darmanandClaude Sonnet 5
ced2b56764
Local Postgres, peer-authed over the unix socket (the "zitadel" role is granted createdb+createrole and doubles as both the runtime and bootstrap DB user - no password anywhere). TLS terminates at Caddy; Zitadel listens on localhost:8080 and is proxied at auth.mgaction.town. Master key and admin bootstrap password come from sops - the admin password specifically needs the sops.templates -> rendered-file route (services.zitadel.steps would leak it into the world-readable Nix store), same pattern as mercury's pihole.env. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
40 lines
1.5 KiB
Nix
40 lines
1.5 KiB
Nix
{ config, ... }:
|
|
|
|
# sops-nix wiring for neptun (netcup VPS). Encrypted values in ../../secrets/neptun.yaml,
|
|
# decrypted with the VPS's own SSH host key (recipient in ../../.sops.yaml).
|
|
# The host key is pre-generated on the laptop and shipped at install
|
|
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
|
|
{
|
|
sops.defaultSopsFile = ../../secrets/neptun.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
sops.secrets.tailscale_authkey = { };
|
|
|
|
# darman's console password (own hash = distinct from jupiter/mercury).
|
|
sops.secrets.darman_password.neededForUsers = true;
|
|
users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
|
|
|
|
# Zitadel: masterKeyFile takes a path natively (no store leak). The admin
|
|
# bootstrap password is different — services.zitadel.steps would render it
|
|
# into a world-readable store path, so render a FirstInstance steps file
|
|
# from the secret instead and point extraStepsPaths at it (see
|
|
# services/zitadel.nix and the pihole.env template on mercury for the same
|
|
# pattern).
|
|
sops.secrets.zitadel_master_key = { };
|
|
sops.secrets.zitadel_admin_password = { };
|
|
sops.templates."zitadel-first-instance.yaml".content = ''
|
|
FirstInstance:
|
|
Org:
|
|
Name: mgaction
|
|
Human:
|
|
UserName: admin
|
|
FirstName: Admin
|
|
LastName: Admin
|
|
Email:
|
|
Address: erik.simon.me@gmail.com
|
|
Verified: true
|
|
Password: ${config.sops.placeholder.zitadel_admin_password}
|
|
PasswordChangeRequired: false
|
|
'';
|
|
}
|