From e2ec40a9560c49df15dcfb33e7bbce3a00082f3b Mon Sep 17 00:00:00 2001 From: Alex van de Sandt Date: Wed, 1 Jul 2026 16:37:57 -0500 Subject: [PATCH] Add secrets via sops --- .sops.yaml | 14 +++++++++++ flake.lock | 38 +++++++++++++++++++----------- flake.nix | 9 ++++++- modules/atproto/sops.nix | 28 ++++++++++++++++++++++ modules/{ => atproto}/tranquil.nix | 11 +++++++-- modules/hosts/roost/roost.nix | 2 ++ modules/users/igneous.nix | 1 + secrets/pds.yaml | 27 +++++++++++++++++++++ 8 files changed, 113 insertions(+), 17 deletions(-) create mode 100644 .sops.yaml create mode 100644 modules/atproto/sops.nix rename modules/{ => atproto}/tranquil.nix (65%) create mode 100644 secrets/pds.yaml diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..d8d595a --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,14 @@ +keys: + - &pds age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg + - &server_roost age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8 +creation_rules: + - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ + key_groups: + - age: + - *pds + - *server_roost + - path_regex: secrets/igneous/[^/]+\.(yaml|json|env|ini)$ + key_groups: + - age: + - *pds + - *server_roost diff --git a/flake.lock b/flake.lock index 70d9ad0..915f384 100644 --- a/flake.lock +++ b/flake.lock @@ -545,19 +545,6 @@ "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz" } }, - "nixpkgs_3": { - "locked": { - "lastModified": 1778672786, - "narHash": "sha256-Tf7q8/0aIwg4Btd/GUMNHXDTqlrWTr5o/vZ8euFUAQY=", - "rev": "eef00dfd8a712b34af845f9350bac681b1228bd1", - "type": "tarball", - "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre997230.eef00dfd8a71/nixexprs.tar.xz?lastModified=1778672786&rev=eef00dfd8a712b34af845f9350bac681b1228bd1" - }, - "original": { - "type": "tarball", - "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz" - } - }, "nixvim": { "inputs": { "flake-parts": "flake-parts_2", @@ -614,10 +601,31 @@ "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_2", "nixvim": "nixvim", + "sops-nix": "sops-nix", "tranquil-pds": "tranquil-pds", "zen-browser": "zen-browser" } }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1782165805, + "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1689347949, @@ -651,7 +659,9 @@ }, "tranquil-pds": { "inputs": { - "nixpkgs": "nixpkgs_3" + "nixpkgs": [ + "nixpkgs" + ] }, "locked": { "lastModified": 1782711090, diff --git a/flake.nix b/flake.nix index 309015e..27b5097 100644 --- a/flake.nix +++ b/flake.nix @@ -25,7 +25,14 @@ url = "github:nix-community/nixvim"; inputs.nixpkgs.follows = "nixpkgs"; }; - tranquil-pds.url = "git+https://tangled.org/tranquil.farm/tranquil-pds"; + sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + tranquil-pds = { + url = "git+https://tangled.org/tranquil.farm/tranquil-pds"; + inputs.nixpkgs.follows = "nixpkgs"; + }; zen-browser = { url = "github:youwen5/zen-browser-flake"; inputs.nixpkgs.follows = "nixpkgs"; diff --git a/modules/atproto/sops.nix b/modules/atproto/sops.nix new file mode 100644 index 0000000..687428e --- /dev/null +++ b/modules/atproto/sops.nix @@ -0,0 +1,28 @@ +{ inputs, ... }: { + flake-file.inputs.sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + + den.aspects.sops = { + nixos = { pkgs, ... }: { + environment.systemPackages = with pkgs; [ + age + sops + ]; + }; + + recipient = { + nixos = { + imports = [ inputs.sops-nix.nixosModules.sops ]; + + sops = { + defaultSopsFile = ./secrets/pds.yaml; + age = { + sshKeyPaths = [ "/etc/ssh/ssh_host/ed25519_key" ]; + }; + }; + }; + }; + }; +} diff --git a/modules/tranquil.nix b/modules/atproto/tranquil.nix similarity index 65% rename from modules/tranquil.nix rename to modules/atproto/tranquil.nix index f0262f8..4094e31 100644 --- a/modules/tranquil.nix +++ b/modules/atproto/tranquil.nix @@ -1,10 +1,11 @@ { inputs, ... }: { flake-file.inputs.tranquil-pds = { url = "git+https://tangled.org/tranquil.farm/tranquil-pds"; + inputs.nixpkgs.follows = "nixpkgs"; }; den.aspects.tranquil = { - nixos = { + nixos = { config, ... }: { imports = [ inputs.tranquil-pds.nixosModules.default ]; services.tranquil-pds = { @@ -14,7 +15,13 @@ server.hostname = "pds.alexvds.com"; }; - environmentFiles = [ "/etc/secrets/tranquil.env.production" ]; + environmentFiles = [ ]; + }; + + sops.secrets = { + jwt_secret = { }; + dpop_secret = { }; + master_key = { }; }; }; }; diff --git a/modules/hosts/roost/roost.nix b/modules/hosts/roost/roost.nix index d371006..994fd1e 100644 --- a/modules/hosts/roost/roost.nix +++ b/modules/hosts/roost/roost.nix @@ -7,6 +7,8 @@ den.batteries.hostname grub + sops + sops.recipient tranquil ]; diff --git a/modules/users/igneous.nix b/modules/users/igneous.nix index 314c9b9..78bd487 100644 --- a/modules/users/igneous.nix +++ b/modules/users/igneous.nix @@ -19,6 +19,7 @@ shell shell.bash shell.zsh + sops spotify steam zen diff --git a/secrets/pds.yaml b/secrets/pds.yaml new file mode 100644 index 0000000..75d7fe7 --- /dev/null +++ b/secrets/pds.yaml @@ -0,0 +1,27 @@ +jwt_secret: ENC[AES256_GCM,data:TchgnA9lmRxmxqVSVNybPr20zyruo+qErokHzxANcgXSkD8oaE9Ldi9R6LKTTOi9gjLEX3yp0L08ZyAQ8imPXQ==,iv:+9+K0+xoy0+qND2YBQ73PaYMkRd1Htshmyih6SveM+E=,tag:fk0brk8CmyxENH4y0+aq6g==,type:str] +dpop_secret: ENC[AES256_GCM,data:BH9XEwwAykLL56tz2UWX8J3WEvM+tkQm43PW8sdv8J/JJkxGkqVIIsXDG1nUcZErjA2hs0J0ebgG6qVVDKvsCg==,iv:GQdzzoB/FY8bK5U0yBInKPof1uAoU9PqoRP4Ixjol10=,tag:iOFiYDQtv83DWVzAkv1M1A==,type:str] +master_key: ENC[AES256_GCM,data:bQ42PHnWX39jZHp462HldzgkYcvmOTs6SDciwJr3wxg2Z2R3rDfeE0jfv5C1IfKi4oeYTI1xzx2quqFRfw6NxQ==,iv:no8pQGbnXFjrcY9pqakBxnJwkKbyhTJ3NNcOcHJqftU=,tag:ZqFjMckQdqiNQ3js1ggkRw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeTFEMjlkaEV5UWw3TFVC + MW5ZWWZUUEkrT1hmTUMxOWtzUmVHWHI1MkNjClE4QmMrSjRaSEVIL3BQK05zazJi + NlRmYU92Vng5b3FEeGx4U0o0S09FcjAKLS0tIE1FSEpCNElxVllwVS9EdlY1OEM0 + bkw2YkJWRTlYK3g3akI5SlM4Q0NXWUEKirJB9sdcQJtylWQNK72Y4iWXkxEsPTZU + 2WY+bX9NhsdM+iE3dqIrna9LYD/2lRxc9OnriF4sVVQO88aWxmKlIg== + -----END AGE ENCRYPTED FILE----- + recipient: age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzOENtUVIwaWFsZEJLQkZz + YXF5ZWRQQ3QwYUwrTmRZRFRTRjduS3IvTDE0CnFJYjBoemtHY3c3dGZqMUNLUWlY + S0xZcXkvR2dMZnUzdStDTDQzUmlDbmcKLS0tIGUvT3ZUMk40ZW9DYkI3RHZFU3BO + QVJWME43Rk00cXFxdHY0RUU3TkhiZjQKtZBCmk+C1Xt1zBBAOmCAk12W1Vx80Mh5 + VG1CjmQgkOA/0CZ3bpLFH/ZvYvIDLHzrE35QlDkstdTeTndqh5nC8w== + -----END AGE ENCRYPTED FILE----- + recipient: age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8 + lastmodified: "2026-07-01T21:30:04Z" + mac: ENC[AES256_GCM,data:bKARPmIg0KWcP4VpuPucMmxZLO00WWQZmO0tHZU/vPYXaGCyHJ/Oz0S6egG57E6AiniylFBLM1fBPwYnE8svXTZvRbfSSM8+4YhheXWZ5ziQ5l8N79CqhPKU5G4GotQ6REL+Rv0oYNjHnDCxgjg7eE4NMmPsbLKby9a1kj+FPBo=,iv:swkPSQ2M6O33ToX7kWEXDE2fDGVyyozmw0ae6uUYYy4=,tag:3s0deQ6dHcvpqJQTE+zQlg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1 -- 2.51.2