schmittlauch/nixconfigs
2
0
Fork 0
Code Issues 2 Pull requests Releases Wiki Activity

sops: darwin: switch to SSH host keys

Browse source 
I've decided to just create some ssh host keys via `sudo ssh-keygen -A`
to make the key management parallel to linux hosts.
This commit is contained in:
Trolli Schmittlauch 2026-04-06 23:43:19 +02:00
parent de64d0d8d6
commit fe50bf0b58
4 changed files with 41 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

25
home/modules/sops.nix
View file

@ -12,21 +12,10 @@ let
else
"/home/${config.home.username}/.config/sops/age/keys.txt";
in
lib.mkMerge [
{
home.ensureDirs."${builtins.dirOf homeKeys}".mode = "0700";
sops = {
age.keyFile = "/home/user/.age-key.txt"; # must have no password!
# deliberately not setting `defaultSopsFile` because there is no clear file-hostname-mapping. Each separate home config has to configure this explicitly.
};
}
# linux machines: assumption: there is an OpenSSH server of which we are able to use the hostkey, like at the NixOS module. The `keyDir` is only used for the private admin key.
(lib.mkIf pkgs.stdenv.isLinux {
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
})
# darwin: no SSH server, no hostkey => let's use the `keyDir` key both for encryption and decrpytion
(lib.mkIf pkgs.stdenv.isDarwin {
sops.age.keyFile = homeKeys;
})
]
{
home.ensureDirs."${builtins.dirOf homeKeys}".mode = "0700";
sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# deliberately not setting `defaultSopsFile` because there is no clear file-hostname-mapping. Each separate home config has to configure this explicitly.
};
}