diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2021-10-07 15:17:30 +0200 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2021-10-13 00:00:55 +0200 |
commit | 282c67a117b7d349b30a96972b050d630f906dec (patch) | |
tree | 6686bdc126d5c0bd548cd6286a41be5c8cfdc01f /modules/private/system | |
parent | 97f5a24bc8839328571b23eb5f910de206ddbe1f (diff) | |
download | Nix-282c67a117b7d349b30a96972b050d630f906dec.tar.gz Nix-282c67a117b7d349b30a96972b050d630f906dec.tar.zst Nix-282c67a117b7d349b30a96972b050d630f906dec.zip |
Refactor secrets handling
Diffstat (limited to 'modules/private/system')
-rw-r--r-- | modules/private/system/backup-2.nix | 5 | ||||
-rw-r--r-- | modules/private/system/dilion.nix | 11 | ||||
-rw-r--r-- | modules/private/system/eldiron.nix | 5 | ||||
-rw-r--r-- | modules/private/system/monitoring-1.nix | 5 | ||||
-rw-r--r-- | modules/private/system/quatresaisons.nix | 5 |
5 files changed, 18 insertions, 13 deletions
diff --git a/modules/private/system/backup-2.nix b/modules/private/system/backup-2.nix index d1064c7..1f226c0 100644 --- a/modules/private/system/backup-2.nix +++ b/modules/private/system/backup-2.nix | |||
@@ -1,4 +1,3 @@ | |||
1 | { privateFiles }: | ||
2 | { config, pkgs, resources, name, ... }: | 1 | { config, pkgs, resources, name, ... }: |
3 | { | 2 | { |
4 | deployment = { | 3 | deployment = { |
@@ -6,8 +5,10 @@ | |||
6 | targetHost = config.hostEnv.ips.main.ip4; | 5 | targetHost = config.hostEnv.ips.main.ip4; |
7 | substituteOnDestination = true; | 6 | substituteOnDestination = true; |
8 | }; | 7 | }; |
8 | # ssh-keyscan backup-2 | nix-shell -p ssh-to-age --run ssh-to-age | ||
9 | secrets.ageKeys = [ "age1kk3nr27qu42j28mcfdag5lhq0zu2pky7gfanvne8l4z2ctevjpgskmw0sr" ]; | ||
9 | boot.kernelPackages = pkgs.linuxPackages_latest; | 10 | boot.kernelPackages = pkgs.linuxPackages_latest; |
10 | myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; }; | 11 | myEnv = import ../../../nixops/secrets/environment.nix; |
11 | 12 | ||
12 | imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ] ++ builtins.attrValues (import ../..); | 13 | imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ] ++ builtins.attrValues (import ../..); |
13 | 14 | ||
diff --git a/modules/private/system/dilion.nix b/modules/private/system/dilion.nix index a59d607..b9be8b0 100644 --- a/modules/private/system/dilion.nix +++ b/modules/private/system/dilion.nix | |||
@@ -1,4 +1,3 @@ | |||
1 | { privateFiles }: | ||
2 | { config, pkgs, name, lib, ... }: | 1 | { config, pkgs, name, lib, ... }: |
3 | { | 2 | { |
4 | deployment = { | 3 | deployment = { |
@@ -6,6 +5,8 @@ | |||
6 | targetHost = config.hostEnv.ips.main.ip4; | 5 | targetHost = config.hostEnv.ips.main.ip4; |
7 | substituteOnDestination = true; | 6 | substituteOnDestination = true; |
8 | }; | 7 | }; |
8 | # ssh-keyscan dilion | nix-shell -p ssh-to-age --run ssh-to-age | ||
9 | secrets.ageKeys = [ "age1x49n6qa0arkdpq8530s7umgm0gqkq90exv4jep97q30rfnzknpaqate06a" ]; | ||
