erikandClaude Opus 4.8
f9358375b5
- pre-generate jupiter SSH host key off-repo (~/.config/homelab/jupiter) - derive age recipient via ssh-to-age, add to .sops.yaml, re-encrypt secret - secrets.nix: sops.age.sshKeyPaths = host key (drop separate keyFile) - gitignore private-key patterns - README: ship host key via nixos-anywhere --extra-files; secret decrypts boot #1 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
19 lines
747 B
Nix
19 lines
747 B
Nix
{ ... }:
|
|
|
|
# sops-nix secret wiring (real host only; not imported by vm.nix).
|
|
# Encrypted values live in ../secrets/jupiter.yaml, decrypted at activation to
|
|
# /run/secrets/<name>.
|
|
#
|
|
# The host decrypts with its OWN SSH host key (age identity derived via
|
|
# ssh-to-age, recipient listed in ../.sops.yaml). The key is pre-generated on
|
|
# the laptop and shipped once at install as /etc/ssh/ssh_host_ed25519_key
|
|
# (nixos-anywhere --extra-files) — so decryption works on boot #1 and there is
|
|
# no separate sops-only key to manage.
|
|
{
|
|
sops.defaultSopsFile = ../secrets/jupiter.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
# Decrypts to /run/secrets/samba_password (root-only by default).
|
|
sops.secrets.samba_password = { };
|
|
}
|