nixos/.sops.yaml

@@ -1,16 +1,11 @@
 keys:
   - &tdpeuter age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y
-  - &tdpeuter_gpg 08a9c1c8cf9159c9172aba129b11f5243089db5b
+  - &Tibo-NixTop age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37
-
-  - &server_H4G0 age1d4gvqz3anf082ja6xt03hnkzazfum80um9t45m4rerl4n3va2yuqgnsg03
 
 creation_rules:
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
-    - pgp:
+    - age:
-      - *tdpeuter_gpg
-      age:
       - *tdpeuter
-
+      - *Tibo-NixTop
-      - *server_H4G0
 

nixos/modules/programs/sops/default.nix

@@ -14,8 +14,8 @@ in {
       # Add secrets.yml to the Nix Store.
       defaultSopsFile = ../../../secrets/secrets.yaml;
       age = {
-        # Automatically import SSH keys as age keys.
+        # Don't derive age keys from SSH keys.
-        sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+        sshKeyPaths = [ ];
         # Use an age key that is expected to already be in the filesystem.
         # You will need to place this file manually.
         keyFile = "/var/lib/sops-nix/key.txt";

nixos/secrets/HomeLab.yaml

@@ -6,22 +6,26 @@ HomeLab:
     Nextcloud:
         ssh: ENC[AES256_GCM,data:aVqa57u9hIOquP367EDj2rlyQWRe3EZv8l5cC+yQQKCri2bN5IFSq8qNemOIcU9ycBnxIyK6gLerJYQQcgzIIARmnfDpbJ9w+EeUL5yvPVJN6FM7oBeaL9mzYRl8aDKr22LhL9YiKAT1nKHESmTb3TZRvuvWJTGzCMRV85ROGxZYVUgG6BjuHEzuTsc4fy3NVPIl7/4ZjPgNNYx+UNsV5xwTejveB/sGblVrHOO74LZXzUWRlQNun5nM3MY3GALzfrPrVIAyGNu37CGachtwxaPOj7vUKZmD/e+XajYVKRJ3v33jrUeI0dDmhuwJj3taoFik6suAyiK3RlDdeWoERR8vqduiyxJnVMs6mNkigzkVtifpwZyQ8vNyG7w1JNPygMYgQzjN43lGVml8cx1lZvcoBzQabjWxcNzhV8gXxoGKvAwUV7ELB6l00rUH+EeI0uU8/IFm9kwmZq42ciM/bRGSGXzo2PYG2OHOiDe5b0nrIlajaRKd+vuuzTtFFU9EwH0GPzERRaoxVK+h9tzcco/REITCE+CVlHSx,iv:bb1X95HK5tT7EJpqqgMOUxw5VO5MuzoYxkPIzR5sEqU=,tag:y2LKHm7czwyuHp7Ea8KiYw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWWFUdnpERVlkK29TQ09k
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlL05vZHk2T1B6OHArUXlj
-            SnJMVm5rUEV6S0huSzJ2YjFFQ3pNR0pmZWprClZEVDloeDE2ODNkMVVJTUtqaENz
+            bEZWV0dUeVN0M3ZpeHdKcGlKV1RWYmRLM0FjCm9PLzBZTFo3RjhZTEhYMDBSN2Nj
-            ZzhwTTA4V2xOeW55WGtPZU5FWElQNDAKLS0tIFh5ZWtmZHRBWTAvM3ZwY3pKQ0R6
+            aithQ2hpZXVCSngxcVBvQ2hKRzFXUEEKLS0tIE5rL0NHb1llRmlSQXVUeU8rVmNY
-            aDNUbFlhWWVoOWpjVlV1VTVJejlSMjQK6wCeCRdHY5oyTX6/R1U5AOGJyp0exi1A
+            aEZHdDFEWUdxMzRVVjFhQWZmS04wRkkKrD2CiwdNcbK9s64omQ7xSA29J48HwIHa
-            dWPUMfkKBBBkrR+G6ougd8o3FwFf+yfb5RhaTxxqjit6p2RyMjR64w==
+            ickyL/uorYhXmBKhqdvNq/j1Nb88LR9ti55Z7eecJNbyJb4OTtgzXQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBOWNXQ1BsekdoS3BCdHA4
+            YTJJRHJBTEJ1bmhkWktSamYyRk1TUmovZ2trCnBXbUZQZFBndmU3VzJHVjczZGtY
+            ZkJDY3RzSEhXQVlLL0g1QTYxSC9CZGMKLS0tIGFBZnNlWmZjZFdkdGZvaHA5ZjMw
+            NFRtOFIybnFPWm1idFY0WEVqVGxOK1UKiJDByqKv/i/l9dvOplDyzDORU3ulhSwi
+            6xyEqmyNQpIkiS6TLZZYrBlQMDYqZ2gj1HhdIUssWJCf5Ho8KVDjJQ==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2024-10-20T07:58:57Z"
     mac: ENC[AES256_GCM,data:mmFgjE7rp7fXmPOnETGamHR3kUAguFCNNTQcEnD+uM4xeSp3QcB2g8tkKYaJAjkWWqKRSm9/Iu1NWOr9GWyu4O1h7ppWSvpKawWki6cHpqBl8JOwbx/SZi5bzU1lBtoJyT6hD1aCu9ENOMUkpPY3rKcYwbsRMJpKYsbXymPikcQ=,iv:kPB6ds8c4yc/w7Ny1d3DTyztQF4yTr0NyKgIHEzIKAg=,tag:VTpXRb5HaWDjVB52K7mByw==,type:str]
-    pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1

