51 lines
1.2 KiB
Nix
51 lines
1.2 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
userSettings,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
options = {
|
|
sys.security.sops.enable = lib.mkEnableOption "Enable SOPS";
|
|
};
|
|
|
|
config = lib.mkIf config.sys.security.sops.enable {
|
|
sops.defaultSopsFile = ./secrets/secrets.yaml;
|
|
sops.defaultSopsFormat = "yaml";
|
|
|
|
sops.age.keyFile = "/home/${userSettings.username}/.config/sops/age/keys.txt";
|
|
|
|
sops.secrets."${userSettings.hostname}/password-hash" = {
|
|
neededForUsers = true;
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
sops
|
|
];
|
|
|
|
# SSH private keys
|
|
sops.secrets = {
|
|
"ssh_keys/masaoka_private" = {
|
|
path = "/home/${userSettings.username}/.ssh/id_masaoka";
|
|
owner = userSettings.username;
|
|
group = "users";
|
|
};
|
|
};
|
|
|
|
# Password hash
|
|
users.users.${userSettings.username}.hashedPasswordFile = "${config.sops.secrets."${userSettings.hostname}/password-hash".path}";
|
|
|
|
# YubiKey IDs
|
|
security.pam.yubico.id =
|
|
[]
|
|
++ (
|
|
if config.program.yubikey.enable
|
|
then ["${config.sops.secrets.yubikey_id}".value]
|
|
else []
|
|
);
|
|
|
|
# Syncthing password
|
|
services.syncthing.settings.gui.password = "${config.sops.secrets."syncthing".value}";
|
|
};
|
|
}
|