home/nixos-servers
home/nixos-servers
Archived
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

Replace agenix with sops-nix

Browse source
This commit is contained in:
Pim Kunis 2024-06-15 22:27:07 +02:00
parent bb1f091fbb
commit 726beabb9c
33 changed files with 296 additions and 332 deletions
Download patch file Download diff file Expand all files Collapse all files

9
flake-parts/scripts/bootstrap.sh
View file

@ -34,13 +34,14 @@ cleanup() {
trap cleanup EXIT
# Create directory where age key will go.
# Nixos-anwhere creates a kind of overlay and retains this structure on the final file system.
mkdir "$temp/etc"
# Nixos-anywhere creates a kind of overlay and retains this structure on the final file system.
mkdir -p "$temp/root/.config/sops/age"
secret-tool lookup age-identity "$servername" > "$temp/etc/age_ed25519"
# Extract and copy server's age key.
sops -d --extract "[\"${servername}\"]" secrets/serverKeys.yaml > "$temp/root/.config/sops/age/keys.txt"
# Set the correct permissions
chmod 600 "$temp/etc/age_ed25519"
chmod 600 "$temp/root/.config/sops/age/keys.txt"
# Install NixOS to the host system with our age identity
nixos-anywhere --extra-files "$temp" --flake ".#${servername}" "root@${hostname}"

2
flake-parts/scripts/default.nix
View file

@ -16,7 +16,7 @@ in
{
packages.bootstrap = createScript {
name = "bootstrap";
runtimeInputs = with pkgs; [ libsecret coreutils nixos-anywhere ];
runtimeInputs = with pkgs; [ sops coreutils nixos-anywhere ];
scriptPath = ./bootstrap.sh;
};