9 | nixpkgs.system = lib.mkOverride 900 "x86_64-linux"; | 10 | nixpkgs.system = lib.mkOverride 900 "x86_64-linux"; |
10 | boot = { | 11 | boot = { |
11 | loader = { | 12 | loader = { |
@@ -31,7 +32,7 @@ | |||
31 | powerManagement.cpuFreqGovernor = "powersave"; | 32 | powerManagement.cpuFreqGovernor = "powersave"; |
32 | hardware.enableRedistributableFirmware = true; | 33 | hardware.enableRedistributableFirmware = true; |
33 | 34 | ||
34 | myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; }; | 35 | myEnv = import ../../../nixops/secrets/environment.nix; |
35 | 36 | ||
36 | swapDevices = [ { label = "swap"; } ]; | 37 | swapDevices = [ { label = "swap"; } ]; |
37 | fileSystems = { | 38 | fileSystems = { |
@@ -88,10 +89,10 @@ | |||
88 | isSystemUser = true; | 89 | isSystemUser = true; |
89 | group = "libvirtd"; | 90 | group = "libvirtd"; |
90 | packages = [ pkgs.netcat-openbsd ]; | 91 | packages = [ pkgs.netcat-openbsd ]; |
91 | openssh.authorizedKeys.keyFiles = [ | 92 | openssh.authorizedKeys.keys = [ |
92 | "${privateFiles}/buildbot_ssh_key.pub" | 93 | config.myEnv.buildbot.ssh_key.public |
94 | config.myEnv.sshd.rootKeys.ismael_flony | ||
93 | ]; | 95 | ]; |
94 | openssh.authorizedKeys.keys = [ config.myEnv.sshd.rootKeys.ismael_flony ]; | ||
95 | }; | 96 | }; |
96 | 97 | ||
97 | users.users.backup = { | 98 | users.users.backup = { |
diff --git a/modules/private/system/eldiron.nix b/modules/private/system/eldiron.nix index 4fb18a0..6c570c8 100644 --- a/modules/private/system/eldiron.nix +++ b/modules/private/system/eldiron.nix | |||
@@ -1,4 +1,3 @@ | |||
1 | { privateFiles }: | ||
2 | { config, pkgs, lib, ... }: | 1 | { config, pkgs, lib, ... }: |
3 | { | 2 | { |
4 | deployment = { | 3 | deployment = { |
@@ -6,6 +5,8 @@ | |||
6 | targetHost = config.hostEnv.ips.main.ip4; | 5 | targetHost = config.hostEnv.ips.main.ip4; |
7 | substituteOnDestination = true; | 6 | substituteOnDestination = true; |
8 | }; | 7 | }; |
8 | # ssh-keyscan eldiron | nix-shell -p ssh-to-age --run ssh-to-age | ||
9 | secrets.ageKeys = [ "age1dxr5lhvtnjssfaqpnf6qx80h8gfwkxg3tdf35m6n9wljmk7wadfs3kmahj" ]; | ||
9 | boot = { | 10 | boot = { |
10 | kernelModules = [ "kvm-intel" ]; | 11 | kernelModules = [ "kvm-intel" ]; |
11 | blacklistedKernelModules = [ "nvidiafb" ]; | 12 | blacklistedKernelModules = [ "nvidiafb" ]; |
@@ -28,7 +29,7 @@ | |||
28 | ''; | 29 | ''; |
29 | nix.maxJobs = 8; | 30 | nix.maxJobs = 8; |
30 | powerManagement.cpuFreqGovernor = "powersave"; | 31 | powerManagement.cpuFreqGovernor = "powersave"; |
31 | myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; }; | 32 | myEnv = import ../../../nixops/secrets/environment.nix; |
32 | 33 | ||
33 | fileSystems = { | 34 | fileSystems = { |
34 | # pools: | 35 | # pools: |
diff --git a/modules/private/system/monitoring-1.nix b/modules/private/system/monitoring-1.nix index 2198d09..e335080 100644 --- a/modules/private/system/monitoring-1.nix +++ b/modules/private/system/monitoring-1.nix | |||
