erikandClaude Opus 4.8
f9358375b5
- pre-generate jupiter SSH host key off-repo (~/.config/homelab/jupiter) - derive age recipient via ssh-to-age, add to .sops.yaml, re-encrypt secret - secrets.nix: sops.age.sshKeyPaths = host key (drop separate keyFile) - gitignore private-key patterns - README: ship host key via nixos-anywhere --extra-files; secret decrypts boot #1 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 lines
889 B
YAML
20 lines
889 B
YAML
# sops-nix encryption rules.
|
|
# Secrets under secrets/ are encrypted to the age recipient(s) below.
|
|
# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
|
|
# editing; /var/lib/sops-nix/key.txt on the host for decryption).
|
|
#
|
|
# Add the host's own age key here later (derived from its ssh host key) so the
|
|
# machine can decrypt without shipping a separate key.
|
|
keys:
|
|
# admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
|
|
- &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
# jupiter host key — derived from its pre-generated SSH host key with
|
|
# ssh-to-age. The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
|
|
- &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
|
|
creation_rules:
|
|
- path_regex: secrets/.*\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *jupiter
|