alexion/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ssh): adopt the client key as a secret and declare who may reach each machine (task 0019) #9

Merged
alexion merged 3 commits from task-0019-user-ssh-keys-and-access-policy into main 2026-07-20 13:07:08 -04:00
Conversation 0 Commits 3 Files Changed 8 +11 -13
3 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 78081143cf - Show all commits

2
flake.nix
View File

@@ -49,7 +49,7 @@
{ self, nixpkgs, ... }@inputs: { self, nixpkgs, ... }@inputs:
let let
inherit (nixpkgs) lib; inherit (nixpkgs) lib;
my = import ./lib { inherit lib inputs self; }; my = import ./lib.nix { inherit lib inputs self; };
in in
{ {
# Helper functions for discovering and building hosts. # Helper functions for discovering and building hosts.

6
lib/default.nix → lib.nix
View File

@@ -46,14 +46,12 @@ let
inherit inputs; inherit inputs;
my = self.lib; my = self.lib;
}; };
modules = modules = (collectNixFiles (self + "/modules")) ++ [
(collectNixFiles (self + "/modules"))
++ [
inputs.home-manager.nixosModules.home-manager inputs.home-manager.nixosModules.home-manager
inputs.chaotic.nixosModules.default inputs.chaotic.nixosModules.default
inputs.disko.nixosModules.disko inputs.disko.nixosModules.disko
inputs.sops-nix.nixosModules.sops inputs.sops-nix.nixosModules.sops
(self + "/system") (self + "/system.nix")
(self + "/hosts/${hostName}") (self + "/hosts/${hostName}")
{ networking.hostName = hostName; } { networking.hostName = hostName; }
]; ];

2
system/default.nix → system.nix
View File

@@ -93,7 +93,7 @@ in
# satisfy the secret below. # satisfy the secret below.
# Clearing both `sshKeyPaths` defaults keeps the SSH host keys out of the # Clearing both `sshKeyPaths` defaults keeps the SSH host keys out of the
# decryption path. # decryption path.
sops.defaultSopsFile = ../secrets/shared.yaml; sops.defaultSopsFile = ./secrets/shared.yaml;
sops.age.keyFile = "/var/lib/sops-nix/key.txt"; sops.age.keyFile = "/var/lib/sops-nix/key.txt";
sops.age.sshKeyPaths = [ ]; sops.age.sshKeyPaths = [ ];
sops.gnupg.sshKeyPaths = [ ]; sops.gnupg.sshKeyPaths = [ ];