@@ -1,4 +1,3 @@ | |||
1 | { privateFiles }: | ||
2 | { config, pkgs, resources, ... }: | 1 | { config, pkgs, resources, ... }: |
3 | { | 2 | { |
4 | deployment = { | 3 | deployment = { |
@@ -6,8 +5,10 @@ | |||
6 | targetHost = config.hostEnv.ips.main.ip4; | 5 | targetHost = config.hostEnv.ips.main.ip4; |
7 | substituteOnDestination = true; | 6 | substituteOnDestination = true; |
8 | }; | 7 | }; |
8 | # ssh-keyscan monitoring-1 | nix-shell -p ssh-to-age --run ssh-to-age | ||
9 | secrets.ageKeys = [ "age1dn4lzhgxusqrpjjnzm7w8ml39ptf326htuzmpqdqs2gg3wq7cqzqxuvx8k" ]; | ||
9 | boot.kernelPackages = pkgs.linuxPackages_latest; | 10 | boot.kernelPackages = pkgs.linuxPackages_latest; |
10 | myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; }; | 11 | myEnv = import ../../../nixops/secrets/environment.nix; |
11 | 12 | ||
12 | imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ] ++ builtins.attrValues (import ../..); | 13 | imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ] ++ builtins.attrValues (import ../..); |
13 | 14 | ||
diff --git a/modules/private/system/quatresaisons.nix b/modules/private/system/quatresaisons.nix index 03446e7..0148650 100644 --- a/modules/private/system/quatresaisons.nix +++ b/modules/private/system/quatresaisons.nix | |||
@@ -1,4 +1,3 @@ | |||
1 | { privateFiles }: | ||
2 | { config, pkgs, lib, ... }: | 1 | { config, pkgs, lib, ... }: |
3 | let | 2 | let |
4 | serverSpecificConfig = config.myEnv.serverSpecific.quatresaisons; | 3 | serverSpecificConfig = config.myEnv.serverSpecific.quatresaisons; |
@@ -164,6 +163,8 @@ in | |||
164 | targetHost = config.hostEnv.ips.main.ip4; | 163 | targetHost = config.hostEnv.ips.main.ip4; |
165 | substituteOnDestination = true; | 164 | substituteOnDestination = true; |
166 | }; | 165 | }; |
166 | # ssh-keyscan quatresaison | nix-shell -p ssh-to-age --run ssh-to-age | ||
167 | secrets.ageKeys = [ "age1yz8u6xvh2fltvyp96ep8crce3qx4tuceyhun6pwddfe0uvcrkarscxl7e7" ]; | ||
167 | 168 | ||
168 | programs.ssh.package = pkgs.openssh.overrideAttrs(old: { | 169 | programs.ssh.package = pkgs.openssh.overrideAttrs(old: { |
169 | PATH_PASSWD_PROG = "/run/wrappers/bin/passwd"; | 170 | PATH_PASSWD_PROG = "/run/wrappers/bin/passwd"; |
@@ -173,7 +174,7 @@ in | |||
173 | imports = builtins.attrValues (import ../..) ++ | 174 | imports = builtins.attrValues (import ../..) ++ |
174 | [ ./quatresaisons/nextcloud.nix ./quatresaisons/databases.nix ]; | 175 | [ ./quatresaisons/nextcloud.nix ./quatresaisons/databases.nix ]; |
175 | 176 | ||
176 | myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; }; | 177 | myEnv = import ../../../nixops/secrets/environment.nix; |
177 | 178 | ||
178 | fileSystems = { | 179 | fileSystems = { |
179 | "/" = { device = "/dev/disk/by-uuid/865931b4-c5cc-439f-8e42-8072c7a30634"; fsType = "ext4"; }; | 180 | "/" = { device = "/dev/disk/by-uuid/865931b4-c5cc-439f-8e42-8072c7a30634"; fsType = "ext4"; }; |