darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(mercury): sops age key on root fs (/var/lib/sops-nix/age.txt)

Browse Source 
Pi's vfat partition isn't mounted at runtime (u-boot reads it pre-boot), so
/boot/firmware doesn't exist -> keyFile moved to the always-mounted root fs.
deploy flash now drops it on the ext4 root partition.
This commit is contained in:
erik
2026-07-13 22:53:43 +02:00
parent dd6e093ca4
commit b0ad211a92
2 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/mercury/secrets.nix
+4 -3
View File
@@ -3,12 +3,13 @@
# sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
#
# SD images have no `--extra-files` step, so mercury uses a DEDICATED age key
# placed on the FAT boot partition. `./deploy flash mercury <dev>` does this
# automatically (copies ~/.config/homelab/mercury/age.txt -> sops-age.txt).
# placed on the ROOT filesystem (the Pi's vfat partition isn't mounted at
# runtime — u-boot reads it pre-boot). `./deploy flash mercury <dev>` drops
# ~/.config/homelab/mercury/age.txt there automatically.
# The key never enters the repo, the nix store, or the image itself.
{
sops.defaultSopsFile = ../../secrets/mercury.yaml;
sops.age.keyFile = "/boot/firmware/sops-age.txt";
sops.age.keyFile = "/var/lib/sops-nix/age.txt";
# darman's console password (SSH is key-only regardless). Different hash per
# host = different password per host.
scripts/deploy
+11 -9
View File
@@ -118,22 +118,24 @@ case "$cmd" in
zstdcat "$img" | sudo dd of="$dev" bs=4M status=progress oflag=sync
sync
# If this config has a dedicated sops age key, drop it on the FAT boot
# partition (mounts at /boot/firmware) so sops decrypts on first boot.
# Key stays off-repo and out of the nix store; the image itself has no key.
# If this config has a dedicated sops age key, drop it on the ROOT ext4
# partition at /var/lib/sops-nix/age.txt so sops decrypts on first boot.
# (The Pi's vfat partition isn't mounted at runtime, so the key can't live
# there.) Key stays off-repo, out of the nix store, and out of the image.
keyfile="$HOME/.config/homelab/$config/age.txt"
if [ -f "$keyfile" ]; then
echo ">> installing sops age key onto the boot partition"
echo ">> installing sops age key onto the root partition"
sudo partprobe "$dev" 2>/dev/null || sudo blockdev --rereadpt "$dev" 2>/dev/null || true
sudo udevadm settle 2>/dev/null || true
fatpart="$(lsblk -lno PATH,FSTYPE "$dev" | awk '$2=="vfat"{print $1; exit}')"
[ -n "$fatpart" ] || die "no FAT boot partition found on $dev — copy $keyfile to it manually as sops-age.txt"
# largest ext4 partition = the NixOS root.
rootpart="$(lsblk -blno PATH,FSTYPE,SIZE "$dev" | awk '$2=="ext4"{print $3, $1}' | sort -rn | head -1 | awk '{print $2}')"
[ -n "$rootpart" ] || die "no ext4 root partition found on $dev — place $keyfile at /var/lib/sops-nix/age.txt manually"
mnt="$(mktemp -d)"
sudo mount "$fatpart" "$mnt"
sudo cp "$keyfile" "$mnt/sops-age.txt"
sudo mount "$rootpart" "$mnt"
sudo install -Dm600 "$keyfile" "$mnt/var/lib/sops-nix/age.txt"
sudo sync
sudo umount "$mnt"; rmdir "$mnt"
echo ">> age key installed (sops-age.txt)"
echo ">> age key installed (/var/lib/sops-nix/age.txt)"
fi
echo ">> done — insert the card into the Pi and boot."
;;