.envrc

@@ -0,0 +1 @@
+export SOPS_AGE_KEY=$(ssh-to-age -i ~/.ssh/id_ed25519 -private-key)

.sops.yaml

@@ -1,5 +1,7 @@
 keys:
   - &primary age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
+  - &yggdrasil age1xxv54tzxz6n4cp4undmejl2lyd7k7s3yh9q0z6ed83evfuz6asqsqhaduv
+  - &loptland age13xshg5e6ucvnu3vqgn344mxpk5kcqutv2lf4gdffvwadq0ku5ewqy4cck6
 creation_rules:
   - path_regex: secrets/secrets.yaml$
     key_groups: 
@@ -10,8 +12,10 @@ creation_rules:
     key_groups: 
     - age:
       - *primary
+      - *yggdrasil
       
   - path_regex: secrets/secrets-loptland.yaml$
     key_groups: 
     - age:
       - *primary
+      - *loptland

flake.lock

@@ -816,17 +816,17 @@
     },
     "nixpkgs-latest-factorio": {
       "locked": {
-        "lastModified": 1730638571,
+        "lastModified": 1731242709,
-        "narHash": "sha256-z9Wy1jmhFrABK3cEyiVmQtUwOuQW1YPwA8+HMnbEpnE=",
+        "narHash": "sha256-zGhhtd4U3AxjA5dqzbHhD10q74Ychyu5mNGI7ic+Yng=",
         "owner": "Daholli",
         "repo": "nixpkgs",
-        "rev": "d941e9aa2d89f377d45516c5edd765fef15ea90a",
+        "rev": "2adc4d1f11c5abcf654ed50c2cbce897c6e78ccc",
         "type": "github"
       },
       "original": {
         "owner": "Daholli",
         "repo": "nixpkgs",
-        "rev": "d941e9aa2d89f377d45516c5edd765fef15ea90a",
+        "rev": "2adc4d1f11c5abcf654ed50c2cbce897c6e78ccc",
         "type": "github"
       }
     },

modules/nixos/security/acme/default.nix

@@ -26,15 +26,15 @@ in
   config = mkIf cfg.enable {
     sops = {
       secrets = {
-        netcup_customer_number = {
+        "netcup/customer_number" = {
           inherit (cfg) sopsFile;
         };
 
-        netcup_api_key = {
+        "netcup/api/key" = {
           inherit (cfg) sopsFile;
         };
 
-        netcup_api_password = {
+        "netcup/api/password" = {
           inherit (cfg) sopsFile;
         };
       };
@@ -42,9 +42,9 @@ in
       templates = {
         "netcup.env" = {
           content = ''
-            NETCUP_CUSTOMER_NUMBER=${config.sops.placeholder.netcup_customer_number}
+            NETCUP_CUSTOMER_NUMBER=${config.sops.placeholder."netcup/customer_number"}
-            NETCUP_API_KEY=${config.sops.placeholder.netcup_api_key}
+            NETCUP_API_KEY=${config.sops.placeholder."netcup/api/key"}
-            NETCUP_API_PASSWORD=${config.sops.placeholder.netcup_api_password}
+            NETCUP_API_PASSWORD=${config.sops.placeholder."netcup/api/password"}
             NETCUP_PROPAGATION_TIMEOUT=1200
           '';
         };

modules/nixos/security/sops/default.nix

@@ -19,13 +19,15 @@ in
     environment.systemPackages = with pkgs; [
       sops
       age
+      ssh-to-age
     ];
 
     sops = {
       defaultSopsFile = lib.snowfall.fs.get-file "secrets/secrets.yaml";
       defaultSopsFormat = "yaml";
 
