darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(mercury): sops age key on root fs (/var/lib/sops-nix/age.txt)

Browse Source 
Pi's vfat partition isn't mounted at runtime (u-boot reads it pre-boot), so
/boot/firmware doesn't exist -> keyFile moved to the always-mounted root fs.
deploy flash now drops it on the ext4 root partition.
This commit is contained in:
erik
2026-07-13 22:53:43 +02:00
parent dd6e093ca4
commit b0ad211a92
2 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/deploy
+11 -9
View File
@@ -118,22 +118,24 @@ case "$cmd" in
zstdcat "$img" | sudo dd of="$dev" bs=4M status=progress oflag=sync
sync
# If this config has a dedicated sops age key, drop it on the FAT boot
# partition (mounts at /boot/firmware) so sops decrypts on first boot.
# Key stays off-repo and out of the nix store; the image itself has no key.
# If this config has a dedicated sops age key, drop it on the ROOT ext4
# partition at /var/lib/sops-nix/age.txt so sops decrypts on first boot.
# (The Pi's vfat partition isn't mounted at runtime, so the key can't live
# there.) Key stays off-repo, out of the nix store, and out of the image.
keyfile="$HOME/.config/homelab/$config/age.txt"
if [ -f "$keyfile" ]; then
echo ">> installing sops age key onto the boot partition"
echo ">> installing sops age key onto the root partition"
sudo partprobe "$dev" 2>/dev/null || sudo blockdev --rereadpt "$dev" 2>/dev/null || true
sudo udevadm settle 2>/dev/null || true
fatpart="$(lsblk -lno PATH,FSTYPE "$dev" | awk '$2=="vfat"{print $1; exit}')"
[ -n "$fatpart" ] || die "no FAT boot partition found on $dev — copy $keyfile to it manually as sops-age.txt"
# largest ext4 partition = the NixOS root.
rootpart="$(lsblk -blno PATH,FSTYPE,SIZE "$dev" | awk '$2=="ext4"{print $3, $1}' | sort -rn | head -1 | awk '{print $2}')"
[ -n "$rootpart" ] || die "no ext4 root partition found on $dev — place $keyfile at /var/lib/sops-nix/age.txt manually"
mnt="$(mktemp -d)"
sudo mount "$fatpart" "$mnt"
sudo cp "$keyfile" "$mnt/sops-age.txt"
sudo mount "$rootpart" "$mnt"
sudo install -Dm600 "$keyfile" "$mnt/var/lib/sops-nix/age.txt"
sudo sync
sudo umount "$mnt"; rmdir "$mnt"
echo ">> age key installed (sops-age.txt)"
echo ">> age key installed (/var/lib/sops-nix/age.txt)"
fi
echo ">> done — insert the card into the Pi and boot."
;;