darmanandClaude Sonnet 5
6f24ab69ad
Comments had drifted into multi-paragraph narrative (git commit lineage, debugging stories, restated code) in several hot spots (scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix). Trim every comment to its load-bearing "why" — gotchas, safety warnings, and non-obvious rationale survive verbatim in substance, just tightened to 1-2 sentences; historical narrative and anything already covered in CLAUDE.md is cut. No code/logic changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
51 lines
2.5 KiB
Nix
51 lines
2.5 KiB
Nix
{ config, ... }:
|
|
|
|
# sops-nix wiring for neptun (netcup VPS). Encrypted values in ../../secrets/neptun.yaml,
|
|
# decrypted with the VPS's own SSH host key (recipient in ../../.sops.yaml).
|
|
# The host key is pre-generated on the laptop and shipped at install
|
|
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
|
|
{
|
|
sops.defaultSopsFile = ../../secrets/neptun.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
sops.secrets.tailscale_authkey = { };
|
|
|
|
# darman's console password (own hash = distinct from jupiter/mercury).
|
|
sops.secrets.darman_password.neededForUsers = true;
|
|
users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
|
|
|
|
# Authentik takes a single systemd EnvironmentFile (services/identity/authentik.nix);
|
|
# no `owner` here on purpose, since systemd reads it as root before dropping to
|
|
# DynamicUser. AUTHENTIK_SECRET_KEY signs sessions (rotating it logs everyone out);
|
|
# the BOOTSTRAP_* vars only matter on the very first start (create `akadmin`) and are
|
|
# inert after.
|
|
sops.secrets.authentik_secret_key = { };
|
|
sops.secrets.authentik_bootstrap_password = { };
|
|
sops.secrets.authentik_bootstrap_email = { };
|
|
sops.templates."authentik.env".content = ''
|
|
AUTHENTIK_SECRET_KEY=${config.sops.placeholder.authentik_secret_key}
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD=${config.sops.placeholder.authentik_bootstrap_password}
|
|
AUTHENTIK_BOOTSTRAP_EMAIL=${config.sops.placeholder.authentik_bootstrap_email}
|
|
'';
|
|
|
|
# Caddy's ACME account email. Same EnvironmentFile trick as authentik above,
|
|
# and root:root 0400 is likewise correct — systemd reads it before dropping
|
|
# to User=caddy. Wired up in configuration.nix.
|
|
sops.secrets.caddy_acme_email = { };
|
|
sops.templates."caddy.env".content = ''
|
|
ACME_EMAIL=${config.sops.placeholder.caddy_acme_email}
|
|
'';
|
|
|
|
# Headplane's cookie_secret_path takes a path natively (no store leak); oidc.client_secret
|
|
# and the headscale API key are still REPLACE_ME placeholders (services/vpn/headplane.nix)
|
|
# until Authentik/headscale are deployed for real. Unlike authentik's EnvironmentFile,
|
|
# headscale/headplane open these paths themselves as the headscale user, so each needs
|
|
# an explicit owner — and headscale's OIDC client is a separate Authentik app from
|
|
# headplane's, hence the second client secret.
|
|
sops.secrets.headscale_oidc_client_secret.owner = "headscale";
|
|
|
|
sops.secrets.headplane_cookie_secret.owner = "headscale";
|
|
sops.secrets.headplane_oidc_client_secret.owner = "headscale";
|
|
sops.secrets.headplane_headscale_api_key.owner = "headscale";
|
|
}
|