nixos/secrets/UGent.yaml

@@ -7,22 +7,26 @@ UGent:
         ssh: ENC[AES256_GCM,data:hJAle4DHJNvX569reclBG5rEdWsjAyV2TtHYMiPfky/dMKJkYgT4+T0doLfUn1O6at77kJGPmwUEvmK819DUuvHtNY7c6angV7iLygJ/ThI1FIFOKH+NxEsI3scoT0VDDybHpgice/fcJL1tMcvE74+dWOnZ2r4pxcMJEFHUPVVWcl9/stJLn78OonsyWpj8PglcnYFOfZ6THIe3lyNBxRp7XEweuwjacthGzOzNu3Z95zcCAnAokFVZ570glJNhjJVNEmPHZkHOcGiGNNM4JNbR11v+dOYtac942t/mmmWwAzbznuu8ZLupYWjdg/f07ftkPAwFwCoXblZ3708Lvf6uOt/CPeWvEII2Haf1Cr5w+U6TAt14zzL73xCSQqwz1TfkcmD+bJplmtcpSP/KX8/BRK7qr6Ec5T9ecbraRB7zDBg0X2x51DSHLrA7UIhpI9JNaOArU5UOVYTWwuzFiGG61elJMcPZ5vWEVrTCocfa4INPo4B2MkFbbsYf6xnY1L3Wc9LQjkff6aCqYnQaXZ/WfPWepf9YvYG1,iv:0Bm1r0FuJJKKmcbTiPL36rb5FaMZfOO7Mx8pXU2FSfg=,tag:0ShoJPJUx37mEAus+mhPmw==,type:str]
     Dwengo: ENC[AES256_GCM,data:3lsZJ5ztkGOfHFQNr54xs9evSTEAs9XHJhg6Krvz3fkT8CaGSiRW5HTCfANGhQ3wJ8kHVziwopQCJ8s93gaipAuEu5k/hYj5wYhOn6x8oDJxftMJC94JDL4eYGIXbx9GSPIy+loftfYIZcfmi6o1lQdiqRdC207Cs+p0ZTB7JSvales16IpgYKoTCRLUytd9cBrezD9gVEngW1b4wHGzai4OOTSunlOVVAgapAKsN+swN7QtMt00607Ns6gCoQDV76qAbM+6EN8PlIKwbyy9UneeTXOf0wtQpb2TM1zrVR7LOqNyXT+DUlrBLpOpYK8tPCP8y5m9DMLixrhbAXMT6pIp2XSbmcfcsuMGLJE2ev/c6PxmbjqiCGEYPC3HdAgUpNDtOMixnHEoXnMUPDJeE0MXbSFMRmzNGo7pc5gOoCFmCkV9NVQXERR6m04Bn3czRQVHfoVIc4ciPdiXpOqF8ocTnqZj7HRW8dvZz9V50ViHwOVqWLJ2a/QUMdagXlaK7zPrxPETKz47iMoMfVaUE8ePg2L5sEZHja62,iv:s/+JYSkZudTr4MnTclpNV7i5VGUlqFhdvovcFt+inSQ=,tag:4Ge0ZOc6qNObQrzS0K0WDA==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWWFUdnpERVlkK29TQ09k
