+4 -3

modules/features/meta/sops.nix

Reviewed

··· 20 20 sops = { 21 21 defaultSopsFile = "${inputs.nix-config-secrets}/${config.networking.hostName}.yaml"; 22 22 validateSopsFiles = false; 23 23 + useSystemdActivation = true; 23 24 24 25 age = { 25 25 - # if key not present at keyFile, automatically generate from ssh key 26 26 - generateKey = true; 27 27 - keyFile = "/var/lib/sops-nix/key.txt"; 28 26 # need to point to /persist as persistence setup to /etc/ssh may not be 29 27 # ready when secrets-for-users are computed. 30 28 # https://github.com/Mic92/sops-nix/commit/4c4fb93f18b9072c6fa1986221f9a3d7bf1fe4b6 31 29 sshKeyPaths = [ "/persist/system/etc/ssh/ssh_host_ed25519_key" ]; 32 30 }; 31 31 + 32 32 + # disable GPG 33 33 + gnupg.sshKeyPaths = [ ]; 33 34 }; 34 35 }; 35 36

+1 -2

modules/features/selfhosted/harmonia.nix

Reviewed

··· 52 52 53 53 sops.secrets."${secretsRoot}/signing-key" = { 54 54 owner = "root"; 55 55 - group = "harmonia"; 56 56 - mode = "0440"; 55 55 + mode = "0400"; 57 56 }; 58 57 }; 59 58 }