schmittlauch/nixconfigs
2
0
Fork 0
Code Issues 2 Pull requests Releases Wiki Activity

sops: add thinknix key

Browse source
This commit is contained in:
Trolli Schmittlauch 2026-04-09 17:52:38 +02:00
parent 1371229109
commit 562785e0d2
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
.sops.yaml
View file

@ -1,19 +1,26 @@
# XXX: missing: thinknix?, at some point mobile # XXX: missing: thinknix?, at some point mobile
# XXX: consider key groups # XXX: consider key groups
keys: keys:
- &admin_framenix age1q80zzsgglj438verw74jghezn8ndpqldvg0mfxzwtaq4v5h7apusqysavz #framenix - &admin_framenix age1q80zzsgglj438verw74jghezn8ndpqldvg0mfxzwtaq4v5h7apusqysavz #framenix, thinknix
- &admin_workmac age1fft2ynhazjwtjmxsvt37qervtekktdln2968gjp4vcp5sp3jeg5segkz3x #workmac - &admin_workmac age1fft2ynhazjwtjmxsvt37qervtekktdln2968gjp4vcp5sp3jeg5segkz3x #workmac
# Generate AGE keys from SSH keys with: # Generate AGE keys from SSH keys with:
# nix-shell -p ssh-to-age --run 'ssh some.example.com cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age' # nix-shell -p ssh-to-age --run 'ssh some.example.com cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
- &machine_framenix age1kx93vp8l8jd6kz0kvk379udr5z8a9t6946w0ff5t9a2esn47nqzqlfzvwe - &machine_framenix age1kx93vp8l8jd6kz0kvk379udr5z8a9t6946w0ff5t9a2esn47nqzqlfzvwe
- &machine_workmac age1rpygw5lkhc0a5hq8fuhjzy57ls7pn5u76097z6g2p4nmlctl8pvsxrztd8 - &machine_workmac age1rpygw5lkhc0a5hq8fuhjzy57ls7pn5u76097z6g2p4nmlctl8pvsxrztd8
- &machine_thinknix age1ux8jt6dt2t5xc22h0qf6nakmhchf7hvzaj9a4spevjlugpafkyzq6vrn0f #thinknix
creation_rules: creation_rules:
# per-host secrets for host specific ones, but for service modules we could store and manage them also per module scope # per-host secrets for host specific ones
- path_regex: hosts/framenix/secrets\.(yaml|json|env|ini)$ - path_regex: hosts/framenix/secrets\.(yaml|json|env|ini)$
key_groups: key_groups:
- age: - age:
- *admin_framenix - *admin_framenix
- *machine_framenix - *machine_framenix
- path_regex: hosts/thinknix/secrets\.(yaml|json|env|ini)$
key_groups:
- age:
- *admin_framenix
- *machine_thinknix
# shared secrets
- path_regex: common/secrets\.(yaml|json|env|ini)$ - path_regex: common/secrets\.(yaml|json|env|ini)$
key_groups: key_groups:
- age: - age:
@ -21,4 +28,5 @@ creation_rules:
- *admin_workmac - *admin_workmac
- *machine_workmac - *machine_workmac
- *machine_framenix - *machine_framenix
- *machine_thinknix