titaniumtown/nixos
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
1,632 Commits 1 Branch 0 Tags
d65d991118039c014edb56f1394a09e902b24d0f
Commit Graph

5 Commits

Author SHA1 Message Date
Simon Gardling
d65d991118 secrets: add mreow + yarn TPM recipients, re-encrypt desktop secrets
Some checks failed
Build and Deploy / mreow (push) Successful in 2m56s
Details
Build and Deploy / yarn (push) Successful in 1m49s
Details
Build and Deploy / muffin (push) Failing after 31s
Details
2026-04-23 19:45:57 -04:00
Simon Gardling
06ccc337c1 secrets: proper agenix for desktop hosts via TPM identity 
- modules/desktop-age-secrets.nix: agenix + rage wrapped with age-plugin-tpm,
  TPM identity primary, admin SSH key fallback for recovery/pre-bootstrap
- modules/desktop-lanzaboote-agenix.nix: extract secureboot.tar at activation
- modules/desktop-networkmanager.nix: revert to simple import of git-crypt file
- modules/server-age-secrets.nix: renamed from age-secrets.nix
- modules/desktop-common.nix: wire netrc + password-hash to agenix paths
- hosts/yarn/impermanence.nix: persist /var/lib/agenix across tmpfs wipes
- secrets/secrets.nix: recipient declarations (admin + tpm + muffin USB)
- secrets/desktop/*.age: secureboot.tar, nix-cache-netrc, password-hash
- scripts/bootstrap-desktop-tpm.sh: generate TPM identity + print recipient
 2026-04-23 19:24:34 -04:00
Simon Gardling
e019f2d4fb secrets overhaul: use tpm for laptop (need to migrate desktop later) 2026-04-23 14:22:37 -04:00
primary
efa1fb0c07 phase 5: git-crypt re-init + re-encrypt secrets/ under new unified key 
- .gitattributes declares secrets/** covered by git-crypt filter
- New symmetric key at $HOME/.nixos-git-crypt.key (chmod 400, not committed)
- All 36 files under secrets/ re-encrypted via the clean filter on 'git add':
  - 5 files in secrets/desktop/ (wifi, secureboot, disk pw, cache netrc, hash)
  - 3 files in secrets/home/ (hm api keys + steam id)
  - 26 files in secrets/server/ (.age + .nix + .tar + livekit_keys)
  - 2 files in secrets/usb-secrets/ (agenix identity)

'git-crypt status' confirms 36 encrypted, 150 non-encrypted.

Old git-crypt keys from the two subtree-merged repos are in the historical subtree commits (pre-Phase 2). To decrypt pre-unify history one still needs the old GPG-encrypted keys, which survive at:
  ~/nixos-migration-aux-*.tar.gz
 2026-04-18 01:12:38 -04:00
primary
05fd05deda phase 2: move secrets → secrets/{desktop,home,server,usb-secrets}/ 2026-04-18 00:48:18 -04:00