73 lines
3.3 KiB
Nix
73 lines
3.3 KiB
Nix
{ config, ... }:
|
|
|
|
# sops-nix secret wiring (real host only; not imported by vm.nix). Decrypts with the
|
|
# host's own SSH host key (ssh-to-age), shipped once at install via nixos-anywhere
|
|
# --extra-files, so there's no separate sops-only key to manage.
|
|
{
|
|
sops.defaultSopsFile = ../../secrets/jupiter.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
# Decrypts to /run/secrets/samba_password (root-only by default).
|
|
sops.secrets.samba_password = { };
|
|
|
|
# darman's login password (a sha-512 hash, not plaintext — generate with
|
|
# `mkpasswd -m sha-512`, edit via ./edit_secrets). neededForUsers makes it
|
|
# available before user setup, at /run/secrets-for-users/darman_password.
|
|
sops.secrets.darman_password.neededForUsers = true;
|
|
users.users.darman.hashedPasswordFile =
|
|
config.sops.secrets.darman_password.path;
|
|
|
|
# Headscale pre-auth key for tailscale auto-registration (see configuration.nix).
|
|
sops.secrets.tailscale_authkey = { };
|
|
|
|
# Immich's OIDC client secret (separate Authentik app from headscale/headplane, see
|
|
# hosts/neptun/secrets.nix). Resolved via systemd LoadCredential as root before
|
|
# privilege drop, so sops's default root:root 0400 is correct — do NOT set `owner`.
|
|
sops.secrets.immich_oauth_client_secret = { };
|
|
|
|
# Gitea Actions runner registration token — gitea generates this itself once Actions
|
|
# is enabled. Rendered into an env file since gitea-actions-runner takes an
|
|
# EnvironmentFile, not a raw secret path.
|
|
sops.secrets.gitea_runner_token = { };
|
|
sops.templates."gitea-runner.env".content =
|
|
"TOKEN=${config.sops.placeholder.gitea_runner_token}";
|
|
|
|
# provisioning access token for gitea used to setup ci-bot account + repo access
|
|
sops.secrets.gitea_provisioning_token.owner = "gitea";
|
|
|
|
# ci-bot access token to allow the ci-bot user to push to repos
|
|
sops.secrets.gitea_ci_bot_token.owner = "gitea";
|
|
|
|
# Add the same value to secrets/jupiter.yaml before deploying Jupiter.
|
|
sops.secrets.gitea_hermes_webhook_secret = {
|
|
owner = "gitea";
|
|
};
|
|
|
|
# SABnzbd credentials (web UI login, API keys, eweka.nl usenet server) for
|
|
# services/media/sabnzbd.nix; sabnzbd_api_key is shared with
|
|
# services/experimental/mediamanager.nix rather than duplicated.
|
|
# owner = sabnzbd because the module's preStart runs as that user, and sops secrets
|
|
# default to root:root 0400.
|
|
sops.secrets.sabnzbd_web_username.owner = "sabnzbd";
|
|
sops.secrets.sabnzbd_web_password.owner = "sabnzbd";
|
|
sops.secrets.sabnzbd_api_key.owner = "sabnzbd";
|
|
sops.secrets.sabnzbd_nzb_key.owner = "sabnzbd";
|
|
sops.secrets.sabnzbd_eweka_username.owner = "sabnzbd";
|
|
sops.secrets.sabnzbd_eweka_password.owner = "sabnzbd";
|
|
|
|
# CouchDB admin account for Obsidian LiveSync — rendered into an [admins] ini
|
|
# fragment instead of services.couchdb.adminPass, which would put the plaintext in
|
|
# the world-readable store.
|
|
# owner = couchdb on both: couchdb re-reads the ini as its own user after privilege
|
|
# drop, and without this sops's default root:root 0400 leaves it with no admin
|
|
# configured (every request 401s).
|
|
sops.secrets.couchdb_admin_password.owner = "couchdb";
|
|
sops.templates."couchdb-admins.ini" = {
|
|
owner = "couchdb";
|
|
content = ''
|
|
[admins]
|
|
obsidian = ${config.sops.placeholder.couchdb_admin_password}
|
|
'';
|
|
};
|
|
}
|