darmanandClaude Opus 4.8
d9ea6a9ecc
mercury was the only host with no tailscale at all -- no module import, no secret, no key in its sops file. It had been enrolled before the NixOS migration and silently dropped off the tailnet when it was reflashed with a config that omitted it. --accept-dns=false, as on neptun and for a sharper reason: headscale pushes override_local_dns, so accepting MagicDNS would repoint the LAN's own DNS server at 100.100.100.100 and make house-wide name resolution depend on tailscaled being up. This host has already deadlocked once on boot-time DNS (see CLAUDE.md). darman_password is also rotated: the account had "!" in /etc/shadow, because on mercury's first boot the secret wasn't readable yet and update-users-groups.pl falls back to a locked account. mutableUsers is true, so no later rebuild ever revisited it and the lock was permanent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
23 lines
994 B
Nix
23 lines
994 B
Nix
{ config, ... }:
|
|
|
|
# sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
|
|
#
|
|
# SD images have no `--extra-files` step, so mercury uses a DEDICATED age key
|
|
# placed on the ROOT filesystem (the Pi's vfat partition isn't mounted at
|
|
# runtime — u-boot reads it pre-boot). `./deploy flash mercury <dev>` drops
|
|
# ~/.config/homelab/mercury/age.txt there automatically.
|
|
# The key never enters the repo, the nix store, or the image itself.
|
|
{
|
|
sops.defaultSopsFile = ../../secrets/mercury.yaml;
|
|
sops.age.keyFile = "/var/lib/sops-nix/age.txt";
|
|
|
|
# darman's console password (SSH is key-only regardless). Different hash per
|
|
# host = different password per host.
|
|
sops.secrets.darman_password.neededForUsers = true;
|
|
users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
|
|
|
|
# Pre-auth key for services/vpn/tailscale.nix. Root-owned 0400 is right:
|
|
# tailscaled runs as root and reads authKeyFile itself.
|
|
sops.secrets.tailscale_authkey = { };
|
|
}
|