From ef87477cefc0c4fcce01f34f079a0c64fc77df59 Mon Sep 17 00:00:00 2001 From: Leonhard Kost Date: Thu, 12 Feb 2026 11:09:52 +0100 Subject: [PATCH] feat: use sops-nix bc it has better docs than agenix and git-crypt still leaks to the store --- .gitattributes | 1 - .sops.yaml | 7 +++++++ flake.lock | 23 ++++++++++++++++++++++- flake.nix | 3 +++ nixos/server/default.nix | 2 ++ nixos/server/dyndns/default.nix | 3 ++- nixos/server/dyndns/nc.env.secret | Bin 204 -> 0 bytes nixos/server/secrets/default.nix | 12 ++++++++++++ nixos/server/secrets/dyndns.env | 10 ++++++++++ 9 files changed, 58 insertions(+), 3 deletions(-) delete mode 100644 .gitattributes create mode 100644 .sops.yaml delete mode 100644 nixos/server/dyndns/nc.env.secret create mode 100644 nixos/server/secrets/default.nix create mode 100644 nixos/server/secrets/dyndns.env diff --git a/.gitattributes b/.gitattributes deleted file mode 100644 index 195a277..0000000 --- a/.gitattributes +++ /dev/null @@ -1 +0,0 @@ -*.secret filter=git-crypt diff=git-crypt diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..f5be6f3 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,7 @@ +keys: + - &server age1cma8j2jk0jmzgttjmqn06l87u4as9k46yzmvetflzqp995wzdsgsjppacx +creation_rules: + - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ + key_groups: + - age: + - *server diff --git a/flake.lock b/flake.lock index d92446f..2d2c7d2 100644 --- a/flake.lock +++ b/flake.lock @@ -172,7 +172,28 @@ "home-manager": "home-manager", "nixpkgs": "nixpkgs", "nixpkgs-unstable": "nixpkgs-unstable", - "nixvim": "nixvim" + "nixvim": "nixvim", + "sops-nix": "sops-nix" + } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1770683991, + "narHash": "sha256-xVfPvXDf9QN3Eh9dV+Lw6IkWG42KSuQ1u2260HKvpnc=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "8b89f44c2cc4581e402111d928869fe7ba9f7033", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" } }, "systems": { diff --git a/flake.nix b/flake.nix index 9a4eae4..2cc66ec 100644 --- a/flake.nix +++ b/flake.nix @@ -8,6 +8,9 @@ nixvim.url = "github:nix-community/nixvim/nixos-25.11"; nixvim.inputs.nixpkgs.follows = "nixpkgs"; + + sops-nix.url = "github:Mic92/sops-nix"; + sops-nix.inputs.nixpkgs.follows = "nixpkgs"; }; outputs = diff --git a/nixos/server/default.nix b/nixos/server/default.nix index c2b9530..1c528eb 100644 --- a/nixos/server/default.nix +++ b/nixos/server/default.nix @@ -9,6 +9,8 @@ (import ../base.nix { inherit inputs outputs; }) ./hardware-configuration.nix ./config.nix + inputs.sops-nix.nixosModules.sops + ./secrets ./dyndns ]; diff --git a/nixos/server/dyndns/default.nix b/nixos/server/dyndns/default.nix index 0a82558..1d49985 100644 --- a/nixos/server/dyndns/default.nix +++ b/nixos/server/dyndns/default.nix @@ -1,4 +1,5 @@ { + config, pkgs, ... }: @@ -28,7 +29,7 @@ in Type = "oneshot"; User = "dyndns"; ExecStart = "${pyenv.interpreter} ${./dyndns.py}"; - EnvironmentFile = ./. + "/nc.env.secret"; + EnvironmentFile = config.sops.secrets.dyndns.path; }; }; } diff --git a/nixos/server/dyndns/nc.env.secret b/nixos/server/dyndns/nc.env.secret deleted file mode 100644 index e40373c03ba5e552cce0d6cd6b05ba493d7051fa..