darman
67b12cb96b
Replaces CachyOS on the OS SSD (Kingston SA400, disko-managed). Dev-data disks (sdc ext4 /mnt/hdd_01, LVM vg_ssd /mnt/ssd_01) stay out of disko and are mounted as plain filesystems so they're never wiped. Desktop split into services/desktop/desktop-hyprland.nix (session: compositor, greeter, audio, portals) and desktop-apps.nix (things darman actually launches, including claude-code — allowlisted alongside the other unfree desktop apps).
34 lines
1.6 KiB
YAML
34 lines
1.6 KiB
YAML
# sops-nix encryption rules.
|
|
# Secrets under secrets/ are encrypted to the age recipient(s) below.
|
|
# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
|
|
# editing; /var/lib/sops-nix/key.txt on the host for decryption).
|
|
#
|
|
# Add the host's own age key here later (derived from its ssh host key) so the
|
|
# machine can decrypt without shipping a separate key.
|
|
keys:
|
|
# admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
|
|
- &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
# per-host keys — derived from each box's pre-generated SSH host key
|
|
# (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
|
|
- &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
|
|
- &neptun age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
|
|
- &terra age1rfcmu6zh40v4260l9hnf8ajs9vly0s06rx3ey76eu78dp9t7getqyhmkut
|
|
# mercury (rpi) uses a dedicated age key (SD image, no ssh-host-key delivery);
|
|
# the private key is dropped on its boot partition after flashing.
|
|
- &mercury age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
|
|
# Each host's secrets go to admin (edit) + that host only. Order matters:
|
|
# the first matching rule wins, so keep these specific paths.
|
|
creation_rules:
|
|
- path_regex: secrets/jupiter\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *jupiter ]
|
|
- path_regex: secrets/neptun\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *neptun ]
|
|
- path_regex: secrets/terra\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *terra ]
|
|
- path_regex: secrets/mercury\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *mercury ]
|