From 11d5f9f0bb7265e7e46f984dc1f31f769242523a Mon Sep 17 00:00:00 2001 From: Ivan Malison Date: Tue, 22 Aug 2023 15:48:29 -0600 Subject: [PATCH] [NixOS] Set up agenix and auto import gpg key --- nixos/configuration.nix | 1 + nixos/keys.nix | 1 + nixos/secrets.nix | 21 +++++++++++++++++++++ nixos/secrets/gpg-keys.age | Bin 0 -> 5255 bytes nixos/secrets/secrets.nix | 5 +++++ 5 files changed, 28 insertions(+) create mode 100644 nixos/secrets.nix create mode 100644 nixos/secrets/gpg-keys.age create mode 100644 nixos/secrets/secrets.nix diff --git a/nixos/configuration.nix b/nixos/configuration.nix index 211fad54..4d9904e5 100644 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -16,6 +16,7 @@ ./nix.nix ./nixified.ai.nix ./options.nix + ./secrets.nix ./ssh.nix ./syncthing.nix ./users.nix diff --git a/nixos/keys.nix b/nixos/keys.nix index f27288ff..9ca7f632 100644 --- a/nixos/keys.nix +++ b/nixos/keys.nix @@ -7,6 +7,7 @@ rec { "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDt/rcYuGGlXBcRUJvzUCgOW8PNVkJJ5TwEOha1/KGM4 imalison@stevie-nixos" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICzGkqGJm+nrMvsrfuWOLVxXHvi0UL1ULJmyfzS9sKpy imalison@biskcomp" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJr9kVlYIZIPXfXom4Fi7S2yvp5sWJ6BSM5m3uLh+8y5 imalison@adele" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOFkA5JZkq8mRd7St0jP2P6WyYYhW2CChmQoY20N45f imalison@ryzen-shine" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIiZd2FiyTJvuvDh5hH0L3BqZV3E/kwwyau57QD7pz7C cardno:000614590850" # Dfinity Admin "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOEt0T+Hxxat5tbkD9mSu8T271QjRrLr2EA0rIDXUNL cardno:000614590748" # Dfinity Read-Only "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMCJ08qswd3OoApAIHQwojEUJ4sre89vSngbM3x5pBP2 imalison@jay-lenovo.local" # Kat's Lenovo Legion diff --git a/nixos/secrets.nix b/nixos/secrets.nix new file mode 100644 index 00000000..bc391b40 --- /dev/null +++ b/nixos/secrets.nix @@ -0,0 +1,21 @@ +{ inputs, pkgs, ... }: { + home-manager.users.imalison = ({ config, ... }: { + imports = [ inputs.agenix.homeManagerModules.default ]; + age.identityPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ]; + home.packages = [ + inputs.agenix.packages."