Move secrets to flakes

[perso/Immae/Config/Nix.git] / modules / private / system.nix

diff --git a/modules/private/system.nix b/modules/private/system.nix
index c7e277c4bb7313efdd72e57bc2b57a2c234ed8b2..8be7368d8d4a2e306f8307c691948062feeb0962 100644 (file)
--- a/modules/private/system.nix
+++ b/modules/private/system.nix
@@ -1,6 +1,14 @@
 { pkgs, lib, config, name, nodes, ... }:
 {
   config = {
+    deployment.secrets."secret_vars.yml" = {
+      source = builtins.toString ../../nixops/secrets/vars.yml;
+      destination = config.secrets.secretsVars;
+      owner.user = "root";
+      owner.group = "root";
+      permissions = "0400";
+    };
+
     networking.extraHosts = builtins.concatStringsSep "\n"
       (lib.mapAttrsToList (n: v: "${v.config.hostEnv.ips.main.ip4} ${n}") nodes);
 
@@ -9,6 +17,7 @@
     secrets.gpgKeys = [
       ../../nixops/public_keys/Immae.pub
     ];
+    secrets.secretsVars = "/run/keys/vars.yml";
 
     services.openssh.enable = true;