-      age.keyFile = "/home/cholli/.config/sops/age/keys.txt";
+      # age.keyFile = "/home/cholli/.config/sops/age/keys.txt";
+      age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     };
   };
 }

modules/nixos/services/factorio-server/default.nix

@@ -24,15 +24,15 @@ in
     environment.systemPackages = [ pkgs.factorio-headless ];
     sops = {
       secrets = {
-        factorio_token = {
+        "factorio/token" = {
           restartUnits = [ "factorio.service" ];
           inherit (cfg) sopsFile;
         };
-        factorio_username = {
+        "factorio/username" = {
           restartUnits = [ "factorio.service" ];
           inherit (cfg) sopsFile;
         };
-        factorio_game_password = {
+        "factorio/game_password" = {
           restartUnits = [ "factorio.service" ];
           inherit (cfg) sopsFile;
         };
@@ -43,12 +43,12 @@ in
           "description": "Trying to run a factorio-headless-server on my nix system",
           "tags": ["vanilla"],
           "max_players": 10,
-          "game_password": "${config.sops.placeholder.factorio_game_password}",
+          "game_password": "${config.sops.placeholder."factorio/game_password"}",
           "allow_commands": "admins-only",
           "autosave_slots": 5,
           "ignore_player_limit_for_returning_players": true,
-          "username" : "${config.sops.placeholder.factorio_username}",
+          "username" : "${config.sops.placeholder."factorio/username"}",
-          "token": "${config.sops.placeholder.factorio_token}"
+          "token": "${config.sops.placeholder."factorio/token"}"
         }
       '';
       templates."extraSettingsFile.json".mode = "0444";