${pkgs.system}".default + ]; + age.secrets.gpg-keys.file = ./secrets/gpg-keys.age; + + systemd.user.services.import-gpg-key = { + Unit = { + Description = "Import GPG private key"; + }; + Install.WantedBy = [ "default.target" ]; + Service = { + Type = "oneshot"; + ExecStart = "${pkgs.gnupg}/bin/gpg --batch --import /run/user/%U/agenix/gpg-keys"; + }; + }; + }); +} diff --git a/nixos/secrets/gpg-keys.age b/nixos/secrets/gpg-keys.age new file mode 100644 index 0000000000000000000000000000000000000000..fcf32d1cc24e6a4af3a906d71de52f4042774742 GIT binary patch literal 5255 zcmZvb`CAMM!@o&crmUr7E7Oiqvu}iEnx&a$-)AJ6eV=LenMfra*`TOP0A`FoT!z1GbL;%DfV!0>;Q@mZM)w5A%1lFRE(S=BZNot~+5qfbd#Rj)H ztrCw;s!~$eFp`WLPbN^sP>Bi5AQ%ArM4SyrVz6;K8XN?77|krGT#bWj?PLka%2l$d z930MyBC|~<6q3bDfzZG@L!yjl%t*$Mh?njR=A{Mi3NdnkQpu#%c`(@kOmeLX@z2#WPnUV5(%6LHIgG$G35|EhAQHi z!6b$mgBK=PonSqUl7c0g^h~J~#-ONDnGTN%qE*omESZRsh{pp=5)z3dF=@39CP62H z8SNw!S)}^k+6p-giG*T-ViLuafCCb(BoP^Iaj0FSRwklaq9&TYoRC2*!7g`6remZ`qLA{~9;3#LbLkuuB~Hi?LJ435SZ9+G`2a4|q-Sx#NJ|2i zW(K9;3>Jr0rAASNQU=%#gG)&^5}I$YBx0=ef75ha8O5anq7`m(s+r6rm^d`K&@R@y z6e&!U91B(n`BVp-1A}m=8k2ypBq9KI93hpjVUURe5ex}4^Y|ilyh})vVufUw5$r)3 z$xxWqAWIav{;OnyM+EgafiMjc<%WUv4zY=*AWJbK1rZG~DDiG5hsmT!2#iE1Ly;gb z!U#kF0Sz}%aZm%vWks3e6O?YWH6F>Lb1`Uvlx#3lutu|iC3HbKV*bC~{(nh>g+~%` zg+ex7BU2M-7P?-mrKK7?FtD4bN6Lg0G(%vKYG^Kq7$9_rv}^*}!W2ST3W^9yHy4reR4C;^&Bu*xNDS|Snz zrSLFF57y$+>DU$(1b~sj2vk>s5=s;qKwLi6MEuXLIz10Vq$Ge;P=r;bP7%5^CcW_g za6@YNIAAJ8B!uy#Vg!Wl)Mf({W%`5c1^fV1)v{__PY zKhc4pY87k&!=l!6@dP$Oz(VU~G^hy1M93g~3rzR#k`M(K3Bmz&NU%l$k*jG|ty~rl zC7_WB4x0gDVuN@rng}bxm=O$KJVXM95&=jvf|Ur@%JmM3#q6<=Xk>Ie-$*0UNJ=Pz zZgml03M~sIR~x9rf77sF1k2(Cia=TlNdkrQWE7Q72bT+Y3>!y51(C%GB!~v5M!}E* z4U8g2lAQn$PEAF~;A9?}NHqx69)t;FQ{b!?ib=t9)A@83%q}oUkYt=q{BN2Hr-Oso zKn=!eq%l=sg@9&5!;mID#K9*JFme*aWuYVNJOmz2BWQ35c%BTPL}1Az6OE{#A%tA3 z9?Ic*xF`l!oN+hLPG+LBE z2LO@qNUB8YBARp@I|q)Du|+bOnnouZU`B;b#^WMT@m8de;*|eCH+WhU$r-J(C{nBn zAbSZgi4II%0LKF9u=!Ls8(^eDU{rxxiKjSqN(K>$gUeIQo_IRSfRrLod>7Gf65?@g z1QB9o8HE;>+yNIGEm{uGjiNi`Pz?Ygu!#s{7cNDPz{*JK6cU)_LPMZr8Qh^w#K*@w z{`14=Xdr~o5cBXTcY+irr;|-AqF$n8+f=dyoB&3Kr^*FVBZi@~OAH(_pgSY0HKp_E zZN!|It0%@LX5f>=i{`f}oXsg?+mrYIey$;6f@@1LWj_aJtZVsM+0fLm^vB@`Z(j=M zg|xj6c;6E~rXldcWO$l(h>`VVsUV~W`M&qv%lz=Qt_`c#&Q8$XteU5& zJwrXexorJ3a4jrxa_Hzw%3FP{1#0e~7U^mqs2lTvJ#QnA!-XtPnCm&=xVlpmfSEJz za^!