nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Working on secrets

Browse Source
This commit is contained in:
niten
2021-04-22 11:38:52 -07:00
parent 5d572b3726
commit 962abd52e7
4 changed files with 98 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/host-config/limina.nix
+3 -9
View File
@@ -15,11 +15,6 @@ let
in {
config = {
# TODO: remove?
nixpkgs.config.permittedInsecurePackages = [
"openssh-with-gssapi-8.4p1" # CVE-2021-28041
];
networking = {
interfaces = {
enp1s0 = { useDHCP = true; };
@@ -64,11 +59,10 @@ in {
network-definition = config.fudo.networks.${domain-name};
};
secrets = {
backplane-client-limina-passwd = {
secrets.limina = {
backplane-client-passwd = {
source-file = /srv/secrets/backplane-client/limina.passwd;
target-file = "/srv/backplane/dns/client.passwd";
target-host = "limina";
user = config.fudo.client.dns.user;
};
};
@@ -80,7 +74,7 @@ in {
user = "fudo-client";
external-interface = "enp1s0";
password-file =
config.fudo.secrets.backplane-client-limina-passwd.target-file;
config.fudo.secrets.limina.backplane-client-passwd.target-file;
};
garbage-collector = {
config/host-config/plato.nix
+38 -15
View File
@@ -1,14 +1,47 @@
{ config, lib, pkgs, ... }:
with lib;
let primary-ip = "10.0.0.21";
let
primary-ip = "10.0.0.21";
deploy-group = "nixops-deploy";
secrets-path = /srv/secrets;
in {
config = {
users.groups = { ${deploy-group} = { members = [ "niten" ]; }; };
# TODO: remove?
nixpkgs.config.permittedInsecurePackages = [
"openssh-with-gssapi-8.4p1" # CVE-2021-28041
];
systemd = let secrets-watcher-name = "secrets-ownership-fixer";
in {
paths.${secrets-watcher-name} = {
description = "Watch ${secrets-path} and correct perms on change.";
wantedBy = [ "multi-user.target" ];
pathConfig = {
PathChanged = secrets-path;
Unit = "${secrets-watcher-name}.service";
};
};
services.${secrets-watcher-name} = {
wantedBy = [ "multi-user.target" ];
description = "Correct perms on ${secrets-path}.";
serviceConfig = {
ExecStart = pkgs.writeShellScript "${secrets-watcher-name}.sh" ''
chown -R root:${deploy-group} ${secrets-path}
chmod -R ug=rX,o= ${secrets-path}
'';
};
};
tmpfiles.rules = [
"L /root/.gnupg - - - - /state/root/gnupg"
# "L /root/.emacs.d - - - - /state/root/emacs.d"
"L /root/.ssh/id_rsa - - - - /state/root/ssh/id_rsa"
"L /root/.ssh/id_rsa.pub - - - - /state/root/ssh/id_rsa.pub"
"L /root/.ssh/known_hosts - - - - /state/root/ssh/known_hosts"
"L /etc/ssh/ssh_host_ed25519_key - - - - /state/ssh/ssh_host_ed25519_key"
"L /etc/ssh/ssh_host_rsa_key - - - - /state/ssh/ssh_host_rsa_key"
];
};
environment.etc = {
nixos.source = "/state/nixos";
@@ -35,16 +68,6 @@ in {
Defaults lecture = never
'';
systemd.tmpfiles.rules = [
"L /root/.gnupg - - - - /state/root/gnupg"
# "L /root/.emacs.d - - - - /state/root/emacs.d"
"L /root/.ssh/id_rsa - - - - /state/root/ssh/id_rsa"
"L /root/.ssh/id_rsa.pub - - - - /state/root/ssh/id_rsa.pub"
"L /root/.ssh/known_hosts - - - - /state/root/ssh/known_hosts"
"L /etc/ssh/ssh_host_ed25519_key - - - - /state/ssh/ssh_host_ed25519_key"
"L /etc/ssh/ssh_host_rsa_key - - - - /state/ssh/ssh_host_rsa_key"
];
networking = {
defaultGateway = {
address = "10.0.0.1";
config/host-config/procul.nix
+21 -7
View File
@@ -71,13 +71,24 @@ in {
fudo = {
hosts.procul.external-interfaces = [ "extif0" ];
secrets = {
backplane-client-limina-passwd = {
secrets.procul = {
backplane-client-passwd = {
source-file = /srv/secrets/backplane-client/procul.passwd;
target-file = "/srv/backplane/dns/client.passwd";
target-host = "procul";
user = config.fudo.client.dns.user;
};
postgres-keytab = {
source-file = /srv/secrets/kerberos/procul-postgres.keytab;
target-file = "/srv/postgres/secure/postgres.keytab";
user = "root";
};
gitea-database-password = {
source-file = /srv/secrets/gitea/procul-database.passwd;
target-file = "/srv/gitea/secure/database.passwd";
user = config.fudo.git.user;
};
};
client.dns = {
@@ -86,7 +97,8 @@ in {
ipv6 = true;
user = "fudo-client";
external-interface = "extif0";
password-file = "/srv/backplane/dns/client.passwd";
password-file =
config.fudo.secrets.procul.backplane-client-passwd.target-file;
};
auth.kdc = {
@@ -183,12 +195,13 @@ in {
enable = true;
ssl-certificate = (acme-certificate host-fqdn);
ssl-private-key = (acme-private-key host-fqdn);
keytab = "/srv/postgres/secure/postgres.keytab";
keytab = config.fudo.secrets.procul.postgres-keytab.target-file;
local-networks = local-networks;
users = {
gituser = {
password-file = "/srv/git/secure/db.passwd";
password-file =
config.fudo.secrets.procul.gitea-database-password.target-file;
databases = {
git = {
access = "CONNECT";
@@ -213,7 +226,8 @@ in {
state-dir = /srv/git/state;
database = {
user = "gituser";
password-file = /srv/git/secure/db.passwd;
password-file =
config.fudo.secrets.procul.gitea-database-password.target-file;
hostname = "127.0.0.1";
name = "git";
};