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 204 zcmZQ@_Y83kiVO&02tBar;RNoFoi@^X%qG7TE&blidL|*yutYA)u{ojZ-!dMx!VTV@ zo~ylMHzc32uxhheK3$_wO!rmG0`H9bYx!2ZU^3fmC)L4pZt+Im(gyQ}4GGUTZ@+f@ zVD`59lar_1VL$!!CsVD#|AIc%Kensw<_EnLYhVd_86Ws*+se7iCv6wBm)7aMk>Hq7CKBcK*sW15cU@BEtT+8N9G~xbB}Sxn7TW#jS+Qxu-3-?Y NOR6rvzP$6+TL8MEV;}$k diff --git a/nixos/server/secrets/default.nix b/nixos/server/secrets/default.nix new file mode 100644 index 0000000..e490413 --- /dev/null +++ b/nixos/server/secrets/default.nix @@ -0,0 +1,12 @@ +{ + config, + ... +}: +{ + sops.secrets.dyndns = { + format = "dotenv"; + sopsFile = ./dyndns.env; + mode = "0400"; + owner = config.systemd.services.dyndns.serviceConfig.User; + }; +} diff --git a/nixos/server/secrets/dyndns.env b/nixos/server/secrets/dyndns.env new file mode 100644 index 0000000..45920c5 --- /dev/null +++ b/nixos/server/secrets/dyndns.env @@ -0,0 +1,10 @@ +NC_DOMAIN=ENC[AES256_GCM,data:q4yNX+QAzptwBo82PWL2XlJmaV4PL8o=,iv:09/3DcXAH9/86dPyblRfbc3ILuUmUzgRUjX0KIuQmOU=,tag:N3Ad0vfuz2Li9pra7laEpA==,type:str] +NC_CUSTOMER=ENC[AES256_GCM,data:tqi91SnB,iv:OGwGNi298lHvcTuOi9tavb3Z+td7XzEk8A73tvRbQew=,tag:ivXW4uCirxja5PIZaGc/HA==,type:str] +NC_API_PASSWORD=ENC[AES256_GCM,data:PJ/ppYER5nXAJTUD+eD2BS8jwuqLrb6dXfc5lfhL8vzYeCCvmRyTrvsfMLYFA8rC1VQ=,iv:3LsvJoPuq7YSKK93YNDBFmJmSaNF9VMPmAhL9mr5vjI=,tag:OozQp5V+A2ZsBll94vQtpw==,type:str] +NC_API_KEY=ENC[AES256_GCM,data:LzfK825771pwYAoHEzaDh+5D9LyA29e3Jq9SLZTaCCtHz98r8uIhwZpWCFWU3hfU+xw=,iv:yAo1/DiSbl5T49X6EWlbhdYTOcZwuDw3AFlVbj/KlrM=,tag:sW1ahTqAcekhhv+5ctefUg==,type:str] +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOOFdSQnlXODBHMlIvRjNK\nQUN6N0Z5b2tZZWk0elZHWXZZSlk3YkEzOTJ3CkdIWmg0dFpCdkQ2ek4wRllHeUpE\nQUpXWHhSRG9aeHAvamJLeGQvUnFUYjQKLS0tIGdsNG5WMDVvbEl2NnU0OGpkMTF1\nTGdaVGhBaEJ1bGNNZi9ReUI0TmJaMXMKE5Zg7MwjkKHSNceY3kRomMAgqXnN2slq\ndGM1s1MVZ83x3AdKTxCfhPXOqHCTgdpHpvvCq+EqntB2Tze/SVApSw==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age1cma8j2jk0jmzgttjmqn06l87u4as9k46yzmvetflzqp995wzdsgsjppacx +sops_lastmodified=2026-02-12T09:56:38Z +sops_mac=ENC[AES256_GCM,data:sixevaa0DdTDFqYkCT6giO/OjOeI3Z4OWP10zXazHoiRODXMnU4O4CwfHvzPbD0z0lLCUNe1lF9vCQgQhhxw09Ose3XOZXspcdO95aea+705cgA9uSAxA5Sms7eFGdhWFAHaOYI/Up9OYFtzDO2CJN4XYY9IinnkfEwlpoXog3g=,iv:NRUGvsOYhB6t1qgvaiXvam91jUOOgvirmJ+Exuldmhc=,tag:Uo4+n5umEHGpszz4B8p8+w==,type:str] +sops_unencrypted_suffix=_unencrypted +sops_version=3.11.0