{p(Z3 zsOd+*GhZ%!d#0|16CAs@ZD-|aW)u0)&U-(eR|F+RGu3NgAxhvtLXzv+yqx`+M|0h! z5npdtZL{tNwxZ9KH zXch%}W8LkQXWqV)53SrDR=l$Bef)DiHSLrkdTnTQ-NES4(BrEa&%%h%`D)iCL1p}| z2`6&j?pf87ll>W*OuFc!AM4(DbK_uGyX%PWAK{zRS;K*4?uY72=h;un19soFF`nGk zbsP#jTs<{?!iZnUw8>-g=U-#o>AkZl>=hWF|s`@WLkM!YQN7OEe3f`Ng6bLk{22ZR8^@te z6gQk;?QYySYTnh?XL768u+fT z`Su$t=Eq{Mx}z4YjQSfj;@_@Z^@BGZ`|ZrY%QfA@$)2h@+MzqUUVTch;eGszn`KjN z&Hxvzd3mIJr*9;lVBNR&gm>~k8_E7Rp)ICGU!V)VWPD8$-}*kwbU5+C%Sn!DQI~%% zzWSt{oKf-Y)~ARp;IAS5ytBMa{DPw$tLc}zjU1_v-+$>^+WEyFe(IO`y+DdhlFs%+ z^q^0b>sBqVFLA8@r?TlIJv3=+DHMO|U`WF&Q{QO+)#)YhJ70V<`j5fvF#Sv86zD7Nwo%6oN zzF*#WV14+XFTA_Uxj%?GS-^h4j32|cA04BTn)hVpeh)qaj!jN_ydp5VaN8r^u}3!( zo__(D*48f>+eaT>Ui`!QxP)BYkvVbP*-3ri zuqA|m?cwt~KD_!|S|JXI&ihss92mB>w(icPfC-Fc->91S@!>65Sn?=~AD123>^Bcl zQ(?K7Mv4f|UHm#1rdq$L_V%v!MSqC%h&Ns#Is(GC86Pg%208ZP;W$XpfzBNtuXr`0 zfqlnrnKFdk`v#B2G>{s9d~=@rFu}}8pKet)?cE9S2b^)p8-I4spXn2~us`rJRl<3Z zuxV+BGw%zo4(}J)RrqIES)30MC0;WN zs;;!RZjcuC%?_xWdwNuZfzAY0>@#UrMTb*2LC~`r``Re;oSFQJUA|h_|{(#3#-`{OImg{z;wM>ED(I>s%Ci9IS8+W&MEUC1?e@EBO-KUim zQF|-jJ349JJ8CZ+rtGinNLxjezdj6jSx~9yp8tU2tVp2%uH=-}cm7jst`9_!|zV!Hz-zk5-4=1^)(aVh0Iyynl-`v`ZAS6y!+ zryOs;Z~wXFzIP_MV#t6gl&iijUAQ0sb>t}SO_KQ7#~pulu2q)wIBTfDzDHNx2UFkO)sxGaij9?psR;J zQ1W)&;J}zDBC;iuXxq7L-P|$w#V06*#{`r3B2RJDrZvA>FJ_efZC94RAss%8sQtKN z?oi&v^;w>SBA{L{*BOggmuD@%D)O9Juq4&5cdGY24dK-%zw-`8ptvd25WEVc znY5|Bb#qqwMEH!|bMiIizsM`kdMvFYt0Q4uGt}MlWZw;Ua?i{xw+oGBo1bwP_DtZZ zis8{k&0lf{a@K7q@%9?TjL9pgpB?x94XesKD*DRc!MnxZ8ylT{H$QbiWXpeconDmy zO+A{(3D0Faw&-p1BhcU<~*IY#p8{Kj6R_uGs~nWbU^Y&B$g-d%Wc zcYFQ8IjH24Dc2|Z3vyF^f2$gq__;qEu>W(j>>>SQin@hVcL30y49i?@K3ennTg1CK zZybdDF@x~l#wBDAnXt&3Thnw2m zVSu9jRB~rxrxLE~**LhuyMG~hh9GWc<-j_G;q3X6Q%7%juQiVfS|ipC7Zlc4hjA+> z{hbR4Ss!w6ynFQucJscarZ~u`nWux;rH017?HT*iEGkvU*v7kt&L->xFHo^hf!)6K zR(a5>tr3r-mn;PLpBR~%VJ$qGp0^ex12U>&g5q}9R6oxhS-6y8-4-$lk|=E`xm**| zT|DI$Gp1M8r4`l*>WcCUftP-}2ar;X<6|+~6y#gX%mR-Nu@6xZ%qDbY%a#!LD8NyW?2-+2jmdTd^dl5--gzSl6Y5Eo=!ZiSyrk&fBtn z>PFb;Y_C(6+sBr?NUyvcG-M5?ra-Kd6j{Eg$2zjb{~LDT{7lkZUz-`r&0Rh+bMe$` zmy0+F&76v9ja?7xN^%#z9F2z5uL^E?x3UD896&65Hq|uPJG#rKXu`W;+K=Ej?E>G& zXJ0;TY#9ByF@Dpg7to0CU)v}(UmmZom=${qTj5)Da<4|U4>D%s;)Bzx za2@yPm+jVV?-RqWf6PnIETo4zf}1R>YGE&A7~>_{Ut2;^QxI2`sPLE*PVS@s0hRFC Ab^rhX literal 0 HcmV?d00001 diff --git a/nixos/secrets/secrets.nix b/nixos/secrets/secrets.nix new file mode 100644 index 00000000..fc7386c0 --- /dev/null +++ b/nixos/secrets/secrets.nix @@ -0,0 +1,5 @@ +let keys = (import ../keys.nix); +in +{ + "gpg-keys.age".publicKeys = keys.kanivanKeys; +}