reorganize secrets

.sops.yaml

@@ -8,31 +8,31 @@ keys:
   - &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8
   - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c
 creation_rules:
-  - path_regex: secrets/toaster/[^/]+\.yaml$
+  - path_regex: hosts/toaster/[^/]+\.yaml$
     key_groups:
       - pgp:
         - *admin_oxa
         age:
         - *toaster
-  - path_regex: secrets/cloud/[^/]+\.yaml$
+  - path_regex: hosts/cloud/[^/]+\.yaml$
     key_groups:
       - pgp:
         - *admin_oxa
         age:
         - *cloud
-  - path_regex: secrets/minime/[^/]+\.yaml$
+  - path_regex: hosts/minime/[^/]+\.yaml$
     key_groups:
       - pgp:
         - *admin_oxa
         age:
         - *minime
-  - path_regex: secrets/auth/[^/]+\.yaml$
+  - path_regex: hosts/auth/[^/]+\.yaml$
     key_groups:
       - pgp:
         - *admin_oxa
         age:
         - *auth
-  - path_regex: secrets/radicale/[^/]+\.yaml$
+  - path_regex: hosts/radicale/[^/]+\.yaml$
     key_groups:
       - pgp:
         - *admin_oxa

hosts/auth/default.nix

@@ -6,7 +6,7 @@ in
   imports = [
     ./keycloak.nix
   ];
-  sops.defaultSopsFile = ../../secrets/auth/secrets.yaml;
+  sops.defaultSopsFile = ./secrets.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   sops.secrets = {

hosts/cloud/default.nix

@@ -1,10 +1,21 @@
-{ ... }:
+{ config, ... }:
 {
   imports = [
     ./configuration.nix
     ./hardware-configuration.nix
     ./networking.nix
     ./proxy
-    ./secrets.nix
   ];
+
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-mgmt" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
 }

hosts/cloud/secrets.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  sops.defaultSopsFile = ../../secrets/cloud/secrets.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-  sops.secrets = {
-    "wg/0xa-mgmt" = {
-      owner = config.users.users.systemd-network.name;
-    };
-    "wg/0xa-proxy" = {
-      owner = config.users.users.systemd-network.name;
-    };
-  };
-}

hosts/minime/default.nix

@@ -1,10 +1,18 @@
-{ ... }:
+{ config, ... }:
 {
   imports = [
     ./configuration.nix
     ./hardware-configuration.nix
     ./networking
-    ./secrets.nix
     ./zfs.nix
   ];
+
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-mgmt" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
 }

hosts/minime/secrets.nix

@@ -1,11 +0,0 @@
-{ config, ... }:
-{
-  sops.defaultSopsFile = ../../secrets/minime/secrets.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-  sops.secrets = {
-    "wg/0xa-mgmt" = {
-      owner = config.users.users.systemd-network.name;
-    };
-  };
-}

hosts/radicale/default.nix

@@ -3,7 +3,7 @@ let
   mac = "02:00:00:00:00:02";
 in
 {
-  sops.defaultSopsFile = ../../secrets/radicale/secrets.yaml;
+  sops.defaultSopsFile = ./secrets.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   sops.secrets = {

hosts/toaster/default.nix

@@ -1,15 +1,32 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
   imports = [
     ./amd.nix
     ./hardware-configuration.nix
     # ./irc.nix
     ./network
-    ./secrets.nix
     ./secure-boot.nix
     ./zfs.nix
   ];
 
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/zw" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wg/dvb" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wg/mullvad" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wg/0xa-mgmt" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
   nixpkgs.config.allowUnfree = true;
 
   # Use the systemd-boot EFI boot loader.

hosts/toaster/secrets.nix

@@ -1,20 +0,0 @@
-{ config, ... }:
-{
-  sops.defaultSopsFile = ../../secrets/toaster/secrets.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-  sops.secrets = {
-    "wg/zw" = {
-      owner = config.users.users.systemd-network.name;
-    };
-    "wg/dvb" = {
-      owner = config.users.users.systemd-network.name;
-    };
-    "wg/mullvad" = {
-      owner = config.users.users.systemd-network.name;
-    };
-    "wg/0xa-mgmt" = {
-      owner = config.users.users.systemd-network.name;
-    };
-  };
-}