erik
1937d59b2c
- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml
-> hashedPasswordFile; different console password per host (ssh still key-only)
- mercury: dedicated age key (on boot partition post-flash), sops-nix wired
- AdGuard: module has no secret hook + writable config -> mutableSettings=true,
admin password set via web setup on first boot (never in repo/store)
30 lines
1.4 KiB
YAML
30 lines
1.4 KiB
YAML
# sops-nix encryption rules.
|
|
# Secrets under secrets/ are encrypted to the age recipient(s) below.
|
|
# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
|
|
# editing; /var/lib/sops-nix/key.txt on the host for decryption).
|
|
#
|
|
# Add the host's own age key here later (derived from its ssh host key) so the
|
|
# machine can decrypt without shipping a separate key.
|
|
keys:
|
|
# admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
|
|
- &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
# per-host keys — derived from each box's pre-generated SSH host key
|
|
# (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
|
|
- &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
|
|
- &vps age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
|
|
# mercury (rpi) uses a dedicated age key (SD image, no ssh-host-key delivery);
|
|
# the private key is dropped on its boot partition after flashing.
|
|
- &mercury age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
|
|
# Each host's secrets go to admin (edit) + that host only. Order matters:
|
|
# the first matching rule wins, so keep these specific paths.
|
|
creation_rules:
|
|
- path_regex: secrets/jupiter\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *jupiter ]
|
|
- path_regex: secrets/vps\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *vps ]
|
|
- path_regex: secrets/mercury\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *mercury ]
|