dotfiles.nix/nixos/common/global/age.nix

31 lines
914 B
Nix
Raw Normal View History

2024-01-21 22:32:25 +08:00
{ config, pkgs, inputs, ... }:
2024-01-21 21:03:57 +08:00
let
hostname = config.networking.hostName;
in
{
2024-01-21 22:32:25 +08:00
imports = [
inputs.agenix.nixosModules.default
inputs.agenix-rekey.nixosModules.default
];
2024-01-21 21:03:57 +08:00
environment.systemPackages = with pkgs; [
agenix-rekey
];
age = {
# Master identity used for decryption
rekey.masterIdentities = [ ../users/sajenim/agenix-rekey.pub ];
# Pubkey for rekeying
rekey.hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
2024-01-21 22:18:12 +08:00
# Where we store the rekeyed secrets
2024-01-21 21:03:57 +08:00
rekey.cacheDir = "/var/tmp/agenix-rekey/\"$UID\"";
};
# Required to persist `/var/tmp/agenix-rekey`
environment.persistence."/persist".directories = [
{ directory = "/var/tmp/agenix-rekey"; mode = "1777"; }
];
2024-01-21 22:18:12 +08:00
# As user not a trusted-users in our nix.conf
# we must add age.rekey.cacheDir as a global extra sandbox path
nix.settings.extra-sandbox-paths = [ "/var/tmp/agenix-rekey" ];
2024-01-21 21:03:57 +08:00
}