From b6c88b47d958ac41f7a7d708d3f4d96f2a4a37c3 Mon Sep 17 00:00:00 2001 From: Tibo De Peuter Date: Sat, 4 Oct 2025 17:38:21 +0200 Subject: [PATCH] [sops] Add Tibo-NixTop key --- nixos/.sops.yaml | 11 +++-------- nixos/modules/programs/sops/default.nix | 4 ++-- nixos/secrets/HomeLab.yaml | 24 ++++++++++++++---------- nixos/secrets/UGent.yaml | 24 ++++++++++++++---------- nixos/secrets/personal.yaml | 24 ++++++++++++++---------- nixos/secrets/secrets.yaml | 24 ++++++++++++++---------- 6 files changed, 61 insertions(+), 50 deletions(-) diff --git a/nixos/.sops.yaml b/nixos/.sops.yaml index 5380b68..1e89a07 100644 --- a/nixos/.sops.yaml +++ b/nixos/.sops.yaml @@ -1,16 +1,11 @@ keys: - &tdpeuter age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y - - &tdpeuter_gpg 08a9c1c8cf9159c9172aba129b11f5243089db5b - - - &server_H4G0 age1d4gvqz3anf082ja6xt03hnkzazfum80um9t45m4rerl4n3va2yuqgnsg03 + - &Tibo-NixTop age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37 creation_rules: - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ key_groups: - - pgp: - - *tdpeuter_gpg - age: + - age: - *tdpeuter - - - *server_H4G0 + - *Tibo-NixTop diff --git a/nixos/modules/programs/sops/default.nix b/nixos/modules/programs/sops/default.nix index 443eac9..c18f0fc 100644 --- a/nixos/modules/programs/sops/default.nix +++ b/nixos/modules/programs/sops/default.nix @@ -14,8 +14,8 @@ in { # Add secrets.yml to the Nix Store. defaultSopsFile = ../../../secrets/secrets.yaml; age = { - # Automatically import SSH keys as age keys. - sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + # Don't derive age keys from SSH keys. + sshKeyPaths = [ ]; # Use an age key that is expected to already be in the filesystem. # You will need to place this file manually. keyFile = "/var/lib/sops-nix/key.txt"; diff --git a/nixos/secrets/HomeLab.yaml b/nixos/secrets/HomeLab.yaml index f749611..dbd385b 100644 --- a/nixos/secrets/HomeLab.yaml +++ b/nixos/secrets/HomeLab.yaml @@ -6,22 +6,26 @@ HomeLab: Nextcloud: ssh: