Archived
beatzaplentyandClaude Sonnet 5
2f7831aea8
Check NixOS configurations / eval-hosts (push) Failing after 11m5s
Audited the working tree and full git history for committed secrets
(gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept
local/gitignored per the spec). Found: a password hash shared by root
and the nixos user across every host, two live Beszel monitoring
tokens, and a GitHub fine-grained PAT embedded in a home-manager
nix.conf.
Migrates all of them to sops-nix:
- .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys
derived (via ssh-to-age) from each live host's existing SSH host
key — no new key material transferred to any machine.
- users.users.{root,nixos}.hashedPasswordFile replaces the inline
hashedPassword shared by every target.
- The GitHub PAT moves from a home-manager-managed, store-visible
nix.conf to a sops.templates-rendered file included via nix.conf's
native !include, system-wide instead of per-user.
- Beszel TOKEN moves from `environment` (store-visible) to
`environmentFile` (runtime-only via sops.templates); the dead
commented-out docker token is removed from the tree entirely.
Added a tracked pre-commit hook (gitleaks protect --staged, wired via
core.hooksPath) so a secret can't be committed by accident again, and
documented the sops workflow in README.md.
Structural verification only: all 17 flake targets evaluate, and
`nix build --dry-run --no-link` succeeds for the three currently
deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the
step that confirms secrets decrypt and services start on a real
machine — is left for manual verification.
Git history still contains the original plaintext secrets; scrubbing
history (Milestone 3) and rotating every credential (Milestone 4) are
separate, deliberately gated steps per remove-sensetive-info-refactor.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
91 lines
3.1 KiB
Nix
91 lines
3.1 KiB
Nix
{ config, lib, pkgs, ... }:
|
||
|
||
{
|
||
imports =
|
||
[ # Include the results of the hardware scan.
|
||
# ./hardware-configuration.nix
|
||
../set-locale.nix
|
||
];
|
||
# Use the GRUB 2 boot loader.
|
||
# boot.loader.grub.enable = true;
|
||
#boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||
|
||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||
|
||
# Set your time zone.
|
||
time.timeZone = "Australia/Brisbane";
|
||
|
||
# Enable QEMU agent
|
||
services.qemuGuest.enable = true;
|
||
|
||
# Enable docker-compose
|
||
environment.systemPackages = with pkgs; [
|
||
vim
|
||
btop
|
||
git
|
||
gcr
|
||
];
|
||
|
||
# Secrets shared by every host, decrypted at activation via each host's
|
||
# existing SSH host key (sops-nix derives the age key from
|
||
# /etc/ssh/ssh_host_ed25519_key automatically — see modules/common/README
|
||
# or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
|
||
# neededForUsers so they're available before the normal secret-activation
|
||
# step, since user creation happens very early in boot.
|
||
sops.defaultSopsFile = ../../secrets/common.yaml;
|
||
sops.secrets."root-hashedPassword".neededForUsers = true;
|
||
sops.secrets."nixos-hashedPassword".neededForUsers = true;
|
||
sops.secrets."nix-github-token" = { };
|
||
|
||
# nix.conf doesn't support a *File-style option for access-tokens, so the
|
||
# token is rendered into a runtime-only file (never touches the Nix store)
|
||
# and pulled in via nix.conf's native !include directive.
|
||
sops.templates."nix-github-token.conf".content = ''
|
||
access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
|
||
'';
|
||
nix.extraOptions = ''
|
||
!include ${config.sops.templates."nix-github-token.conf".path}
|
||
'';
|
||
|
||
#Set root password
|
||
users.users.root = {
|
||
hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
|
||
};
|
||
|
||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||
users.users.nixos = {
|
||
isNormalUser = true;
|
||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||
packages = with pkgs; [
|
||
tree
|
||
];
|
||
hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
|
||
openssh.authorizedKeys.keys = [
|
||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
|
||
];
|
||
};
|
||
|
||
|
||
# Enable the OpenSSH daemon.
|
||
services.openssh.enable = true;
|
||
|
||
#Enable flakes
|
||
|
||
nix.settings = {
|
||
experimental-features = [ "nix-command" "flakes" ];
|
||
auto-optimise-store = true;
|
||
};
|
||
|
||
|
||
programs.git = {
|
||
enable = true;
|
||
package = pkgs.git;
|
||
config = {
|
||
credential.helper = "store";
|
||
};
|
||
};
|
||
|
||
|
||
|
||
} |