chaos/nixfiles
1
0
Fork 0
Code Issues 2 Releases Activity

change secret path?

Browse source
This commit is contained in:
chaos 2023-09-20 15:59:18 +01:00
parent 1223d1b98b
commit c0da687901
No known key found for this signature in database
2 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
hosts/vault/secrets.nix
View file

@ -12,7 +12,7 @@
}; };
requiredVaultPaths = [ requiredVaultPaths = [
"/private-public-keys/ssh/root@vault-decrypt" "/private-public-keys/data/ssh/root@vault-decrypt"
"private-public-keys/data/restic/Vault" "private-public-keys/data/restic/Vault"
@ -28,10 +28,9 @@
# but it makes it easier to install. # but it makes it easier to install.
# it's stored in /nix store anyway # it's stored in /nix store anyway
ssh_host_ed25519_key = { ssh_host_ed25519_key = {
path = "/initrd_secrets/ssh_host_ed25519_key"; path = "/ssh_host_ed25519_key";
permissions = "600"; permissions = "600";
fetchScript = '' fetchScript = ''
[ ! -d "$SYSROOT/initrd_secrets" ] && mkdir -p "$SYSROOT/initrd_secrets"
simple_get "/private-public-keys/ssh/root@vault-decrypt" .private | base64 > "$secretFile" simple_get "/private-public-keys/ssh/root@vault-decrypt" .private | base64 > "$secretFile"
''; '';
}; };

2
presets/nixos/serverEncryptedDrive.nix
View file

@ -40,7 +40,7 @@ in {
secrets = { secrets = {
# This will need to be generated before install or installed with secrets-init # This will need to be generated before install or installed with secrets-init
# To keep it same across reinstalls add the ssh key and pubkey to secrets module # To keep it same across reinstalls add the ssh key and pubkey to secrets module
"/ssh_host_ed25519_key" = mkForce "/initrd_secrets/ssh_host_ed25519_key"; "/ssh_host_ed25519_key" = "/ssh_host_ed25519_key";
}; };
luks = { luks = {