From 44a4f7c6bac97a3381a2b7de8707cd9389f5460f Mon Sep 17 00:00:00 2001 From: Mel Date: Sat, 7 Dec 2024 03:24:15 +0100 Subject: Move secrets and keys into agenix Signed-off-by: Mel --- flake.nix | 2 +- machines/lapin/default.nix | 9 ++++--- modules/ddns.nix | 9 ++++--- modules/git.nix | 4 +-- modules/user.nix | 10 +++++--- secrets/cloudflare-dns.age | Bin 0 -> 693 bytes secrets/keys.nix | 59 +++++++++++++++++++++++++++++++++++++++++++++ secrets/password.age | 15 ++++++++++++ secrets/pds-secrets.age | 12 +++++++++ secrets/secrets.nix | 18 ++++++++++++++ security.nix | 13 ---------- services/pds.nix | 9 ++++--- 12 files changed, 132 insertions(+), 28 deletions(-) create mode 100644 secrets/cloudflare-dns.age create mode 100644 secrets/keys.nix create mode 100644 secrets/password.age create mode 100644 secrets/pds-secrets.age create mode 100644 secrets/secrets.nix delete mode 100644 security.nix diff --git a/flake.nix b/flake.nix index 3d22c57..4a8b76f 100644 --- a/flake.nix +++ b/flake.nix @@ -75,7 +75,7 @@ specialArgs = inputs // (packageSetsForSystem machine.system) // { me = machine; - security = import ./security.nix; + keys = import ./secrets/keys.nix; util = import ./util.nix { inherit lib; }; }; diff --git a/machines/lapin/default.nix b/machines/lapin/default.nix index 69960c3..3178a1d 100644 --- a/machines/lapin/default.nix +++ b/machines/lapin/default.nix @@ -1,4 +1,4 @@ -{ me, pkgs, lib, ... }: +{ me, config, ... }: { imports = [ @@ -14,14 +14,17 @@ ../../services/akkoma ]; + age.secrets.cloudflare-dns = { + file = ../../secrets/cloudflare-dns.age; + }; + security.acme.certs."pds.rnrd.eu" = { group = "nginx"; domain = "*.pds.rnrd.eu"; extraDomainNames = [ "pds.rnrd.eu" ]; dnsProvider = "cloudflare"; credentialFiles = { - # TODO: use age - CLOUDFLARE_DNS_API_TOKEN_FILE = "/home/mel/cloudflare-dns-token.pw"; + CLOUDFLARE_DNS_API_TOKEN_FILE = config.age.secrets.cloudflare-dns.path; }; }; diff --git a/modules/ddns.nix b/modules/ddns.nix index c9d2abd..8ee9afd 100644 --- a/modules/ddns.nix +++ b/modules/ddns.nix @@ -1,9 +1,13 @@ -{ me, ... }: +{ me, config, ... }: let domain = "rnrd.eu"; in { + age.secrets.cloudflare-dns = { + file = ../secrets/cloudflare-dns.age; + }; + services.ddclient = { enable = true; @@ -20,7 +24,6 @@ in username = "token"; zone = domain; domains = [ "${me.name}.${domain}" ]; - # TODO: use age - passwordFile = "/home/mel/cloudflare-dns-token.pw"; + passwordFile = config.age.secrets.cloudflare-dns.path; }; } diff --git a/modules/git.nix b/modules/git.nix index 1d592f0..f7a26c4 100644 --- a/modules/git.nix +++ b/modules/git.nix @@ -1,4 +1,4 @@ -{ me, security, pkgs, ... }: +{ me, keys, pkgs, ... }: { users.users.git = { @@ -8,7 +8,7 @@ home = "/srv/git"; group = "git"; - openssh.authorizedKeys.keys = security.keys; + openssh.authorizedKeys.keys = keys.allUsers; }; users.groups.git = {}; } diff --git a/modules/user.nix b/modules/user.nix index 2f49569..4ea0be2 100644 --- a/modules/user.nix +++ b/modules/user.nix @@ -1,6 +1,10 @@ -{ config, pkgs, security, ... }: +{ config, pkgs, keys, ... }: { + age.secrets.password = { + file = ../secrets/password.age; + }; + users.mutableUsers = false; users.users.mel = { isNormalUser = true; @@ -8,8 +12,8 @@ shell = pkgs.fish; extraGroups = [ "networkmanager" "wheel" "docker" ]; - hashedPassword = security.password; - openssh.authorizedKeys.keys = security.keys; + hashedPasswordFile = config.age.secrets.password.path; + openssh.authorizedKeys.keys = keys.allUsers; packages = (with pkgs; []); }; diff --git a/secrets/cloudflare-dns.age b/secrets/cloudflare-dns.age new file mode 100644 index 0000000..bd546a6 Binary files /dev/null and b/secrets/cloudflare-dns.age differ diff --git a/secrets/keys.nix b/secrets/keys.nix new file mode 100644 index 0000000..6f6aa8e --- /dev/null +++ b/secrets/keys.nix @@ -0,0 +1,59 @@ +let + machines = { + renard = { + user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINs2TTjnQvDNr/S3lPLWYOnZi00YIMrRUDH8cpBz1k1m"; + system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/qDL7+86+0H6NkPs/w4GYiWQwT/4YAx9O2J7sLkKmf"; + }; + + lapin = { + user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIzDyaafULcgTuFca51NNgYAzZ28RFDQwVWavRpnY5c+"; + system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGMD/EN9v8YgHOu4YG74Q+xvwjCdxbMIZjnQcUXi0QhZ"; + }; + + corsac = { + user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDlqytVSNMFAfbB+rdiNktv3WYViVBMeK7zUO2Pjfii+"; + system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxghVX0Oq+eHklg/e7s/qhC8CK8PLUgvpLk2G53xEjK"; + }; + }; + + desktops = { + bismuth = { + user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEK96G1n31aJsZOrux3BKM0ztzi/SFAVHn0MsGkPDdqY"; + system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEP1Q8/07PD5AXghM7cd9Uf54YY8rkuBHfllr1Kzxh10"; + }; + + graphite = { + user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEDujTul5wWyGnidLnNuJDRze0Up29l2cDpyKdmvW2Ls"; + system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHd+EvfxJC1rZbeI6hUq5tPpy8b3Xio02orgMBLwPU2l"; + }; + + # this one is just a phone :3 + anise = { + user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMkdZb6fmfj8fHQUCigTz1x503nRqyokhxYC4RrgA3dZ"; + system = ""; + }; + }; + + keysOfType = type: from: with builtins; catAttrs type (attrValues from); + + machinesWithKey = type: from: builtins.mapAttrs (m: k: k.${type}) from; +in +rec { + inherit machines; + + # keys of admin accounts on network machines + allAdmins = keysOfType "user" machines; + # keys of user accounts on desktop machines + allDesktopUsers = keysOfType "user" desktops; + # keys of all users, both on desktop and server + allUsers = allAdmins ++ allDesktopUsers; + # system host keys of all network machines + allSystems = keysOfType "system" machines; + # all keys, whether system or user + all = allUsers ++ allSystems; + + # user keys per machine + user = machinesWithKey "user" (machines // desktops); + # system keys per machine + system = machinesWithKey "system" (machines // desktops); +} diff --git a/secrets/password.age b/secrets/password.age new file mode 100644 index 0000000..44f33a2 --- /dev/null +++ b/secrets/password.age @@ -0,0 +1,15 @@ +age-encryption.org/v1 +-> ssh-ed25519 QWV68w T9rDQNnBbiX8mXTTGOArxEBgce3FhHnwGYH2kBywMxc +kVhycw6ZriC7XtiBbW9uPH58aD2sZkEKcVtqnn5Mqwg +-> ssh-ed25519 oQ052g XPWeWjk8h4BkVS3A6JdcjilnswwxIjAM674CbLV08hk +MOWWyep176qbrw+bRR19uNOHYx0uXT4fccAZ95Nb2mg +-> ssh-ed25519 p1ieXg ffpjZePsGGBvGR6z1GjdZEnM+tyUtLN3Xi5d9r+snG0 +AdeTzYwITMjyRPF9VQxLMXCqs585pV/p32nvK+mxgQo +-> ssh-ed25519 ztr2Fw JLp7IJqyMchZ/VPO7caHAfbIQ/ImZ9LU2wNc3qQF6T8 +yQzb19n/fgMj270IBWYRSsx/q6EvZQdAZrSJZVFosGs +-> ssh-ed25519 COVM9Q C4nrd6ntpgqopm1dl6RMHmA3xp02OPlMoOS7/qipM1A +nLDehTRyknfsdNlNZuPx+rKmmmhFALHBtUjh9iDR3z4 +-> ssh-ed25519 aV3pTQ 2tI02eszGD0uaSypQ989j2rh9JeEavCcjPxwnyCku1M +q26P5e2h9E7zVWTjDRQnZ1gBjoLprkJowLaqCb13kIA +--- o/bftSdUluJK4uFCh0CgV0LGBrheSuh2aSSlIAR19SQ +kGq.2S\p@XEf ,@1sFQ+%,rCщցR'LoPG=RmdJ[a~uuo*9 \ No newline at end of file diff --git a/secrets/pds-secrets.age b/secrets/pds-secrets.age new file mode 100644 index 0000000..764bec6 --- /dev/null +++ b/secrets/pds-secrets.age @@ -0,0 +1,12 @@ +age-encryption.org/v1 +-> ssh-ed25519 oQ052g gUuIbqRYV2IkWZT33qhiaqDOuhZIu5EMikWOI88s6kg +jKeHgm3zRMTE7A1FfPO/BFjufbpAVFVNL1bW6Q0kyc4 +-> ssh-ed25519 ztr2Fw TBmwrM6geKnJxq1Kn8oQj9K6enaXLxtcO2IIfSZzpB0 +YiRl/RyPoPNlvxTJCG9p0DU9/1jAmmsW3sredGb9KaM +-> ssh-ed25519 COVM9Q xjnVsFeN9FvMdgfgXUbwFSB9fHIgg+nSZrK5OtrVGVI +k54JOwV91KvdoiyRhiV8TRcFdx517LFKi7hCOkV0b64 +-> ssh-ed25519 aV3pTQ cgtpeDpRR2tWoym2aFElBSk4x5xeySWR8jdJDME4aTU +z6LG5YboZ+2I6SHrwxbtIFa1dn88W/1kL86md9wwIQY +--- Bk116iREjvqiGZ4PRrkdx6mJl81rHxzhIrog8AcHmM8 +ћteM!%WqJ8Mq텎hH8EZR!j@\@MoQ*)y~q.sM>JN}gҜf+(4̍U:qxQ+ZPAPpw\k`>5ʞ-?3P橸I|.CW0