First commit

modules/sops/default.nix

@@ -0,0 +1,70 @@
+{ inputs, ... }@attrs:
+let
+  secretsPath = builtins.toString inputs.mysecrets;
+in
+{
+  sops = {
+    defaultSopsFile = "${secretsPath}/secrets.yaml";
+    age = {
+      sshKeyPaths = [
+        "/etc/ssh/ssh_host_ed25519_key"
+      ];
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+
+    secrets = {
+      "ldap_password/beastie" = {
+      };
+      "users_password/beastie" = {
+        neededForUsers = true;
+      };
+      "ssh_keys/default_pub" = {
+        owner = "${attrs.username}";
+        mode = "0644";
+        path = "/home/${attrs.username}/.ssh/id_ed25519.pub";
+      };
+      "ssh_keys/default_priv" = {
+        owner = "${attrs.username}";
+        mode = "0600";
+        path = "/home/${attrs.username}/.ssh/id_ed25519";
+      };
+      "ssh_keys/ansible_pub" = {
+        owner = "${attrs.username}";
+        mode = "0644";
+        path = "/home/${attrs.username}/.ssh/id_ed25519_ansible.pub";
+      };
+      "ssh_keys/ansible_priv" = {
+        owner = "${attrs.username}";
+        mode = "0600";
+        path = "/home/${attrs.username}/.ssh/id_ed25519_ansible";
+      };
+      "ssh_keys/beastie_pub" = {
+        owner = "${attrs.username}";
+        mode = "0644";
+        path = "/home/${attrs.username}/.ssh/id_ed25519_beastie.pub";
+      };
+      "ssh_keys/beastie_priv" = {
+        owner = "${attrs.username}";
+        mode = "0600";
+        path = "/home/${attrs.username}/.ssh/id_ed25519_beastie";
+      };
+      "ssh_keys/gitea_semaphore_pub" = {
+        owner = "${attrs.username}";
+        mode = "0644";
+        path = "/home/${attrs.username}/.ssh/id_ed25519_gitea_semaphore.pub";
+      };
+      "ssh_keys/gitea_semaphore_priv" = {
+        owner = "${attrs.username}";
+        mode = "0600";
+        path = "/home/${attrs.username}/.ssh/id_ed25519_gitea_semaphore";
+      };
+    };
+  };
+  system.activationScripts.setup-ssh-keys = {
+    text = ''
+      chown ${attrs.username}:users /home/${attrs.username}/.ssh
+      chmod 700 /home/${attrs.username}/.ssh
+    '';
+  };
+}