diff --git a/.sops.yaml b/.sops.yaml index 930e725..f7b8afa 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -2,10 +2,10 @@ keys: - &john-p14s age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy - &john-pc age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt - &test-nix age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0 - - &soteria age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633 + - &soteria age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g - &janus age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3 creation_rules: - - path_regex: modules/hosts/janus/secrets\.yaml$ + - path_regex: janus/secrets\.yaml$ key_groups: - age: - *janus @@ -22,8 +22,8 @@ creation_rules: - path_regex: soteria/secrets\.yaml$ key_groups: - age: - - *john-pc - *soteria + - *john-pc - *test-nix - path_regex: john-p14s/secrets\.yaml$ key_groups: diff --git a/keys/secrets.yaml b/keys/secrets.yaml index 544e018..7ef51c4 100644 --- a/keys/secrets.yaml +++ b/keys/secrets.yaml @@ -11,47 +11,47 @@ sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwWlpYV1o3SVdJdmJ5TWM3 - Qmg4WVkvL21aQ2wvMUcxeGIxL2FQRUNOZFhZCkFqT3RtNTZvODJZczVwcEZkMzBp - eFFTVmJLb1ZOQVVVSWl4OVNQWkM4VWcKLS0tIEV4WmhEOGpkUWFBTCtqaldxdXFO - T20rVXNrY0ZBWlBaS0lWdGIrYUFNdm8KL06MsEu0fy6gKX5khZoxaypKDgEEJnTL - hCh4sCmTC3l7vQLv6deWf1Xhc8vSYhhNaWFCZ+KSaUen+6Bm/WrRIg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dTVZQ2hFanhqbVJXTmxG + YUFFanBiTzgyek1WZW5YajlaL3hVNElORHpJCm1JN2hxell5dmJVczlBbVI2VktH + Z21lelF6UDBHcXIyUDE0clpxcEV4MGsKLS0tIG0zMktBVEt1SFZ6aGFaNW0wdzlB + QkpQc3lkNmZCd0d6ZVRCc1ZaWjFYaDAK9RXWeW6dCIhYfVGPywsHlRigORVMuVfl + d+Evyp72wV5C1MnhV9jv8O4S8aQkcNae1PALacnFw0GJAI1iXn0bqw== -----END AGE ENCRYPTED FILE----- recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRGVJTXJtSk9KUFpCdksv - SUJ4YXBSTndhZkVHNlV2TTlyS0MrQXdqOG1jCkk0c3p0ZUlHMzZmR0FTUTMxOTl1 - c0dFTW9yZFpuSUdwVUs0dlJiL2d2cFUKLS0tIE1VWldEYmR6cWFoRTkycmllVnpt - TGYxU2J0NzAvMjBMOXVMZEJTYTNkamMK2zfuTeHJ/8I07oNhp3MN1wKlmtVpahke - cz8FVesp/+53HxfQAdnC7l/Cv7P71aVEyr2/oTEd4gt9HsHVVw3O6A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBTWt3MEFDL3JGOUw0LzNa + RmNLMmFRRzh5NEtZWENjNTlrcDg1MHpjWWg0Cjl5THh3ckdyMWVqR0M2Q0Y0czUr + Y0ZNRGVIbS9TNXlCcFo3R3lPZUl4cW8KLS0tIDN4QmhSYjBPMDZLWURhMndsK2hE + WVY1T0JnZ3dmSjNIMDNBYmhMellvMWcKp15FwF7lJnHoZ/tLNQTGvwP7Kffj8hms + 6G5ZG2howsNFiRFFdo/uL08ShaycL2PAL/Kge/0pPL1ygiDaDLjGGg== -----END AGE ENCRYPTED FILE----- recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwR3VEWmZ4REpUN0M5NTRT - U1l1S0k1MnFrYnhRanB4UStOQU0vYXE0TjFZCld2cDBlRXNyRlJWMlZ4TENadURy - cUN0RmpYYld3WlY0TzkyNXlqbFVnKzgKLS0tIHhtSG5VU3RMclMyZFJmbk1DMkV6 - elRhVTV6Tk5OTjUybldvUXY3Sk9hdkEKg17Pagk12Pvj6cNr49HN8tImM4w7pnkc - XLCWIHUCe3QpJlgs4USXbyA06PmsNl7PVvCoxmf6tPegt+SFMTuDRQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwT1FoTDNmRXM4Tk9HZHNu + ZSszMEM1R0Z5bzY1ZzRvR3VGR2srVVdXbDBNCmp2c0tacndoQ3RiZUpNTnk1MTNH + V0Q4ckhWaDBjemYxZEhrSGJHcVlwYzQKLS0tIHNDZkNrNmZvM2plNEp2TTJmVlpT + U1JhN2MrT2NzeURuVzRIZlNEVEd0S0EKBcTG4hWKdXqNfajVZ5DOClOeZsFYktPb + dAauLGwx1zkXbVxopUpH5+vCXp02kvvwgO9kiqJvSf0U+l/5VIp6Ww== -----END AGE ENCRYPTED FILE----- recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUUtJWklHTGpLYTJuMkZi - N2YzMlBUU3dxUGZwSUJjRktVYmp4RlowZ0c0CmdWdmFOQndpQWM0a0VOZUtlckhz - SktRclh5ZFZLaCt2RjhIdGU1aUs0c2sKLS0tIGI4UGFUcHhPVis5Z3dhanhiMGwv - OXRWQnNKcU9XRVJRWWdUNTZyZUdETzAKSchzGq3teDdBiyzJEujlxPaoJsVww4JX - 3VvsUZLxnV1yWu83X1bp6uZA3YLMdQgPcHezdgmIyixp+ATHh9fgzw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bTVkK0pQL3kxZzdaN0xq + YU9rVTNvQXE1V1d0Ykx1bEN3cXp4eWdKaWpjCkEzNUs0N1JlMjlrdnA4UUxIRkZ1 + aFl2Qk9PeTNTQ0grMjFJMzZvT05adGMKLS0tIEIwd3NyQ0xWWkVBMFl4Z0VUVFBY + eWFlSFYrL1E1aXN2bVp5YTF5VXVOYUEK3NhyHGnY+a/Fj6TJFzljSX+49G9x5F3x + M16Nx7JGsD5IV6GfdiMYSEwgT1pm0/XY8rhvWBO1fArkleMz1HKewg== -----END AGE ENCRYPTED FILE----- - recipient: age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633 + recipient: age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOHFwemUyc2pEKzlibVBo - MlI4R0VTMHpwK21MaXZkSUp5dnIwUnVZOFRvCjVsM3FrclFJL0s2a1RwU1F2VXNF - MnRBOVUydFdEWXY3Mk9oTGw5Z05Zb28KLS0tIE9QRFdCVGR1Z0UyeE5KSzgrWnpP - Q25nZWx3bFdlek1OSjJsSk1QREdGRU0K++hDWzoKbBkGkMAkruuEwQKa1Jrc8POs - liN274cEdi1T6nmwBJ05w0alUR2XuYEn9HNKdvz8EntNuKIhCpHing== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWGpwUkRueVhhcVErQ0ZF + RXdxV1lMNzh6VFhubmc3TDBMaSsrYjhlS1Q0CnlZMmJSaXN5d1daRmpUVTlWeU1i + Nkxsd3JoTGpoelhiTXBMclhoL3RKQlEKLS0tIHRyQjk0akN3WnhKKy82T0ZOYTNK + QU5tYkZuTVc2Yzc0bzJrNXd1aWJMVlEKoMHFqDQYmT+q4eSNtmIb6drI/pFt9Z4W + gHI/QxeWQq6BWssk4EAonRXhIE0iJPOsXz2zyT+dRRDqcKBod9h01w== -----END AGE ENCRYPTED FILE----- recipient: age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3 lastmodified: "2026-03-15T15:06:29Z" diff --git a/modules/features/ssh.nix b/modules/features/ssh.nix index 80bdc82..01ed22f 100644 --- a/modules/features/ssh.nix +++ b/modules/features/ssh.nix @@ -266,6 +266,10 @@ in HostName = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57"; User = "root"; }; + "soteria" = { + HostName = "fded:fb16:653e:25da:be24:11ff:fe54:aa39"; + User = "root"; + }; "hermes" = { HostName = "192.168.1.150"; User = "root"; diff --git a/modules/hosts/soteria/default.nix b/modules/hosts/soteria/default.nix index c2a7351..65471e7 100644 --- a/modules/hosts/soteria/default.nix +++ b/modules/hosts/soteria/default.nix @@ -3,17 +3,22 @@ let username = "john"; hostname = "soteria"; + ipv4 = "192.168.1.233"; + ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39"; + names = [ "${hostname}.john-stream.com" ipv4 ipv6 ]; in { flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem { modules = with inputs.self.modules; [ nixos.lxc - nixos.mysops - nixos."