alexion
0801b728b8
Wire sops-nix into the shared base config as unconditional plumbing, with a two-tier age identity model: an admin identity held outside the repo, and a per-host identity generated on the machine and kept on its encrypted root. Both `sshKeyPaths` defaults are cleared so the SSH host keys stay out of the decryption path and remain free to become secrets in their own right. The primary user's password hash moves into a shared secrets file encrypted to admin plus neogaia, consumed through `hashedPasswordFile` and decrypted before accounts are created. This needs `users.mutableUsers = false`: NixOS applies a declared hash to an already-existing account only when that flag is false, so at the default the hand-set password would have been kept and the change would have been inert. Root consequently has no password and is locked; sudo from wheel is the way in, and generation rollback remains the recovery path.
18 lines
762 B
YAML
18 lines
762 B
YAML
# Recipients for the encrypted files under secrets/.
|
|
keys:
|
|
# On every file: one whose only recipients are machines becomes unrecoverable
|
|
# the moment they are wiped, and adding a recipient requires decrypting first.
|
|
# The private half is held outside this repo, in the operator's password manager.
|
|
- &admin age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
|
|
# Generated on the machine it names, and reads only that machine's secrets
|
|
# plus the shared file.
|
|
- &neogaia age14a04vphzjq74epfrz9a09wjw8lzchtru84awzuq2n45d8f42ychqjs89qe
|
|
|
|
creation_rules:
|
|
# Material common to every machine, so it is stored once rather than per host.
|
|
- path_regex: secrets/shared\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *neogaia
|