ENC[AES256_GCM,data:aVqa57u9hIOquP367EDj2rlyQWRe3EZv8l5cC+yQQKCri2bN5IFSq8qNemOIcU9ycBnxIyK6gLerJYQQcgzIIARmnfDpbJ9w+EeUL5yvPVJN6FM7oBeaL9mzYRl8aDKr22LhL9YiKAT1nKHESmTb3TZRvuvWJTGzCMRV85ROGxZYVUgG6BjuHEzuTsc4fy3NVPIl7/4ZjPgNNYx+UNsV5xwTejveB/sGblVrHOO74LZXzUWRlQNun5nM3MY3GALzfrPrVIAyGNu37CGachtwxaPOj7vUKZmD/e+XajYVKRJ3v33jrUeI0dDmhuwJj3taoFik6suAyiK3RlDdeWoERR8vqduiyxJnVMs6mNkigzkVtifpwZyQ8vNyG7w1JNPygMYgQzjN43lGVml8cx1lZvcoBzQabjWxcNzhV8gXxoGKvAwUV7ELB6l00rUH+EeI0uU8/IFm9kwmZq42ciM/bRGSGXzo2PYG2OHOiDe5b0nrIlajaRKd+vuuzTtFFU9EwH0GPzERRaoxVK+h9tzcco/REITCE+CVlHSx,iv:bb1X95HK5tT7EJpqqgMOUxw5VO5MuzoYxkPIzR5sEqU=,tag:y2LKHm7czwyuHp7Ea8KiYw==,type:str] sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] age: - recipient: age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWWFUdnpERVlkK29TQ09k - SnJMVm5rUEV6S0huSzJ2YjFFQ3pNR0pmZWprClZEVDloeDE2ODNkMVVJTUtqaENz - ZzhwTTA4V2xOeW55WGtPZU5FWElQNDAKLS0tIFh5ZWtmZHRBWTAvM3ZwY3pKQ0R6 - aDNUbFlhWWVoOWpjVlV1VTVJejlSMjQK6wCeCRdHY5oyTX6/R1U5AOGJyp0exi1A - dWPUMfkKBBBkrR+G6ougd8o3FwFf+yfb5RhaTxxqjit6p2RyMjR64w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlL05vZHk2T1B6OHArUXlj + bEZWV0dUeVN0M3ZpeHdKcGlKV1RWYmRLM0FjCm9PLzBZTFo3RjhZTEhYMDBSN2Nj + aithQ2hpZXVCSngxcVBvQ2hKRzFXUEEKLS0tIE5rL0NHb1llRmlSQXVUeU8rVmNY + aEZHdDFEWUdxMzRVVjFhQWZmS04wRkkKrD2CiwdNcbK9s64omQ7xSA29J48HwIHa + ickyL/uorYhXmBKhqdvNq/j1Nb88LR9ti55Z7eecJNbyJb4OTtgzXQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBOWNXQ1BsekdoS3BCdHA4 + YTJJRHJBTEJ1bmhkWktSamYyRk1TUmovZ2trCnBXbUZQZFBndmU3VzJHVjczZGtY + ZkJDY3RzSEhXQVlLL0g1QTYxSC9CZGMKLS0tIGFBZnNlWmZjZFdkdGZvaHA5ZjMw + NFRtOFIybnFPWm1idFY0WEVqVGxOK1UKiJDByqKv/i/l9dvOplDyzDORU3ulhSwi + 6xyEqmyNQpIkiS6TLZZYrBlQMDYqZ2gj1HhdIUssWJCf5Ho8KVDjJQ== -----END AGE ENCRYPTED FILE----- lastmodified: "2024-10-20T07:58:57Z" mac: ENC[AES256_GCM,data:mmFgjE7rp7fXmPOnETGamHR3kUAguFCNNTQcEnD+uM4xeSp3QcB2g8tkKYaJAjkWWqKRSm9/Iu1NWOr9GWyu4O1h7ppWSvpKawWki6cHpqBl8JOwbx/SZi5bzU1lBtoJyT6hD1aCu9ENOMUkpPY3rKcYwbsRMJpKYsbXymPikcQ=,iv:kPB6ds8c4yc/w7Ny1d3DTyztQF4yTr0NyKgIHEzIKAg=,tag:VTpXRb5HaWDjVB52K7mByw==,type:str] - pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/nixos/secrets/UGent.yaml b/nixos/secrets/UGent.yaml index 5eb38a0..5e55b6d 100644 --- a/nixos/secrets/UGent.yaml +++ b/nixos/secrets/UGent.yaml @@ -7,22 +7,26 @@ UGent: ssh: