mirror of
https://github.com/nickolaj-jepsen/nixos.git
synced 2026-01-22 08:06:50 +01:00
21 lines
642 B
Nix
21 lines
642 B
Nix
{config, ...}: let
|
|
inherit (config.fireproof) hostname;
|
|
hostSecrets = ../../secrets/hosts + ("/" + hostname);
|
|
publicKey = builtins.readFile (hostSecrets + "/id_ed25519.pub");
|
|
in {
|
|
age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
|
age.rekey = {
|
|
storageMode = "local";
|
|
hostPubkey = publicKey;
|
|
masterIdentities = [
|
|
{
|
|
identity = ../../secrets/yubikey-identity.pub;
|
|
}
|
|
];
|
|
extraEncryptionPubkeys = [
|
|
"age1pzrfw28f8qvsk9g8p2stundf4ph466jut0g6q47sse76zljtqy9q2w32zr" # Backup key (bitwarden)
|
|
];
|
|
localStorageDir = hostSecrets + /.rekey;
|
|
generatedSecretsDir = hostSecrets;
|
|
};
|
|
}
|