erik
1937d59b2c
- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
-> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
admin password set via web setup on first boot (never in repo/store)
18 lines
775 B
Nix
18 lines
775 B
Nix
{ config, ... }:
|
|
|
|
# sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
|
|
#
|
|
# SD images have no `--extra-files` step, so mercury uses a DEDICATED age key
|
|
# (not ssh-host-key-derived) placed on the FAT boot partition after flashing:
|
|
# mount the boot partition, copy ~/.config/homelab/mercury/age.txt to it as
|
|
# sops-age.txt, unmount. The key never enters the repo or the nix store.
|
|
{
|
|
sops.defaultSopsFile = ../../secrets/mercury.yaml;
|
|
sops.age.keyFile = "/boot/firmware/sops-age.txt";
|
|
|
|
# darman's console password (SSH is key-only regardless). Different hash per
|
|
# host = different password per host.
|
|
sops.secrets.darman_password.neededForUsers = true;
|
|
users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
|
|
}
|