ENC[AES256_GCM,data:hJAle4DHJNvX569reclBG5rEdWsjAyV2TtHYMiPfky/dMKJkYgT4+T0doLfUn1O6at77kJGPmwUEvmK819DUuvHtNY7c6angV7iLygJ/ThI1FIFOKH+NxEsI3scoT0VDDybHpgice/fcJL1tMcvE74+dWOnZ2r4pxcMJEFHUPVVWcl9/stJLn78OonsyWpj8PglcnYFOfZ6THIe3lyNBxRp7XEweuwjacthGzOzNu3Z95zcCAnAokFVZ570glJNhjJVNEmPHZkHOcGiGNNM4JNbR11v+dOYtac942t/mmmWwAzbznuu8ZLupYWjdg/f07ftkPAwFwCoXblZ3708Lvf6uOt/CPeWvEII2Haf1Cr5w+U6TAt14zzL73xCSQqwz1TfkcmD+bJplmtcpSP/KX8/BRK7qr6Ec5T9ecbraRB7zDBg0X2x51DSHLrA7UIhpI9JNaOArU5UOVYTWwuzFiGG61elJMcPZ5vWEVrTCocfa4INPo4B2MkFbbsYf6xnY1L3Wc9LQjkff6aCqYnQaXZ/WfPWepf9YvYG1,iv:0Bm1r0FuJJKKmcbTiPL36rb5FaMZfOO7Mx8pXU2FSfg=,tag:0ShoJPJUx37mEAus+mhPmw==,type:str] Dwengo: ENC[AES256_GCM,data:3lsZJ5ztkGOfHFQNr54xs9evSTEAs9XHJhg6Krvz3fkT8CaGSiRW5HTCfANGhQ3wJ8kHVziwopQCJ8s93gaipAuEu5k/hYj5wYhOn6x8oDJxftMJC94JDL4eYGIXbx9GSPIy+loftfYIZcfmi6o1lQdiqRdC207Cs+p0ZTB7JSvales16IpgYKoTCRLUytd9cBrezD9gVEngW1b4wHGzai4OOTSunlOVVAgapAKsN+swN7QtMt00607Ns6gCoQDV76qAbM+6EN8PlIKwbyy9UneeTXOf0wtQpb2TM1zrVR7LOqNyXT+DUlrBLpOpYK8tPCP8y5m9DMLixrhbAXMT6pIp2XSbmcfcsuMGLJE2ev/c6PxmbjqiCGEYPC3HdAgUpNDtOMixnHEoXnMUPDJeE0MXbSFMRmzNGo7pc5gOoCFmCkV9NVQXERR6m04Bn3czRQVHfoVIc4ciPdiXpOqF8ocTnqZj7HRW8dvZz9V50ViHwOVqWLJ2a/QUMdagXlaK7zPrxPETKz47iMoMfVaUE8ePg2L5sEZHja62,iv:s/+JYSkZudTr4MnTclpNV7i5VGUlqFhdvovcFt+inSQ=,tag:4Ge0ZOc6qNObQrzS0K0WDA==,type:str] sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] age: - recipient: age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWWFUdnpERVlkK29TQ09k - SnJMVm5rUEV6S0huSzJ2YjFFQ3pNR0pmZWprClZEVDloeDE2ODNkMVVJTUtqaENz - ZzhwTTA4V2xOeW55WGtPZU5FWElQNDAKLS0tIFh5ZWtmZHRBWTAvM3ZwY3pKQ0R6 - aDNUbFlhWWVoOWpjVlV1VTVJejlSMjQK6wCeCRdHY5oyTX6/R1U5AOGJyp0exi1A - dWPUMfkKBBBkrR+G6ougd8o3FwFf+yfb5RhaTxxqjit6p2RyMjR64w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpb0dlWE5PNllnME1jQWE4 + cHFzWkR4ZzNaWlR0WDJ4c1hEdlJGN0FISWlZCmNNdVRtL080QzgwQTZtTGpVRkxW + dkdvYXdQNUlhYWQrYlNDR2JISXdpdkkKLS0tIEpIU20rK3F3WGpBS1g3NmJqYWRX + SWlNbFZ0NTJJZ09Wd3JzK1hscjJoS2MK4GU8ndim80CaOjgvMwVlgIq/1VQIylSZ + EJl15zUFaDiDZUCcZE8TkJQ/rbGDSiq7KlWyFe48Q3UC86jfF88qCg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYNjkzeHloK3hKUTJaMTdr + NUdiZ2JGZitqN1k0WCtEODU4R2MrTmUzR1hrCmNJL0Y4ZEpLN0l6ZmhGWEM5UktG + ck1PUnFSSVNCRUd5Sm9kSXNmVW5jZDQKLS0tIHpHWVBVNFNBSlUvZldJVGowUEtZ + S05HZ0FiSVlkUjRRV01TbjlpVFlkQWcK7jAqOYd9EDT93xpVgtpKl03EO6oHmGRR + iK9j2y7j1YSghPKDBrC5eKy9+IP/EFEBGygcokqT7C6Nscu80YhVbg== -----END AGE ENCRYPTED FILE----- lastmodified: "2025-02-21T19:36:01Z" mac: ENC[AES256_GCM,data:NMxbxf7/UwR9akbbLgKeSLIkk+dS/an2pGzZUSbe1AJenCVFO/fiRCC5BF6xJVpFSpag/dLwo/tS64JmJ36Vqn2sQGmqn26HPXsjAgyUdpp3+anXIVOGvNHF3oCM8gEUk9+W2FsOqKuejpD7HK/IsVJEZZLbThkUS1BiptOWk84=,iv:xNBBjWADFF5itg45KnmNbZG5RN0KRpaph7iMGhf1KZg=,tag:FrDSAbvo/7QHH0g5Ik8ATw==,type:str] - pgp: [] unencrypted_suffix: _unencrypted version: 3.9.2 diff --git a/nixos/secrets/personal.yaml b/nixos/secrets/personal.yaml index 1e520ab..8a60040 100644 --- a/nixos/secrets/personal.yaml +++ b/nixos/secrets/personal.yaml @@ -3,22 +3,26 @@ GitHub: Gitea: ssh: ENC[AES256_GCM,data:8eyuycMkBVMHfzaGeGs+0RA4vCpaAUTjCwiplUamypEk9BDYqxe+69O6OjJAGaPnmH4kpsb/WVd5sU6HNUogBuzDQhCrv2B6NadcmnV+fH3MHfAWvDy7R68PUkwcywWVOo65SONckjKVa0Y+8IeeJh9zpr36qCbbs+zPC4XTk+Y5R4vK/ocmSJSmwqVK1SfGGwOjFoJvHVI6jdXh//vgKaITqmyZV7N3OU9EiQp1FmNKwFf/x70w2LGATrNBcexwNy20ZYd6ewiAfJxFHR6Svfc2P5X2nlv99W5t1eU5QEGUcalcslsW/VkmFC3agN3Yry2EMIlfTlm0hm4+ryDGWEvgyUC0dLA8Ao0TLaaqig9HzBRP1h6aORe0lDwzTUg6WltrIu0s7hFwD4YLi1qP5lY99hvrDIRbTEg6AY6X4b32YFlyOXy0YDetv90+QyEcwANWO9MXz2S9hxuQmjOXMCVYMaiMLVUkG+mShbQuxTiFQt/7D83yOBSRLugx/aU318NKvUDlCt7wpZbMI3gBia4nUYLoLcXRKcAZ,iv:uc1ZtGdcolLrpQgS5n5LEAwBt0vMmkj2OuTXcn8sQ7A=,tag:F2ofcj0zEBgxwukMUd7+uw==,type:str] sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] age: - recipient: age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWWFUdnpERVlkK29TQ09k - SnJMVm5rUEV6S0huSzJ2YjFFQ3pNR0pmZWprClZEVDloeDE2ODNkMVVJTUtqaENz - ZzhwTTA4V2xOeW55WGtPZU5FWElQNDAKLS0tIFh5ZWtmZHRBWTAvM3ZwY3pKQ0R6 - aDNUbFlhWWVoOWpjVlV1VTVJejlSMjQK6wCeCRdHY5oyTX6/R1U5AOGJyp0exi1A - dWPUMfkKBBBkrR+G6ougd8o3FwFf+yfb5RhaTxxqjit6p2RyMjR64w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwSDRZQ0pVNWhmdFo1UDVv + MFlrZEFtNjlpZ3pBU0VrdkFpR2x4WGxUZ0RRClJad1JPYWhFTWd1N2ZKQWsrSjFj + YXREaGRrbE15MEdpblJtcTk2cFk1eGsKLS0tIHE2ZTd3R1gwQ3E1VzkvZTZoZjBW + aTRLcFJ6NkpJRjkyenVxeFRLVmgwMjQK47HRKyg1SxWABZHCdVdIaPEKoSiWIOO/ + OYu/1owbUwTh1KouUb4tgNmVBOkERJ9i3lEjWLHUWrlCAUImc9dG4g== + -----END AGE ENCRYPTED FILE----- + - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBVDZtU2g4dmFXTlNIMFBs + OFBpS2RXRzFwTVdJazQrSldwWUFtdCs0U1ZFCmxRdy9yY3VIWU4zenc4eVNEVUZv + VUlyT29JekNTS3RIMktmS2RGNU5GMTgKLS0tIEhvM2RkcUs0SE5uSXFxc3dvSXhP + WmViM05IMHFPckNic1hHY2ZlTEMrYkkK+66rYqbGQucqQch4Tx9jONR9OIXdjMUd + q/fGLCoSluHuCOkUWr/wUgvF5dWAHftYj9JjDB/9vpp4Q0WClLDszw== -----END AGE ENCRYPTED FILE----- lastmodified: "2024-10-19T12:24:38Z" mac: ENC[AES256_GCM,data:g15gV0H0rlzoeN5Z/Zkgh/8ya9GSrWDVP9oqdVz3m4obmquCLDIygsPaYpRXmfOtPSgvX2KzZ08sNLfcBZSh7eH2Ws7xcezWOntOcmAQNz5LvemqP7YuwtivMK/P4qrkME+LQPkSrSUR+rT99Zj+RQXisy91Cq9NbVBj6uQH7+I=,iv:W+oDp5Dun0g35BFprOmgfI0LoPME3HpPuuniCKA32Kc=,tag:CUU74HZuRNedyI3txn9D+g==,type:str] - pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/nixos/secrets/secrets.yaml b/nixos/secrets/secrets.yaml index 6c8e2ac..b5bf68e 100644 --- a/nixos/secrets/secrets.yaml +++ b/nixos/secrets/secrets.yaml @@ -9,22 +9,26 @@ example_booleans: - ENC[AES256_GCM,data:Ul7fKA==,iv:U51FhTsWwkbhUWGsO8D+bl2mLdTIfapIB+OGJEOAiRA=,tag:9NJLKp8s2TSKLyXwM8OncA==,type:bool] - ENC[AES256_GCM,data:LVU1a90=,iv:1X1qV+8iIe1i5hIrqyB3tJew9hsHjJHlATmkEmwRA0Y=,tag:ko/5OwmJH/6HKPsvbkoRpw==,type:bool] sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] age: - recipient: age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ekx1bzluY0ZhYmhnRmhW - b3pzM2RlKzFrREpMK3RNU1MweldNRXJ5NjE4CmNRbnFvbk1EN0V0ZWJiVzFmL3Jt - N1Vpb3NEdXFzdzU4MjN1elp1RWZ5THcKLS0tIDR4cTFJNVFveEdxaEYvZndKbURa - UHpaNENhL3c1K3RXc05hUmdNZVBpT2MKwBj4+Gb7giVJIoPWiwY3tvugEAexXy6Q - YTWgZQZk96r5aF2mBjRCFCc7prj85PsUN/UXOPjPLVAFG3lwS0Eaog== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4KzMrV2dpWFQyQUQyV050 + elVhN0dUeTRodG1kNHZ0VEVmTUI1QjhidFJnClhJU0tVY0tmMkFaMDZkMDJOKzV1 + NVJiSERtR0VZR3VBOGVJbGk3cUxTMzAKLS0tIGhvMmIyOWQwVlhXRzYwampTeG5V + UDVWQnE4NDY5cFF3RnpxcjhMY2N0VUUK+B24C0CT5b82DJSdKotX4iPhzWxnYsn6 + kS7Ut9uy5OwcB+p6erlbLMEUVmmSNw89KBrowT0Ui1d3AfyGAN4rqQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwTjh4NDRYZGM1VHRZWGor + MmhFWDNvMjI4UUVPbnorNnpabGNZY1BuMVdrCisvZ0U5SXRPM3IzNlZvZEpWZktz + b2FJemtNVHU0WUI4M0U1L2tWR3g1MEUKLS0tIGczTmVubzcwVjg5NDdQdEllWEFw + TWRIRE5WSGRCbncvWlpEMmdWOW5kb00Kq79O2C4aYmZmrq+rbyMtwmEqkqL9epn/ + pw2dxXmYt95qu3x/BxjoN8RFZhabFp9xHkZ1kqJe9FGmBtAmoWXjWA== -----END AGE ENCRYPTED FILE----- lastmodified: "2023-09-10T20:20:18Z" mac: ENC[AES256_GCM,data:yfmYEo8pdlG3tu4Fabwde57igIvpt4UuhQqStVlV36rvPnv9dc42+6iduu+heuQ2OAVw0jk6/o6SWJpcms2DReOAMGDOgt+zV3TgJym52YdMcjTNJTo+4loULhvaWyN9ZdPJjSYKEoSgOZi+oMx4BpwreQEaPaYUxcbTqrWCUa8=,iv:Mb81sBxibRxSaC2kgakhy2pyEmW0MDobF+lHF7cny5E=,tag:DCqTWSnf5Gv5YfAGSEC2yw==,type:str] - pgp: [] unencrypted_suffix: _unencrypted version: 3.7.3