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpb0dlWE5PNllnME1jQWE4
-            SnJMVm5rUEV6S0huSzJ2YjFFQ3pNR0pmZWprClZEVDloeDE2ODNkMVVJTUtqaENz
+            cHFzWkR4ZzNaWlR0WDJ4c1hEdlJGN0FISWlZCmNNdVRtL080QzgwQTZtTGpVRkxW
-            ZzhwTTA4V2xOeW55WGtPZU5FWElQNDAKLS0tIFh5ZWtmZHRBWTAvM3ZwY3pKQ0R6
+            dkdvYXdQNUlhYWQrYlNDR2JISXdpdkkKLS0tIEpIU20rK3F3WGpBS1g3NmJqYWRX
-            aDNUbFlhWWVoOWpjVlV1VTVJejlSMjQK6wCeCRdHY5oyTX6/R1U5AOGJyp0exi1A
+            SWlNbFZ0NTJJZ09Wd3JzK1hscjJoS2MK4GU8ndim80CaOjgvMwVlgIq/1VQIylSZ
-            dWPUMfkKBBBkrR+G6ougd8o3FwFf+yfb5RhaTxxqjit6p2RyMjR64w==
+            EJl15zUFaDiDZUCcZE8TkJQ/rbGDSiq7KlWyFe48Q3UC86jfF88qCg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYNjkzeHloK3hKUTJaMTdr
+            NUdiZ2JGZitqN1k0WCtEODU4R2MrTmUzR1hrCmNJL0Y4ZEpLN0l6ZmhGWEM5UktG
+            ck1PUnFSSVNCRUd5Sm9kSXNmVW5jZDQKLS0tIHpHWVBVNFNBSlUvZldJVGowUEtZ
+            S05HZ0FiSVlkUjRRV01TbjlpVFlkQWcK7jAqOYd9EDT93xpVgtpKl03EO6oHmGRR
+            iK9j2y7j1YSghPKDBrC5eKy9+IP/EFEBGygcokqT7C6Nscu80YhVbg==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-02-21T19:36:01Z"
     mac: ENC[AES256_GCM,data:NMxbxf7/UwR9akbbLgKeSLIkk+dS/an2pGzZUSbe1AJenCVFO/fiRCC5BF6xJVpFSpag/dLwo/tS64JmJ36Vqn2sQGmqn26HPXsjAgyUdpp3+anXIVOGvNHF3oCM8gEUk9+W2FsOqKuejpD7HK/IsVJEZZLbThkUS1BiptOWk84=,iv:xNBBjWADFF5itg45KnmNbZG5RN0KRpaph7iMGhf1KZg=,tag:FrDSAbvo/7QHH0g5Ik8ATw==,type:str]
-    pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.2

