darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
9 Commits 2 Branches 0 Tags
dd6c4829adcb7a8a04cea17ccf4aaa68abc9bdf4
Commit Graph
3 Commits
Author SHA1 Message Date
erikandClaude Opus 4.8 dd6c4829ad feat: darman login password via sops (hashedPasswordFile) 
- add darman_password (sha-512 hash) to secrets/jupiter.yaml
- neededForUsers so it lands in /run/secrets-for-users before user setup
- real host uses hashedPasswordFile; VM keeps its test initialPassword

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 21:22:00 +02:00
erikandClaude Opus 4.8 f9358375b5 feat: sops decrypts via pre-generated SSH host key (works on boot #1) 
- pre-generate jupiter SSH host key off-repo (~/.config/homelab/jupiter)
- derive age recipient via ssh-to-age, add to .sops.yaml, re-encrypt secret
- secrets.nix: sops.age.sshKeyPaths = host key (drop separate keyFile)
- gitignore private-key patterns
- README: ship host key via nixos-anywhere --extra-files; secret decrypts boot #1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 20:48:33 +02:00
erikandClaude Opus 4.8 10387fdbee feat: sops-nix for samba password secret 
- add sops-nix input + module (jupiter only, not the VM)
- secrets/jupiter.yaml: age-encrypted samba_password (safe to commit)
- .sops.yaml: encryption rule for admin age key
- secrets.nix: decrypt samba_password to /run/secrets on the host
- provisioning oneshot reads sops secret (host) or plaintext (VM), single value
- .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 20:16:17 +02:00