Archived
beatzaplentyandClaude Sonnet 5
71d052e737
Audited the working tree and full git history for committed secrets
(gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept
local/gitignored per the spec). Found: a password hash shared by root
and the nixos user across every host, two live Beszel monitoring
tokens, and a GitHub fine-grained PAT embedded in a home-manager
nix.conf.
Migrates all of them to sops-nix:
- .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys
derived (via ssh-to-age) from each live host's existing SSH host
key — no new key material transferred to any machine.
- users.users.{root,nixos}.hashedPasswordFile replaces the inline
hashedPassword shared by every target.
- The GitHub PAT moves from a home-manager-managed, store-visible
nix.conf to a sops.templates-rendered file included via nix.conf's
native !include, system-wide instead of per-user.
- Beszel TOKEN moves from `environment` (store-visible) to
`environmentFile` (runtime-only via sops.templates); the dead
commented-out docker token is removed from the tree entirely.
Added a tracked pre-commit hook (gitleaks protect --staged, wired via
core.hooksPath) so a secret can't be committed by accident again, and
documented the sops workflow in README.md.
Structural verification only: all 17 flake targets evaluate, and
`nix build --dry-run --no-link` succeeds for the three currently
deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the
step that confirms secrets decrypt and services start on a real
machine — is left for manual verification.
Git history still contains the original plaintext secrets; scrubbing
history (Milestone 3) and rotating every credential (Milestone 4) are
separate, deliberately gated steps per remove-sensetive-info-refactor.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
66 lines
1.8 KiB
Nix
66 lines
1.8 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
remote = "root@proxmox-ip:/var/lib/vz/template/iso";
|
|
localMount = "${config.home.homeDirectory}/proxmox-iso";
|
|
in {
|
|
|
|
imports = [
|
|
./aliases.nix
|
|
];
|
|
|
|
home.username = "nixos"; # your actual username
|
|
home.homeDirectory = "/home/nixos";
|
|
home.stateVersion = "25.11"; # match your NixOS stateVersion
|
|
|
|
programs.home-manager.enable = true; # mandatory to activate HM
|
|
|
|
programs.bash.enable = true;
|
|
|
|
# GitHub access-tokens setting used to live here in plaintext; it's now
|
|
# rendered system-wide from a sops-nix secret via nix.extraOptions in
|
|
# modules/common/configuration.nix instead (covers the daemon for every
|
|
# user, not just this one).
|
|
|
|
# Optional: packages
|
|
home.packages = with pkgs; [
|
|
git
|
|
vim
|
|
tmux
|
|
nano
|
|
sshfs
|
|
];
|
|
|
|
# Optional: set environment vars
|
|
home.sessionVariables = {
|
|
EDITOR = "nano";
|
|
};
|
|
# systemd.user.services.mount-proxmox-iso = {
|
|
# Unit = {
|
|
# Description = "Mount Proxmox ISO dir via SSHFS";
|
|
# After = [ "network-online.target" ];
|
|
# Wants = [ "network-online.target" ];
|
|
# };
|
|
|
|
# Service = {
|
|
# Type = "simple";
|
|
# ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
|
|
# ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
|
|
# ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
|
|
# Restart = "on-failure";
|
|
# };
|
|
|
|
# Install = {
|
|
# WantedBy = [ "default.target" ];
|
|
# };
|
|
# };
|
|
# Optional: enable bash (or zsh, fish...)
|
|
# programs.bash.enable = true;
|
|
|
|
# Optional: manage dotfiles via symlinks
|
|
# home.file = {
|
|
# ".tmux.conf".source = ./dotfiles/tmux.conf;
|
|
# ".config/nvim/init.vim".source = ./dotfiles/init.vim;
|
|
# };
|
|
}
|