systemd-creds: move to creds-{setup,encrypt,decrypt}.sh

diff --git a/.git-crypt/.gitattributes b/.git-crypt/.gitattributes
deleted file mode 100644 (file)
index 665b10e..0000000
--- a/.git-crypt/.gitattributes
+++ /dev/null
@@ -1,4 +0,0 @@
-# Do not edit this file.  To specify the files to encrypt, create your own
-# .gitattributes file in the directory where your files are.
-* !filter !diff
-*.gpg binary

diff --git a/.git-crypt/keys/default/0/F2E027182397AC0775714F2AD15AF7F467E8299B.gpg b/.git-crypt/keys/default/0/F2E027182397AC0775714F2AD15AF7F467E8299B.gpg
deleted file mode 100644 (file)
index 0b51f73..0000000
Binary files a/.git-crypt/keys/default/0/F2E027182397AC0775714F2AD15AF7F467E8299B.gpg and /dev/null differ

diff --git a/.git-crypt/keys/julm/0/F2E027182397AC0775714F2AD15AF7F467E8299B.gpg b/.git-crypt/keys/julm/0/F2E027182397AC0775714F2AD15AF7F467E8299B.gpg
deleted file mode 100644 (file)
index a94c516..0000000
Binary files a/.git-crypt/keys/julm/0/F2E027182397AC0775714F2AD15AF7F467E8299B.gpg and /dev/null differ

diff --git a/.git-crypt/keys/shared/0/388FB89C12F65085160A6397DB1FCA48E58F1A7C.gpg b/.git-crypt/keys/shared/0/388FB89C12F65085160A6397DB1FCA48E58F1A7C.gpg
deleted file mode 100644 (file)
index d522375..0000000
Binary files a/.git-crypt/keys/shared/0/388FB89C12F65085160A6397DB1FCA48E58F1A7C.gpg and /dev/null differ

diff --git a/.git-crypt/keys/shared/0/F2E027182397AC0775714F2AD15AF7F467E8299B.gpg b/.git-crypt/keys/shared/0/F2E027182397AC0775714F2AD15AF7F467E8299B.gpg
deleted file mode 100644 (file)
index 2eb8533..0000000
Binary files a/.git-crypt/keys/shared/0/F2E027182397AC0775714F2AD15AF7F467E8299B.gpg and /dev/null differ

diff --git a/.gitattributes b/.gitattributes
new file mode 100644 (file)
index 0000000..f97b721
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.gpg diff=gpg

diff --git a/creds-decrypt.sh b/creds-decrypt.sh
new file mode 100755 (executable)
index 0000000..1a7b109
--- /dev/null
+++ b/creds-decrypt.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# USAGE: ./creds-decrypt.sh path/to/file.cred
+# Find machine-id and credential.secret.gpg
+# in an ancestor directory, to decrypt and print path/to/file.cred
+set -eu
+cred=$(realpath "$1")
+name=${cred##*/}
+name=${name%.cred}
+
+cd "$(dirname "$cred")"
+while test "$PWD" != /
+do test ! -f machine-id || break; cd ..
+done
+
+umask 177
+SECRET=$(mktemp /dev/shm/credential.secret.XXXXXXX)
+trap 'chmod 600 $SECRET; shred --remove=unlink $SECRET' EXIT
+set -e${XTRACE:+x}
+gpg --yes --output "$SECRET" --decrypt credential.secret.gpg
+
+sudo unshare --mount sh -${XTRACE:+x}c "
+  chmod 400 $SECRET &&
+  mount --bind $SECRET /var/lib/systemd/credential.secret &&
+  mount --bind machine-id /etc/machine-id &&
+  systemd-creds decrypt --with-key=host --name '$name' '$cred' -
+"

diff --git a/creds-encrypt.sh b/creds-encrypt.sh
new file mode 100755 (executable)
index 0000000..fd34005
--- /dev/null
+++ b/creds-encrypt.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# USAGE: ./creds-encrypt.sh path/to/file.gpg
+# Find the machine-id and credential.secret.gpg files
+# in an ancestor directory, to reencrypt path/to/file.gpg
+# into path/to/file.cred
+set -eu
+set -o pipefail
+gpg=$(realpath "$1")
+base=${gpg%.gpg}
+
+cd "$(dirname "$gpg")"
+while test "$PWD" != /
+do test ! -f machine-id || break; cd ..
+done
+
+umask 177
+SECRET=$(mktemp /dev/shm/credential.secret.XXXXXXX)
+trap 'chmod 600 $SECRET; shred --remove=unlink $SECRET' EXIT
+set -e${XTRACE:+x}
+gpg --yes --output "$SECRET" --decrypt credential.secret.gpg
+
+gpg --decrypt "$gpg" |
+sudo unshare --mount sh -${XTRACE:+x}c "
+  chmod 400 $SECRET
+  mount --bind '$SECRET' /var/lib/systemd/credential.secret &&
+  mount --bind machine-id /etc/machine-id &&
+  systemd-creds encrypt --with-key=host --name '${base##*/}' - - |
+  install -m 400 -o '$USER' -g users /dev/stdin '$base.cred'
+"

