diff --git a/modules/security/secrets/.sops.yaml b/modules/security/secrets/.sops.yaml index e7d1b6b..f7eae63 100644 --- a/modules/security/secrets/.sops.yaml +++ b/modules/security/secrets/.sops.yaml @@ -1,9 +1,13 @@ keys: - &computer-mo age1yw3dt8myjpq3hek6gadzy8jd04l30ladgva7p74ktl7plfkwqs8qmk8c4x - &mo age1nkqrkx782x6hnn5l8trh2e4v5pgygkx2ql4w8m20pc9jzsq244zs8d44qw + - &deck age18eu0gy9uhyeppljlq2faqnhlmtxmkx9up75x27h3mn5zrpz8ncgsf7fhfw + - &nadine age14r5jdwjan0ft0zerz7jtgqlr7hzzcuruvqnyqfp3l48cr0jdwuhsqkj4sq creation_rules: - path_regex: secrets.yaml$ key_groups: - age: - *computer-mo - *mo + - *deck + - *nadine diff --git a/modules/security/secrets/secrets.yaml b/modules/security/secrets/secrets.yaml index 0fdf72c..eebb70d 100644 --- a/modules/security/secrets/secrets.yaml +++ b/modules/security/secrets/secrets.yaml @@ -17,20 +17,38 @@ sops: - recipient: age1yw3dt8myjpq3hek6gadzy8jd04l30ladgva7p74ktl7plfkwqs8qmk8c4x enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDMzF6WTZXRitScFpKdG1m - aHBnaThnTmkyanYrL0pIWGlSRXhlTUVzQ1RFCnJYZXBXeHBnN3dWSjFUbDdCb2tZ - NU5ZTE82VXltMVJLT3YzSVRIRWpUWkUKLS0tIHhtcno4WmJ6d0Y2NWkrOTZiWkNS - Y2xSUE0veVdCaERFUXpVeHdoVUd5V2MKV3DDB8WfAJkZ91MdWzz5Yi0D2u8ozeEi - AQY7by2kpV4oJWG96zu6grR1FU/jNqaC+qTCtIcb3/e7pK9pHdstow== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlVktUNitRVTVxdmxRM3Vv + cVJWOHlqNDY5WUNhVEJlMENIVmNReW5zK1E0CnNYY3h6TWxWOEI1bGt0QUV2Nk1E + bXVkTGJINldZRStrM054L0JJV0xvSncKLS0tIFZtYXZ1L3I2K2x4VlYvYkU4Mm1K + NzIzWkltSDlXK0dxdFVNakk4U2NVSzAKBkuVkOHwRHWUkwV4ivwqtK0E5JmToNT/ + 81bYB7ty4a0iJtR52snAV5x9e2KrhgHlpwjagjeCo02n3Ejpa47RoA== -----END AGE ENCRYPTED FILE----- - recipient: age1nkqrkx782x6hnn5l8trh2e4v5pgygkx2ql4w8m20pc9jzsq244zs8d44qw enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTFcwZnB5RGNNZWQyY2JR - ekg1c05BSU9Qay9RYlkxT3pCWlB4T2VJd1VJCmpuc08yZlhZRS93cnpoS0lBeFVY - ME1xQUtIcDc0aHJqVmJjUy9BbjhCMG8KLS0tIHpsMGVLSlhKc3JUTlhnTE1HbVUv - RVVGdEM3UFg5Y0ZhQmlJTGg1eUQxU1UK0U3aR79JWeFyvQRDVVmyICh1UTDIIeai - 6E87FDE9XRhAbneR5sHw4ujnZCSyX7njfDMpN23dpWX3smRRKVIsNQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrcVF2N0ZYVmJCTnhudEZC + eDdZTUVZd1lUWWE5L3FnUW9EbGFjUmZyQWh3Ck52ZGhvemYyakM3M3ZwT0d2Rmpq + ZXVCSjIwcGU4QnJGVTRTLzNHSGlQa28KLS0tIG9SUDhxU3BqU2VoT1NDNUEweVdB + Q2dGai9SQTgvbGNYVG5ZYllPWFBmQWsKSttlEZLdG/JMLHOkDUueHga3c5fa+Y8L + 6UFRIprJZBu/kPBzIZmHtKFKaAs3TfJ4KaQMMg2F+49Nrv1cMYPPJg== + -----END AGE ENCRYPTED FILE----- + - recipient: age18eu0gy9uhyeppljlq2faqnhlmtxmkx9up75x27h3mn5zrpz8ncgsf7fhfw + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5SUMxcTNrQnhTZUJnUmFW + cU5mU1F0aUM3OHFoZmE3TVpzNUgzZ1c0WUFVClU2YWNBRmI2Z2JGMlBLa0g1Q05G + RkxYTGhJcDNjS0o4UDcwRi8yZWJXMVkKLS0tIG1IRkJ5Vzk2bnBzV0t3U2lpT1N0 + enkxR0hGZVZvWTVkZnY4RW1DZXQrUHcKTCBoJZOYRjQVbJdv6HTN36KmlOOkjnO1 + 1MnVVi8Iy5AfoJ4S+zYuExgAnpxvJE2OlDMZB7kfRAKHBo2xgoqjBw== + -----END AGE ENCRYPTED FILE----- + - recipient: age14r5jdwjan0ft0zerz7jtgqlr7hzzcuruvqnyqfp3l48cr0jdwuhsqkj4sq + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwbG8rOTZDQ0RsOVhKYmR1 + a2I0Q050Qk1BQVdCc0V0aE92N053ZzFqbkdRCkhDNmRMZVd1VU5OZFozMCs0Vi9O + OEVPVDBib1RJei9SWkUwOUlOZkxSQTgKLS0tIG82OVQ3amdJcFY1OFdIUUs2YklV + cHJwSXV0cklmZHVuc1FLSFhPMm9jT0kKAD9kjdxt0r+PnbDU2qNFT326/raBTvn1 + YKNGXFNMfUb3mVPwJxJQ4W72pvIRxTp9SaTzrCZypk+l1U/JgExEOA== -----END AGE ENCRYPTED FILE----- lastmodified: "2026-03-04T19:16:00Z" mac: ENC[AES256_GCM,data:WuBte+LcIsI5z20OGMQ4A+gd5QxxM6MfIQ1Q0ZvVt8fbCRncweQyF7qBvhBi7l6XvUj6WECjJ1Oxm6mep4Bd4XXJhEjzwXCImvXfHAK4YQPoo5e7+r1WyaQih7zceaH9lfIYv1mijvrTW9KWHFzaNHiwK5LzeT5H3KWAPj5y2aE=,iv:WHv6oK5OgI18jXuwqqLSOxlEcsi+MSoZeXVFD+UyM1U=,tag:V34xzu8F24/UO2oPMS8j4Q==,type:str] diff --git a/modules/users/sys/mo.nix b/modules/users/sys/mo.nix index 9851398..6dc6f33 100644 --- a/modules/users/sys/mo.nix +++ b/modules/users/sys/mo.nix @@ -4,6 +4,11 @@ sops.secrets."users/mo/password" = { neededForUsers = true; }; + sops.secrets."ssh/intern/public" = { + owner = "mo"; + path = "/home/mo/.ssh/authorized_keys"; + mode = "0600"; + }; users.mutableUsers = false; users.users.mo = { isNormalUser = true; @@ -12,7 +17,6 @@ shell = pkgs.zsh; hashedPasswordFile = config.sops.secrets."users/mo/password".path; }; - home-manager.users.mo = { home.username = "mo"; home.homeDirectory = "/home/mo";