secrets/secrets-loptland.yaml

@@ -1,13 +1,15 @@
-#ENC[AES256_GCM,data:Cgp+gOU81+rvdlY=,iv:8DxJxnCslDoEu0bxtlTjmNiAUCdiAV/8VYKTb4yqQ50=,tag:ZTkK7WCOBh1It6GuKPUXdg==,type:comment]
+factorio:
-factorio_username: ENC[AES256_GCM,data:egV5kXtAiw==,iv:Hay0PC2yol5FAJGcWxLkxzNdwpD1V4UfDDnkhsjvjVQ=,tag:QBDS6eAeOswQoHBoi4Gj6A==,type:str]
+    username: ENC[AES256_GCM,data:aFRsUMsoaw==,iv:8EGn99WbgJxUyEKuOcwV6U8awOl7bDfmui+M3mDBoCg=,tag:BzMvGS3lfTsXToI/I5dguQ==,type:str]
-factorio_token: ENC[AES256_GCM,data:whruEJQCNIqqfMA0A3yQdwwrzpIJBt815Lvex4Au,iv:hh3zZt+UxV9ltSHIAjpTRwtDvPgPU5APrB/1bXtKUkE=,tag:AgUmBYWp+Oyxm8O7yD8vlA==,type:str]
+    token: ENC[AES256_GCM,data:WP6FTOBOBuNF6+pzi090wXsXpL2XsU34dQ2ZMzmw,iv:uKM4hLyx3vdyk9F0SyKu4x+2sl442GWXwEKbdgo/Dug=,tag:Xw3BJ7wxuft6hOG9cGtW0g==,type:str]
-factorio_game_password: ENC[AES256_GCM,data:Gu/p0+Sbd6Y=,iv:6AB1T3JdleiUnusU7hw/0wOFNSBsAsBgP2yD9FB7zXk=,tag:DMgD4csthynuBon+KNZtOw==,type:str]
+    game_password: ENC[AES256_GCM,data:GtLNoCdQH1M=,iv:dxOMtXscLeMdsQxWjNgrIMb08vL2wAswvd1oM6pEWPA=,tag:a55ciDtw9mjLM9x5YQBTwQ==,type:str]
-#ENC[AES256_GCM,data:15i2BBxM4iM=,iv:JV6Lsk8jUZl/eIJWkH/w5I2NraB9J9+0ggsENBGgbdI=,tag:HDwGheUv7dFIztQoJBjGmQ==,type:comment]
+forgejo:
-forgejo_db_password: ENC[AES256_GCM,data:CFsvko1AXRymDBC6WiOBs98rvFM=,iv:Wemhu8URxA6HsWQyYcPSwJzuMP4myrDC3rU3GEDVt7c=,tag:6wcNlDFVdnjez8hzi4E2cw==,type:str]
+    db:
-#ENC[AES256_GCM,data:nQnLBl7v,iv:HORr/Uvw4eUXfW5uS6rWr+6FkFF9bTNpMYGaRpVITRY=,tag:/r4n/xpqp7EPecGxDj4N+w==,type:comment]
+        password: ENC[AES256_GCM,data:CicLsCG2WCtiKMcz3DF5eVVaT8A=,iv:SPO1H4AZwo5FjJWkf1OS7aPOrpTGxqsAj4q3cuuWAbA=,tag:0snK8RyAd8heNvui2sbSNw==,type:str]
-netcup_customer_number: ENC[AES256_GCM,data:pRooJa3O,iv:0U/ONcWa2eqcsT1UpgXmLpAvJndaU8zln2g1HMbBQYE=,tag:+pu8EBl/dnm6DoLAtrjZBQ==,type:str]
+netcup:
-netcup_api_key: ENC[AES256_GCM,data:nlkDz1VV2NIXxv/tIROWDHN9DLI0lVq9n9l2FlDwt+3H4G4gg6yCeZjGtR+pTCNfwio=,iv:x8HLL10ww52UJDkz7Yi02KBg7jbuLFHAlG0iMYDd8hk=,tag:pcuka4/Hu/QFIwS0b8GlxQ==,type:str]
+    customer_number: ENC[AES256_GCM,data:9+QboNg1,iv:Tg9ylJUM8L/kzqFmk2uIsD9noqnp5wIxr5GVXMsZwB8=,tag:2qRggSIkPHuCQYDWCfka5Q==,type:str]
-netcup_api_password: ENC[AES256_GCM,data:k2mdQp57x5ZTypRCHbVlq1fembJ0uj5D0rb72K5rac43p888y3TFyiYVuDTosxR66mo=,iv:0OhtKWD/LWeV5ZWN9fbPozebSxvaFRdSn1AkX97ffAM=,tag:uY6A4jBL/9mtGy7++Yvn0A==,type:str]
+    api:
+        key: ENC[AES256_GCM,data:eYTKtJSSXmZfkRjlj65OHi99mpD3Iom8dPc8v34pwJIQSBbxVaqdgb7Gqzhse1c9L+U=,iv:9gmsBwlJ+NQIGY5NBA6Fi/1EQium2pcfQkF7x/fHyFU=,tag:v25eeqT6/WEMG9za7LVWAg==,type:str]
+        password: ENC[AES256_GCM,data:VTW4XGDg19AbE4EM6kS0u89Sz6718vHXvZZmQlkhGJe/4/LQJHmF1FetAClxkLZ9Za0=,iv:sWHvjHEsMXBbtFmkEdAOeSlQ6VTabRJ28kH3iP3GDaY=,tag:5k6NXFXwXHorUGKe+sAbbg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -17,14 +19,23 @@ sops:
         - recipient: age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3NFlTd2hOTHBtUDhuT0lF