diff --git a/creds-setup.sh b/creds-setup.sh
new file mode 100755 (executable)
index 0000000..0ce0d25
--- /dev/null
+++ b/creds-setup.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# USAGE: ./creds-setup.sh
+# Generate missing hosts/*/{machine-id,,credential.secret.gpg}
+set -eu${XTRACE:+x}
+set -o pipefail
+
+git config --local diff.gpg.binary true
+git config --local diff.gpg.textconv "gpg2 -d -u --quiet --yes --compress-algo=none --no-encrypt-to --batch --use-agent"
+
+for host in hosts/*.nix
+do
+  host=${host%.nix}
+  if test ! -e "$host"/machine-id
+  then
+    sudo unshare --mount sh -${XTRACE:+x}c "
+      touch $host/machine-id
+      mount --bind $host/machine-id /etc/machine-id &&
+      systemd-machine-id-setup
+    "
+  fi
+  if test ! -e "$host"/credential.secret.gpg
+  then
+    umask 077
+    systemd=$(mktemp --directory /dev/shm/systemd.XXXXXXX)
+    trap 'rm -rf $systemd' EXIT
+    sudo unshare --mount sh -${XTRACE:+x}c "
+      mount --bind $systemd /var/lib/systemd &&
+      systemd-creds setup --with-key=host
+      cat $systemd/credential.secret
+      shred --remove=unlink $systemd/credential.secret
+    " |
+    pass insert --multiline "$host"/credential.secret
+  fi
+done

diff --git a/flake.nix b/flake.nix
index 68ddbca9dca84b23e9f599c14bbbc372b3d0d5b5..1697b169c25f8da885ca08eeb960e571aa91efd7 100644 (file)
--- a/flake.nix
+++ b/flake.nix
@@ -39,10 +39,6 @@ outputs = inputs: let
       system = "x86_64-linux";
       specialArgs = {
         inherit hostName inputs;
-        # Encrypted using git-crypt, hence kept out of /nix/store
-        private = "/root/private";
-        # Encrypted using systemd-creds, hence can go into the /nix/store
-        credentials = private/hosts + "/${hostName}/credentials";
       };
       pkgs = import nixpkgsPath {
         inherit system;
@@ -112,12 +108,11 @@ outputs = inputs: let
           program = (pkgs.writeShellScript "switch" (''
             set -eux
             set -o pipefail
+            shopt -s globstar
+            chmod -R g-rwx,o-rwx **/*.gpg
+            trap 'git reset **/*.gpg' EXIT
+            git rm -rf --cached --ignore-unmatch **/*.gpg # prevent copying to /nix/store
 
-            chmod -R g-rwx,o-rwx "private/root"
-            trap 'git reset private/root private/hosts/*/root' EXIT
-            git rm -rf --cached --ignore-unmatch private/root private/hosts/*/root # prevent copying to /nix/store
-
-            nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
             nix-store --add-root hosts/${hostName}.nixpkgs --indirect --realise ${nixpkgsPath}
             nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
             nix copy --to ssh://${target}${lib.optionalString config.install.substituteOnDestination " --substitute-on-destination"} ${build.toplevel}

diff --git a/hosts/aubergine.nix b/hosts/aubergine.nix
index 02bfc9871bb8c1640c0918aae29fc42799e0faf3..69f704c30ce636c61d813fd02c0545a9d0cad3f3 100644 (file)
--- a/hosts/aubergine.nix
+++ b/hosts/aubergine.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, inputs, private, hostName, ... }:
+{ config, pkgs, lib, inputs, hostName, ... }:
 {
 imports = [
   #../nixos/profiles/debug.nix
@@ -13,7 +13,7 @@ imports = [
 # Lower kernel's security for better performances
 boot.kernelParams = [ "mitigations=off" ];
 
