feat(remote-deploy): persist keys

piyoki · Mar 4, 2024 · 0432f31 · 0432f31
1 parent 1745697
commit 0432f31
Show file tree

Hide file tree

Showing 6 changed files with 21 additions and 4 deletions.
diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -50,6 +50,7 @@
           deployment = {
             targetHost = "nixos-${profile}";
             inherit (import ./shared/vars) targetPort targetUser tags;
+            inherit (import ./shared/server/secrets) keys;
           };
           imports = hostModules ++ homeModules;
         };

diff --git a/secrets b/secrets
diff --git a/shared/server/secrets/default.nix b/shared/server/secrets/default.nix
@@ -0,0 +1,5 @@
+{
+  keys = {
+    "age-yubikey-master-key".keyFile = /run/secrets/age/yubikey-master-key;
+  };
+}
diff --git a/system/secrets/age-keys.nix b/system/secrets/age-keys.nix
@@ -0,0 +1,10 @@
+{ inputs, ... }:
+
+{
+  sops.secrets = {
+    "age/yubikey-master-key" = {
+      sopsFile = "${inputs.secrets}/age-keys.enc.yaml";
+      mode = "0644";
+    };
+  };
+}
diff --git a/system/secrets/default.nix b/system/secrets/default.nix
@@ -2,6 +2,7 @@ _:
 
 {
   imports = [
+    ./age-keys.nix
     ./samba.nix
     # ./sdwan.nix
   ];