runtime (u-boot reads it pre-boot), so
/boot/firmware doesn't exist -> keyFile moved to the always-mounted root fs.
deploy flash now drops it on the ext4 root partition.
This commit is contained in:
erik
2026-07-13 22:53:43 +02:00
parent dd6e093ca4
commit b0ad211a92
2 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/mercury/secrets.nix
+4 -3
View File
@@ -3,12 +3,13 @@
# sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
#
# SD images have no `--extra-files` step, so mercury uses a DEDICATED age key
# placed on the FAT boot partition. `./deploy flash mercury <dev>` does this
# automatically (copies ~/.config/homelab/mercury/age.txt -> sops-age.txt).
# placed on the ROOT filesystem (the Pi's vfat partition isn't mounted at
# runtime — u-boot reads it pre-boot). `./deploy flash mercury <dev>` drops
# ~/.config/homelab/mercury/age.txt there automatically.
# The key never enters the repo, the nix store, or the image itself.
{
sops.defaultSopsFile = ../../secrets/mercury.yaml;
sops.age.keyFile = "/boot/firmware/sops-age.txt";
sops.age.keyFile = "/var/lib/sops-nix/age.txt";
# darman's console password (SSH is key-only regardless). Different hash per
# host = different password per host.