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBleDhiRlplSndCcUhaMXV3
-            amtLclY2ZTN0SStZQjFSNkZUd1RmMkdJZ0dJCnB2WU04dk41Qk45aGphMW9GQVJ4
+            ZUR5QXVyemQ2VlhaQ1JjampwaWV5emhnVGt3ClBWRlJJbmx4cldDWmI3cUd2M0Z5
-            b2VWQVlOVFFLaGJWaU9FVU5ZUWtlRncKLS0tIGVPYW5DQnJMeW1qdWtINDNlQWFo
+            YTl5ODVTbmZjM2UxQkhGZ3hvRWVqWmMKLS0tIFlDZXJTQi9wTGxRWElvcDRPVStj
-            NmhrdXhpbVlmUFNsT1VaQjZyYkZkdzgKhL2BKXfPWNWUbFavpmtBQpnNEm/x0xH6
+            MGV3VDBEMWkxNkV4TGV6dTFWaDhLWXMKg2Xt5PJe7etU1yp+IgnwTnLl7AXaN1MA
-            NsjiV05AcrqPmGjj2kjvTv4ULPSoHiHiC5McUMfFTYIrCJgNvUbmMg==
+            5RymeKYjdNipJtxSNxzTjkNpENtHyXLcjVEBTH3IjGujtyGPMpk3eg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-07T14:40:34Z"
+        - recipient: age13xshg5e6ucvnu3vqgn344mxpk5kcqutv2lf4gdffvwadq0ku5ewqy4cck6
-    mac: ENC[AES256_GCM,data:uk2AeOA9pnhekuofIjXavCGy9ZaO0ObprkvnGhJg5lPr/hyT9l7YcZtMQ7wckKDLS03I1hCAcNg0w/EmSUeU2+EHLb6Z1IUj3l0HBUPtPIJwJZifkrzp9iQwGwlK+i6nfREEgPGeuNMj/rnD67MECO4NRHTzGBzH7ZImoDpu0Us=,iv:ss8Q7i75UOQDMJfw4dQCT0qxPUGwfHizX0c/TUej+vc=,tag:iufeO6sfaToNcJg6E8tuxA==,type:str]
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArRTBLR09YS0tuM212a25G
+            cWV5bnR5ZytjQWIvd2txSmdEWjExeWRSbTNvClQwMjc4VnhtdnpKQmQ3Z0JOTEFW
+            OEtEZ0h2bDlPb3UrNTZFVFdCajdzSGcKLS0tIG16UFNqRVpWOHJNTE03TkFTUDF1
+            UllqSDR1YWl6aU1jSnY2WE9oczg5Q28KfN15tFxXHrJmOHySK+cyLi2bFqArg244
+            bNTYyuBUtBW1Y/EuNpbyLjSNQpKZWFz7grE64uxrNQHP865N3wv0gg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-12T14:29:12Z"
+    mac: ENC[AES256_GCM,data:lKx1qAe689wkWkrMRvqHpE0zmv+ShLwpApBw2C4+JEuuHnoN1W7aoB/GQRkWzmImCCy9odzM2yoUa0mJogl0i+bddblrl+ZS0uPmPQrm3pM0sl876pelogxKuNpQWS8PRNDe24z3m06f0TozhfPF9D2ywH30tFH8naZONfWTTUU=,iv:tDhJVlWnTHnjZak32pgnUZ8XtM6TK9o2gZ0X3tcQD4Q=,tag:PcMS/5DpEkDkk+U0GG918w==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.1

systems/x86_64-linux/loptland/default.nix

@@ -23,7 +23,7 @@ in
 
   sops = {
     secrets = {
-      forgejo_db_password = {
+      "forgejo/db/password" = {
         inherit sopsFile;
       };
     };
@@ -71,7 +71,7 @@ in
     database.type = "postgres";
     lfs.enable = true;
     database = {
-      passwordFile = config.sops.secrets.forgejo_db_password.path;
+      passwordFile = config.sops.secrets."forgejo/db/password".path;
     };
 
     settings = {
@@ -111,8 +111,8 @@ in
     };
 
     user.trustedPublicKeys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHFrDiO5+vMfD5MimkzN32iw3MnSMLZ0mHvOrHVVmLD0"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHFrDiO5+vMfD5MimkzN32iw3MnSMLZ0mHvOrHVVmLD0" # yggdrasil
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII4Pr7p0jizrvIl0UhcvrmL5SHRQQQWIcHLAnRFyUZS6"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII4Pr7p0jizrvIl0UhcvrmL5SHRQQQWIcHLAnRFyUZS6" # Phone
     ];
   };