home/nixos-servers
home/nixos-servers
Archived
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

Replace agenix with sops-nix

Browse source
This commit is contained in:
Pim Kunis 2024-06-15 22:27:07 +02:00
parent bb1f091fbb
commit 726beabb9c
33 changed files with 296 additions and 332 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nixos-modules/backups.nix
View file

@ -1,4 +1,4 @@
{ self, pkgs, lib, config, ... }:
{ pkgs, lib, config, ... }:
let
cfg = config.lab.backups;
@ -19,12 +19,12 @@ let
}
];
ssh_command = "${pkgs.openssh}/bin/ssh -i ${config.age.secrets."borgbase.pem".path} -o StrictHostKeychecking=no";
ssh_command = "${pkgs.openssh}/bin/ssh -i ${config.sops.secrets."borg/borgbasePrivateKey".path} -o StrictHostKeychecking=no";
keep_daily = 7;
keep_weekly = 4;
keep_monthly = 12;
keep_yearly = -1;
encryption_passcommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets."borg_passphrase".path}";
encryption_passcommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg/borgPassphrase".path}";
};
};
in
@ -67,7 +67,7 @@ in
IOWeight = 100;
Restart = "no";
LogRateLimitIntervalSec = 0;
Environment = "BORG_PASSPHRASE_FILE=${config.age.secrets."borg_passphrase".path}";
Environment = "BORG_PASSPHRASE_FILE=${config.sops.secrets."borg/borgPassphrase".path}";
};
script = "${pkgs.systemd}/bin/systemd-inhibit --who=\"borgmatic\" --what=\"sleep:shutdown\" --why=\"Prevent interrupting scheduled backup\" ${pkgs.borgmatic}/bin/borgmatic --verbosity -2 --syslog-verbosity 1 -c ${borgmaticConfig}";
@ -83,9 +83,9 @@ in
};
};
age.secrets = {
"borg_passphrase".file = "${self}/secrets/borg_passphrase.age";
"borgbase.pem".file = "${self}/secrets/borgbase.pem.age";
sops.secrets = {
"borg/borgPassphrase" = { };
"borg/borgbasePrivateKey" = { };
};
};
}

48
nixos-modules/k3s/default.nix
View file

@ -1,4 +1,4 @@
{ self, inputs, pkgs, lib, config, ... }:
{ inputs, pkgs, lib, config, ... }:
let cfg = config.lab.k3s;
in {
options.lab.k3s = {
@ -56,7 +56,7 @@ in {
{
enable = true;
role = cfg.role;
tokenFile = config.age.secrets.k3s-server-token.path;
tokenFile = config.sops.secrets."k3s/serverToken".path;
extraFlags = lib.mkIf (cfg.role == "server") serverFlags;
clusterInit = cfg.clusterInit;
serverAddr = lib.mkIf (! (cfg.serverAddr == null)) cfg.serverAddr;
@ -101,38 +101,18 @@ in {
};
};
age.secrets = {
k3s-server-token.file = "${self}/secrets/k3s-server-token.age";
k3s-server-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/server-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/server-ca.key";
sops.secrets =
let
keyPathBase = "/var/lib/rancher/k3s/server/tls";
in
{
"k3s/serverToken" = { };
"k3s/keys/clientCAKey".path = "${keyPathBase}/client-ca.key";
"k3s/keys/requestHeaderCAKey".path = "${keyPathBase}/request-header-ca.key";
"k3s/keys/serverCAKey".path = "${keyPathBase}/server-ca.key";
"k3s/keys/serviceKey".path = "${keyPathBase}/service.key";
"k3s/keys/etcd/peerCAKey".path = "${keyPathBase}/etcd/peer-ca.key";
"k3s/keys/etcd/serverCAKey".path = "${keyPathBase}/etcd/server-ca.key";
};
k3s-client-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/client-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/client-ca.key";
};
k3s-request-header-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/request-header-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/request-header-ca.key";
};
k3s-etcd-peer-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/etcd/peer-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/etcd/peer-ca.key";
};
k3s-etcd-server-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/etcd/server-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/etcd/server-ca.key";
};
k3s-service-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/service.key.age";
path = "/var/lib/rancher/k3s/server/tls/service.key";
};
};
};
}