cleanup secrets

move secrets out of the repo

move secrets

cleanup secrets

common/default.nix

@@ -1,3 +1,3 @@
 { ... }: {
-  imports = [ ./nix.nix ./secrets.nix ./users.nix ];
+  imports = [ ./nix.nix ./sops.nix ./users.nix ];
 }

common/sops.nix

@@ -0,0 +1,23 @@
+{ config, ... }: {
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+    age = {
+      keyFile = "/persist/sops/age/keys.txt";
+      sshKeyPaths = [ "/persist/system/etc/ssh/keys/ssh_host_ed25519_key" ];
+    };
+    secrets = {
+      "passwd/root" = {
+        mode = "400";
+        owner = config.users.users.root.name;
+        group = config.users.users.root.group;
+        neededForUsers = true;
+      };
+      "passwd/adtya" = {
+        mode = "400";
+        owner = config.users.users.root.name;
+        group = config.users.users.root.group;
+        neededForUsers = true;
+      };
+    };
+  };
+}

common/users.nix

@@ -7,7 +7,7 @@
     adtya = {
       uid = 1000;
       hashedPasswordFile = config.sops.secrets."passwd/adtya".path;
-      description = "Adithya";
+      description = "Adithya Nair";
       isNormalUser = true;
       extraGroups = [ "docker" "libvirtd" "networkmanager" "tss" "wheel" ];
       shell = pkgs.zsh;

home/programs/git.nix

@@ -1,8 +1,4 @@
-{ secrets, ... }:
+{ osConfig, ... }: {
-let
-  user = secrets.users;
-in
-{
   programs.git = {
     enable = true;
     delta = {
@@ -12,10 +8,10 @@ in
         syntax-theme = "Dracula";
       };
     };
-    userEmail = user.primary.emailAddress;
+    userEmail = "adtya@adtya.xyz";
-    userName = user.primary.realName;
+    userName = osConfig.users.users.adtya.description;
     signing = {
-      key = user.primary.pgpFingerprint;
+      key = "51E4F5AB1B82BE45B4229CC243A5E25AA5A27849";
       signByDefault = true;
     };
     extraConfig = {

hosts/skipper/services/default.nix

@@ -1,8 +1,4 @@
-{ secrets, ... }:
+{ config, ... }: {
-let
-  user = secrets.users;
-in
-{
   imports = [
     ./btrfs.nix
     ./dbus.nix
@@ -15,7 +11,7 @@ in
     cpupower-gui.enable = true;
     fstrim.enable = true;
     fwupd.enable = true;
-    getty.autologinUser = user.primary.userName;
+    getty.autologinUser = config.users.users.adtya.name;
     gnome.gnome-keyring.enable = true;
     gvfs.enable = true;
     irqbalance.enable = true;

secrets.nix.example

@@ -4,16 +4,4 @@
     endpoint = "<endpoint>:<port>";
     publicKey = "<public key>";
   };
-  users = {
-    root.hashedPassword = "<password hash of root user>";
-    primary = {
-      userName = "<primary non-root username>";
-      realName = "<primary user's full name>";
-      hashedPassword = "<password hash of primary user>";
-      pgpFingerprint = "<primary user's pgp fingerprint>";
-      emailAddress = "<primary user's email>";
-      sshPublicKey = "<ssh public key>";
-    };
-  };
-  phone.sshPublicKey = "<ssh public key from phone>";
 }