nixos/secrets/personal.yaml

@@ -3,22 +3,26 @@ GitHub:
 Gitea:
     ssh: ENC[AES256_GCM,data:8eyuycMkBVMHfzaGeGs+0RA4vCpaAUTjCwiplUamypEk9BDYqxe+69O6OjJAGaPnmH4kpsb/WVd5sU6HNUogBuzDQhCrv2B6NadcmnV+fH3MHfAWvDy7R68PUkwcywWVOo65SONckjKVa0Y+8IeeJh9zpr36qCbbs+zPC4XTk+Y5R4vK/ocmSJSmwqVK1SfGGwOjFoJvHVI6jdXh//vgKaITqmyZV7N3OU9EiQp1FmNKwFf/x70w2LGATrNBcexwNy20ZYd6ewiAfJxFHR6Svfc2P5X2nlv99W5t1eU5QEGUcalcslsW/VkmFC3agN3Yry2EMIlfTlm0hm4+ryDGWEvgyUC0dLA8Ao0TLaaqig9HzBRP1h6aORe0lDwzTUg6WltrIu0s7hFwD4YLi1qP5lY99hvrDIRbTEg6AY6X4b32YFlyOXy0YDetv90+QyEcwANWO9MXz2S9hxuQmjOXMCVYMaiMLVUkG+mShbQuxTiFQt/7D83yOBSRLugx/aU318NKvUDlCt7wpZbMI3gBia4nUYLoLcXRKcAZ,iv:uc1ZtGdcolLrpQgS5n5LEAwBt0vMmkj2OuTXcn8sQ7A=,tag:F2ofcj0zEBgxwukMUd7+uw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWWFUdnpERVlkK29TQ09k
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwSDRZQ0pVNWhmdFo1UDVv
-            SnJMVm5rUEV6S0huSzJ2YjFFQ3pNR0pmZWprClZEVDloeDE2ODNkMVVJTUtqaENz
+            MFlrZEFtNjlpZ3pBU0VrdkFpR2x4WGxUZ0RRClJad1JPYWhFTWd1N2ZKQWsrSjFj
-            ZzhwTTA4V2xOeW55WGtPZU5FWElQNDAKLS0tIFh5ZWtmZHRBWTAvM3ZwY3pKQ0R6
+            YXREaGRrbE15MEdpblJtcTk2cFk1eGsKLS0tIHE2ZTd3R1gwQ3E1VzkvZTZoZjBW
-            aDNUbFlhWWVoOWpjVlV1VTVJejlSMjQK6wCeCRdHY5oyTX6/R1U5AOGJyp0exi1A
+            aTRLcFJ6NkpJRjkyenVxeFRLVmgwMjQK47HRKyg1SxWABZHCdVdIaPEKoSiWIOO/
-            dWPUMfkKBBBkrR+G6ougd8o3FwFf+yfb5RhaTxxqjit6p2RyMjR64w==
+            OYu/1owbUwTh1KouUb4tgNmVBOkERJ9i3lEjWLHUWrlCAUImc9dG4g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBVDZtU2g4dmFXTlNIMFBs
+            OFBpS2RXRzFwTVdJazQrSldwWUFtdCs0U1ZFCmxRdy9yY3VIWU4zenc4eVNEVUZv
+            VUlyT29JekNTS3RIMktmS2RGNU5GMTgKLS0tIEhvM2RkcUs0SE5uSXFxc3dvSXhP
+            WmViM05IMHFPckNic1hHY2ZlTEMrYkkK+66rYqbGQucqQch4Tx9jONR9OIXdjMUd
+            q/fGLCoSluHuCOkUWr/wUgvF5dWAHftYj9JjDB/9vpp4Q0WClLDszw==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2024-10-19T12:24:38Z"
     mac: ENC[AES256_GCM,data:g15gV0H0rlzoeN5Z/Zkgh/8ya9GSrWDVP9oqdVz3m4obmquCLDIygsPaYpRXmfOtPSgvX2KzZ08sNLfcBZSh7eH2Ws7xcezWOntOcmAQNz5LvemqP7YuwtivMK/P4qrkME+LQPkSrSUR+rT99Zj+RQXisy91Cq9NbVBj6uQH7+I=,iv:W+oDp5Dun0g35BFprOmgfI0LoPME3HpPuuniCKA32Kc=,tag:CUU74HZuRNedyI3txn9D+g==,type:str]
-    pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1

