darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
23 Commits 2 Branches 0 Tags
946c44f1d3b4401cdd8f2892ed0f8ebde92a6bf7
Commit Graph
3 Commits
Author SHA1 Message Date
erik 946c44f1d3 feat: scaffold netcup vps host (disko/vda, static net, tailscale, caddy) 
- new nixosConfigurations.vps: UEFI systemd-boot, disko on /dev/vda
- static IPv4 159.195.64.117/22 gw .1 (+ IPv6), eth0 pinned, public DNS
- tailscale via headscale + sops authkey (secrets/vps.yaml, own host key)
- caddy public reverse proxy: audiobookshelf.mgaction.town -> jupiter tailnet:8000
- shared common.nix (user/ssh/nix) ; .sops.yaml per-host rules
 2026-07-13 01:01:53 +02:00
erikandClaude Opus 4.8 f9358375b5 feat: sops decrypts via pre-generated SSH host key (works on boot #1) 
- pre-generate jupiter SSH host key off-repo (~/.config/homelab/jupiter)
- derive age recipient via ssh-to-age, add to .sops.yaml, re-encrypt secret
- secrets.nix: sops.age.sshKeyPaths = host key (drop separate keyFile)
- gitignore private-key patterns
- README: ship host key via nixos-anywhere --extra-files; secret decrypts boot #1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 20:48:33 +02:00
erikandClaude Opus 4.8 10387fdbee feat: sops-nix for samba password secret 
- add sops-nix input + module (jupiter only, not the VM)
- secrets/jupiter.yaml: age-encrypted samba_password (safe to commit)
- .sops.yaml: encryption rule for admin age key
- secrets.nix: decrypt samba_password to /run/secrets on the host
- provisioning oneshot reads sops secret (host) or plaintext (VM), single value
- .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 20:16:17 +02:00