${username}" - nixos.ssh-certs nixos.login-text + inputs.home-manager.nixosModules.home-manager + nixos."${username}" + nixos.ssh-new + # nixos.mtls + nixos.mysops + # nixos.ssh-certs nixos.docker - nixos.mtls nixos.step-client nixos.forgejo nixos.restic-server @@ -38,12 +43,7 @@ in mtls = { enable = true; subject = hostname; - san = [ - "${hostname}.john-stream.com" - # "192.168.1.142" - "forgejo.john-stream.com" - "192.168.1.244" - ]; + san = names; lifetime = "12h"; renew.onCalendar = "*:3/15"; renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ]; @@ -70,18 +70,24 @@ in loginText.extraServiceStatus = { Docker = "docker"; "mTLS Renewal" = "mtls-renew.timer"; - Forgejo = "forgejo.service"; + "Forgejo" = "forgejo.service"; "Forgejo Backup" = "forgejo-dump.timer"; "Restic REST Server" = "restic-rest-server.service"; }; - ssh-certs.hostname = hostname; + ssh-new.certificates = { + provisioner = "admin"; + host = { + enable = true; + extraPrincipals = names; + autoRenew = true; + }; + user.enable = true; + }; # This provides the secrets at install time sops.defaultSopsFile = ./secrets.yaml; - # programs.zsh.enable = true; - home-manager.users."${username}".imports = [ inputs.self.modules.homeManager.soteria ]; environment.systemPackages = [ @@ -93,10 +99,10 @@ in }; flake.modules.homeManager.soteria = { config, pkgs, lib, ... }: { - imports = [ - inputs.self.modules.homeManager.rebuild - inputs.self.modules.homeManager.mysops - inputs.self.modules.homeManager.step-client + imports = with inputs.self.modules.homeManager; [ + rebuild + mysops + step-client ({ config, pkgs, lib, ... }: { homeManagerFlakeDir = "${config.xdg.configHome}/home-manager"; docker.enable = true; @@ -107,12 +113,12 @@ in ]; }; - flake.homeConfigurations.soteria = withSystem "x86_64-linux" (ctx@{ config, inputs', ...}: - inputs.home-manager.lib.homeManagerConfiguration { - pkgs = inputs'.nixpkgs.legacyPackages; - modules = [ - inputs.self.modules.homeManager."${username}" - inputs.self.modules.homeManager.soteria - ]; - }); + # flake.homeConfigurations.soteria = withSystem "x86_64-linux" (ctx@{ config, inputs', ...}: + # inputs.home-manager.lib.homeManagerConfiguration { + # pkgs = inputs'.nixpkgs.legacyPackages; + # modules = [ + # inputs.self.modules.homeManager."${username}" + # inputs.self.modules.homeManager.soteria + # ]; + # }); } \ No newline at end of file diff --git a/modules/hosts/soteria/secrets.yaml b/modules/hosts/soteria/secrets.yaml index 5507c3c..f53179f 100644 --- a/modules/hosts/soteria/secrets.yaml +++ b/modules/hosts/soteria/secrets.yaml @@ -9,33 +9,33 @@ forgejo: restic_password: ENC[AES256_GCM,data:u7QOZXJkxVG4J75K5nphb2uJGdz6jbWuVSsKKu+41fshp7cVoRijtr/Cs02LjVse,iv:bt1W2FeBTG6ypBFYzMPXPIkYTSn0uHURY2ui6MRgYY8=,tag:DObAMws/zQcM+UKUe9EECA==,type:str] sops: age: - - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5QThHOFdVQ0F6ZDE3QXdL - QVF0WW5yRkNtNXIyRm1LeEhwY2dRRWo0WENZCmZoWmlXZDh4ZGlUR2JYOUxuaVAx - WjhXVHBMNWdrdkgvTENJR2RpWldkNTAKLS0tIEF1bS9JSnFTbytBa1U5RjVzWkd3 - S0pKVVI2RFN5a1BMYXBEY3VOUUM5QTAKNarYZm9DKRQhosSJBn9yryFxDkmFTV/o - i8b/tZ1ZybjEXX+X1EsgylM5u8iKkbEyUzqKO0E0gpg4qXSsJaMMYQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLM3NML2ozWExSTlY3ZXJH + ZEpaN1RIOWVjNXRRQTlLQVZKTUUvZnBxREd3Cmp6b29aRDlUdDFwMVhwS2thODNO + QzNWSVIrak1uMGRuUlBONkR2aW1nbXMKLS0tIDh2YmFaRXBvZ0Q2blhjTVphL3J3 + TkROaHdwWWN4YnkyczZLbDJYRTNrQTQKvHSXjP9EZkq9DrPZZHTIlFrPUhez6jZT + LJvkmQgKluer7+lWr8XuuqtQsvhtef1di82SBG6C6YK0zWIxrMjFkA== -----END AGE ENCRYPTED FILE----- - - recipient: age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633 - enc: | + recipient: age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdEN2M1lkMFoyQzg3bCsz - cVB0NUlkV1JPRjQ1TW5RSVFHUjdNMERoRXlzCk9tc25iMG00TkZjWjk2S2cyVE1J - cUFITDh2SkZGN0lpeWJVcWM3V3JrTTQKLS0tIENOWVBzTFYrdHRsMERwV0RKS01j - QVI5TVl4L0dwOWpoQ1I2THZ6cWovWGMKIo1x1ZbdTyr/dNlPhvuomfk2MoPLsHyU - N3CP3Scu3aZ7vqVua7uwtv4xQqyQI/yOnFjwxrVYPJ+N5Y/b4wsC6A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWThXZGtFSjFZVU1UWG9v + Wk9sVEVWemtVWTJ6TGlOd3ZhVUZBYnJ1OFFRClpFNmEwTG1PR0pQUFJuTTVVZGRD + bnpPdjZGVUJvS0NyWGJQbEV4cUlHZncKLS0tIDFNU1VxNjZYSks1OTMrblJPbDI1 + bHIrUnhsMWNhWVpVc3hCazlKTlV5YncKgR/AbgCE9JU8U8PH3ouYTZJOqL7rRODr + 5D2zT9pcTC3LQGZrhNtgjAi6IucU4yDAU7UhT3D7cZawwFTKVaoplw== -----END AGE ENCRYPTED FILE----- - - recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0 - enc: | + recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGSGQvL2ZYM2dtV1JWaDR1 - RjJnN0YwWFM4d1IwTElqUnZQQkVDTmdydUJjCjdCUWxCVDNXUHVLd2ZHcDA5L0Mw - cEVxVE84L2xmQnRoYmsxVEdMSEZjdGcKLS0tIHViRVJyTWt4Q3JrMWtYaS9QdHlS - Yjd0MUcxcExvWVpCOUR3MkdZdGQyWUkKnru0Y2A98+0Mps7EtVK7ct3vPqIGveUt - E5fzpcKvdefzObrx7BPTwJ19t2fZg/dSi7HKwx3vmKZSzyQaqJOzsg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3K054SHE0V1RCYlRlTXJT + bXo4ZnE1cFozY3R2dmg5S1BacC9xb2oweWpBClJJVnkrSytFaG8xR1l4SU5FNGxi + UndnNzYwMUlXSjRYK3c3MzI4NmRVRVEKLS0tIFQ4NFdPeGI4LytWK0JPcUV4VjM2 + b1dtYWdFTTFQcW5PQml2OWs1Z0VZOFUKrDX7y3cU8KPRLKlO/HI/jdynqwO1TAS0 + WY4F0qFKmWwsJJjbnjdpYYP3O1/8RNeXjnUg8fGYY75sf7iAYWSe/w== -----END AGE ENCRYPTED FILE----- + recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0 lastmodified: "2026-04-04T23:18:43Z" mac: ENC[AES256_GCM,data:qBgeli5lHb4pyA8nAADBuRBAaq8VbAIsFI37OZtgnbnoHW2crxo3YC+EknaIYnZpZ48kwVhQS5lGRjI6JsWWhTH3+LVAhTmS2Qj/pZTD/JDLK6XJGXS4U9nB7m9aGYyW8gFCy9/DfoJWGsS//+ZmUikKPfd5kMZgh1zGoYCIGug=,iv:h+2fA+bO2SMCNrEslP36x3BPRaIy25cU/DNX8CYSC6A=,tag:RvVyUZ4ONRaKaqGiT31eUQ==,type:str] unencrypted_suffix: _unencrypted