nixos/secrets/secrets.yaml

@@ -9,22 +9,26 @@ example_booleans:
     - ENC[AES256_GCM,data:Ul7fKA==,iv:U51FhTsWwkbhUWGsO8D+bl2mLdTIfapIB+OGJEOAiRA=,tag:9NJLKp8s2TSKLyXwM8OncA==,type:bool]
     - ENC[AES256_GCM,data:LVU1a90=,iv:1X1qV+8iIe1i5hIrqyB3tJew9hsHjJHlATmkEmwRA0Y=,tag:ko/5OwmJH/6HKPsvbkoRpw==,type:bool]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1fva6s64s884z0q2w7de024sp69ucvqu0pg9shrhhqsn3ewlpjfpsh6md7y
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ekx1bzluY0ZhYmhnRmhW
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4KzMrV2dpWFQyQUQyV050
-            b3pzM2RlKzFrREpMK3RNU1MweldNRXJ5NjE4CmNRbnFvbk1EN0V0ZWJiVzFmL3Jt
+            elVhN0dUeTRodG1kNHZ0VEVmTUI1QjhidFJnClhJU0tVY0tmMkFaMDZkMDJOKzV1
-            N1Vpb3NEdXFzdzU4MjN1elp1RWZ5THcKLS0tIDR4cTFJNVFveEdxaEYvZndKbURa
+            NVJiSERtR0VZR3VBOGVJbGk3cUxTMzAKLS0tIGhvMmIyOWQwVlhXRzYwampTeG5V
-            UHpaNENhL3c1K3RXc05hUmdNZVBpT2MKwBj4+Gb7giVJIoPWiwY3tvugEAexXy6Q
+            UDVWQnE4NDY5cFF3RnpxcjhMY2N0VUUK+B24C0CT5b82DJSdKotX4iPhzWxnYsn6
-            YTWgZQZk96r5aF2mBjRCFCc7prj85PsUN/UXOPjPLVAFG3lwS0Eaog==
+            kS7Ut9uy5OwcB+p6erlbLMEUVmmSNw89KBrowT0Ui1d3AfyGAN4rqQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1qzutny0mqpcccqw6myyfntu6wcskruu9ghzvt6r4te7afkqwnguq05ex37
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwTjh4NDRYZGM1VHRZWGor
+            MmhFWDNvMjI4UUVPbnorNnpabGNZY1BuMVdrCisvZ0U5SXRPM3IzNlZvZEpWZktz
+            b2FJemtNVHU0WUI4M0U1L2tWR3g1MEUKLS0tIGczTmVubzcwVjg5NDdQdEllWEFw
+            TWRIRE5WSGRCbncvWlpEMmdWOW5kb00Kq79O2C4aYmZmrq+rbyMtwmEqkqL9epn/
+            pw2dxXmYt95qu3x/BxjoN8RFZhabFp9xHkZ1kqJe9FGmBtAmoWXjWA==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2023-09-10T20:20:18Z"
     mac: ENC[AES256_GCM,data:yfmYEo8pdlG3tu4Fabwde57igIvpt4UuhQqStVlV36rvPnv9dc42+6iduu+heuQ2OAVw0jk6/o6SWJpcms2DReOAMGDOgt+zV3TgJym52YdMcjTNJTo+4loULhvaWyN9ZdPJjSYKEoSgOZi+oMx4BpwreQEaPaYUxcbTqrWCUa8=,iv:Mb81sBxibRxSaC2kgakhy2pyEmW0MDobF+lHF7cny5E=,tag:DCqTWSnf5Gv5YfAGSEC2yw==,type:str]
-    pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.7.3