36 lines
1.2 KiB
Nix
36 lines
1.2 KiB
Nix
{...}: {
|
|
services.secrets = {
|
|
enable = true;
|
|
secrets = {
|
|
# Used for fetching the encryption drive's key at runtime
|
|
# can be revoked in case of hardware theft
|
|
# Can also run vault-login on host before secrets-init to fetch secrets using raspberry's login
|
|
vault_login_password = {
|
|
manual = true;
|
|
};
|
|
|
|
home-wifi-password = {
|
|
user = "root";
|
|
group = "root";
|
|
permissions = "600";
|
|
path = "/etc/NetworkManager/system-connections/Home-WiFi.nmconnection";
|
|
|
|
fetchScript = ''
|
|
ssid=$(simple_get "/passwords/wifi/parentals-home" .ssid)
|
|
password=$(simple_get "/passwords/wifi/parentals-home" .password)
|
|
|
|
# Create path to if doesn't exist, useful for when using secrets-init on another host
|
|
if [ ! -d "$SYSROOT/etc/NetworkManager/system-connections" ]; then
|
|
mkdir -p "$SYSROOT/etc/NetworkManager/system-connections"
|
|
fi
|
|
|
|
cp ${./data/wifi-nmconnection.template} "$secretFile"
|
|
sed -i "s/WIFI_ID/Home-WiFi/" "$secretFile"
|
|
sed -i "s/WIFI_SSID/$ssid/" "$secretFile"
|
|
sed -i "s/WIFI_PASSWORD/$password/" "$secretFile"
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|