erik
946c44f1d3
- new nixosConfigurations.vps: UEFI systemd-boot, disko on /dev/vda - static IPv4 159.195.64.117/22 gw .1 (+ IPv6), eth0 pinned, public DNS - tailscale via headscale + sops authkey (secrets/vps.yaml, own host key) - caddy public reverse proxy: audiobookshelf.mgaction.town -> jupiter tailnet:8000 - shared common.nix (user/ssh/nix) ; .sops.yaml per-host rules
24 lines
1.1 KiB
YAML
24 lines
1.1 KiB
YAML
# sops-nix encryption rules.
|
|
# Secrets under secrets/ are encrypted to the age recipient(s) below.
|
|
# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
|
|
# editing; /var/lib/sops-nix/key.txt on the host for decryption).
|
|
#
|
|
# Add the host's own age key here later (derived from its ssh host key) so the
|
|
# machine can decrypt without shipping a separate key.
|
|
keys:
|
|
# admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
|
|
- &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
# per-host keys — derived from each box's pre-generated SSH host key
|
|
# (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
|
|
- &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
|
|
- &vps age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
|
|
# Each host's secrets go to admin (edit) + that host only. Order matters:
|
|
# the first matching rule wins, so keep these specific paths.
|
|
creation_rules:
|
|
- path_regex: secrets/jupiter\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *jupiter ]
|
|
- path_regex: secrets/vps\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *vps ]
|