Initial commit

2026-02-28 14:18:57 +01:00
commit 8110e8f10b
45 changed files with 6381 additions and 0 deletions
--- a/modules/secrets/.sops.yaml
+++ b/modules/secrets/.sops.yaml
@@ -0,0 +1,11 @@
+keys:
+  - &polaris age122w85pqj508ukv0rd388mahecgfckmpgnsgz0zcyec37ljae2epsdnvxpl
+  - &altair age15mg7k37mc3ll60rfzx4zpzp50xjefzwy0ayjpstq5ce7raem3a7sef57w7
+  - &orion age1l49tm85prcpm4q8e0hxxetv08jqv3gfty3pvzte956dng4h0xaeq0he5yd
+creation_rules:
+  - path_regex: secrets.yaml$
+    key_groups:
+      - age:
+        - *polaris
+        - *altair
+        - *orion
--- a/modules/secrets/secrets.yaml
+++ b/modules/secrets/secrets.yaml
@@ -0,0 +1,38 @@
+radicale_pass: ENC[AES256_GCM,data:zdUxtJKNPC8SzajhFKo=,iv:H55GWMiQLJvZx6rAufkk807lZflg0sepxoq6z0XJ/q4=,tag:MoDOuF37PeF7QEpUxBntEg==,type:str]
+university_calendar_url: ENC[AES256_GCM,data:y5UtZVC0KJPUz//6S0QsrNeFGQshc88zieQgmlur75VFw9y5CJpnZRpdhLnYva00z5HBkxYQelLqS/I5GrXexWtC7Y7d1dCcQ+IZ0K7GGJ5NrYtjNXfMhzNSlhqjvl5lBGb+S565kel3VsCTyo/YRxdbBN6FA/oQNsx8/AvTgtsPeFkQRDGlGkybFRfWHWuTIDLL,iv:rZK9utRrm/KAkVRUjC3VR09MvDZjpoLx7BgaidzQo3o=,tag:tGWGoQCsS3zZh818OKixPw==,type:str]
+ssh_config_orion: ENC[AES256_GCM,data:P2jH5BDIzeHSIwTBcZwTOXKes727xK0Xoj9W64GmEszEPZw8vA==,iv:hSY9mFdC82pBbOjMFuzoR2eufhjY2MGERJ4ODmcogbA=,tag:ejF535LrQwwH66nQG3qLGw==,type:str]
+orion_ip: ENC[AES256_GCM,data:RCK6EKOEDaTu1uR2d/8=,iv:5JhIkVQEELB6MoPh49xq+0CrbPjI/6+qfqUHRqCza5s=,tag:+00T4+pWOWRj7R1ft39HAw==,type:str]
+hashed-password-kiri: ENC[AES256_GCM,data:xubN5stH4RPlHYl+Jzcu2BCepz3Hra3TxjiSspktzjgpEWrU79h3NbcPMrYC0MSjsv3oaWio/S7nBV3Tes3WBlI9EC9vq+6tyTVPynUqpB7c9CvvYSmqc9bAHOnIOBb+gP2RR6JB395UoQ==,iv:uN83RNTfCJdBDhFhywV5NbVBp4xcptqzoKVAoAnaiQk=,tag:x9yufiPdSJwBADT6QymExA==,type:str]
+sops:
+    age:
+        - recipient: age122w85pqj508ukv0rd388mahecgfckmpgnsgz0zcyec37ljae2epsdnvxpl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByTU9pQS92dlJKQzZjaHFN
+            SHFHaEJWWVNsMC9KN1hlc2NNTUtCY1pkREJnCm4yY20vYzFqZG1yZWJZN2JTSW5U
+            Q3dQUkJJalhhbFc4U2Q1dUhpWDRua1UKLS0tIHRuaGUvK2crQUFQRm1DK3UwelJy
+            N1NPUHdlcW1kSUJidi9Dc1R6N0oyYUUKnt3m3NQb3e+kEC4LRiJ2JW38Hnw8zpTM
+            hUITQQXZ6KmYoq+3AXJJbePcK+MAuS7VLlecVbhAq25FiDtZkdky5A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15mg7k37mc3ll60rfzx4zpzp50xjefzwy0ayjpstq5ce7raem3a7sef57w7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrVCtUY2hMcUtaaXlPd3Zh
+            bXBtSjIxWUFUMnFCQUdWdk9pVlhRa0F0TWc0CjhEYVAwTHliV2sweUN3aytvS2lu
+            djdUeG9IYXYxMlBqdklRdGhtWlh0bzQKLS0tIFZpeld1bFArR3h1NXBIeS84eUxr
+            ZkVRcExsbmJBR1p3QVBwTzRGZ2NWbDgK3yBC0dGsiQKZ+f4eeMFQC//1ASacCkgJ
+            0q0rH6YHyqX2ojqLqvpiQUIstCsdohlj36KLc+ziFAOOFyoe7tB7Kg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1l49tm85prcpm4q8e0hxxetv08jqv3gfty3pvzte956dng4h0xaeq0he5yd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNUM2UE1sNUVyYncrY3Jr
+            OE5OWWJidEZqdWdJSkZSUUEzKzJSb2w1akZNClN4ZlhlSXBKVkJWL3NwazlNYjFR
+            dmhoaTArVmpKMjdQajJxZEF2a2dUT1EKLS0tIDdvRXhsYk5uN3gwbkViVEIxZksw
+            YlZ4VGIzaE5kQ3ZSczI2Wk5IU1UvOXcKqkj/OYP37+60Gr2xJmPE9O7HB7LCu4Tp
+            AvvoMQLkkvVJ30Y03pfEzIMnvJHKREy9zDOScfqUflDk79mcDaDhvg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-16T13:53:22Z"
+    mac: ENC[AES256_GCM,data:DuGE9Ovae5Y2Qpm5v8OYgFC2/u/Yzprv+ImmX1OVsh5KjGS26HaX1HLbzGu7NZCMfg2ZrJ5BeFNCO3UaZ7tXNoWGKxQZRNYpAH8PjI225l+GWozcva0on6S0UD2MhtKkpFPFUg1uEDSzqwMoXgPbWoB1W0VeAOkfAhKM9j/tggs=,iv:/Hsh9JvdcZMy7v4tLGaBwDlMIf5HBta3GeZC5gDUO9k=,tag:mtwqk41SA9qzIw+cVDSgQg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/modules/secrets/sops.nix
+++ b/modules/secrets/sops.nix
@@ -0,0 +1,26 @@
+{ inputs, ... }:
+{
+  flake-file.inputs.sops-nix.url = "github:Mic92/sops-nix";
+
+  den.default = {
+    nixos =
+      { pkgs, ... }:
+      {
+        imports = [ inputs.sops-nix.nixosModules.sops ];
+
+        sops = {
+          age.keyFile = "/home/kiri/.config/sops/age/keys.txt";
+          defaultSopsFile = ./secrets.yaml;
+          secrets = {
+            hashed-password-kiri.neededForUsers = true;
+          };
+        };
+
+        environment.systemPackages = with pkgs; [
+          sops
+          age
+        ];
+
+      };
+  };
+}