-environment.etc.machine-id.source = ../private + "/hosts/${hostName}/root/machine-id";
+environment.etc.machine-id.source = aubergine/machine-id;
 
 home-manager.users.julm = {
   imports = [ ../homes/julm.nix ];
@@ -28,7 +28,8 @@ users.users.julm = {
   uid = 1000;
   # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
   # which is already world readable.
-  hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
+  # printf %s $(mkpasswd -m md5crypt)
+  hashedPassword = lib.readFile aubergine/users/julm/login/hashedPassword;
   extraGroups = [
     "adbusers"
     "dialout"
@@ -40,26 +41,23 @@ users.users.julm = {
   # zfs set overlay=yes ${hostName}/home
   createHome = true;
   openssh.authorizedKeys.keys = map lib.readFile [
-    ../private/shared/ssh/root/losurdo.pub
-    ../private/shared/ssh/julm/losurdo.pub
-    ../private/shared/ssh/julm/oignon.pub
-    ../private/shared/ssh/julm/redmi.pub
+    ../users/root/ssh/losurdo.pub
+    ../users/julm/ssh/losurdo.pub
+    ../users/julm/ssh/oignon.pub
+    ../users/julm/ssh/redmi.pub
   ];
 };
 users.users.root = {
   hashedPassword = "!";
-  openssh.authorizedKeys.keys = map lib.readFile [
-    ../private/shared/ssh/root/losurdo.pub
-    ../private/shared/ssh/julm/losurdo.pub
-    ../private/shared/ssh/julm/oignon.pub
-    ../private/shared/ssh/julm/redmi.pub
-  ];
+  openssh.authorizedKeys.keys =
+    config.users.users.julm.openssh.authorizedKeys.keys;
 };
 
+systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
+  "secret-key-files:" + aubergine/nix/secret-key-files;
 nix = {
   extraOptions = ''
     #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
-    #secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
   '';
   settings = {
     trusted-users = [ config.users.users."julm".name ];

diff --git a/hosts/aubergine/.gpg-id b/hosts/aubergine/.gpg-id
new file mode 100644 (file)
index 0000000..8d9dfdc
--- /dev/null
+++ b/hosts/aubergine/.gpg-id
@@ -0,0 +1 @@
+@julm@autogeree.net

diff --git a/hosts/aubergine/credential.secret.gpg b/hosts/aubergine/credential.secret.gpg
new file mode 100644 (file)
index 0000000..d6300d6
Binary files /dev/null and b/hosts/aubergine/credential.secret.gpg differ

diff --git a/hosts/aubergine/machine-id b/hosts/aubergine/machine-id
new file mode 100644 (file)
index 0000000..531a320
--- /dev/null
+++ b/hosts/aubergine/machine-id
@@ -0,0 +1 @@
+8c85ce9f6f5be09714d6de4caca4c3b2

diff --git a/hosts/aubergine/users/julm/login/hashedPassword b/hosts/aubergine/users/julm/login/hashedPassword
new file mode 100644 (file)
index 0000000..1f2ef7f
--- /dev/null
+++ b/hosts/aubergine/users/julm/login/hashedPassword
@@ -0,0 +1 @@
+$1$sbMu6nnC$VDwkK.dvI0pej5qMPTVuA/
\ No newline at end of file

diff --git a/hosts/aubergine/wireguard/wg-intra/privateKey.cred b/hosts/aubergine/wireguard/wg-intra/privateKey.cred
new file mode 100644 (file)
index 0000000..10904a4
--- /dev/null
+++ b/hosts/aubergine/wireguard/wg-intra/privateKey.cred
@@ -0,0 +1,3 @@
+Whxqht+dQJax1aZeCGLxmiAAAAABAAAADAAAABAAAACUQ1IFi3E2Cr1d8K8AAAAALIhIpO2PaS1eqib
+iz2b0mlys9D/21CqbkJi+aOJu4fCoXsHF5OIRGTz+Lgf2qQXwFENbiEkmHPtGpyVf61Pdj8a1Kk2DdA
+ygwQLOTj/4rsZQBoN+MGRDjI7Bheq2

diff --git a/hosts/aubergine/wireguard/wg-intra/privateKey.gpg b/hosts/aubergine/wireguard/wg-intra/privateKey.gpg
new file mode 100644 (file)
index 0000000..3b94974
Binary files /dev/null and b/hosts/aubergine/wireguard/wg-intra/privateKey.gpg differ

diff --git a/hosts/losurdo/nix/key.pub b/hosts/losurdo/nix/key.pub
new file mode 100644 (file)
index 0000000..e91cb7d
--- /dev/null
+++ b/hosts/losurdo/nix/key.pub
@@ -0,0 +1 @@
+losurdo.sourcephile.fr:yi2tx2OAu9/CdeskErvvy7pKC6HCXEaKAnnn8ng+2FQ=

diff --git a/hosts/oignon.nix b/hosts/oignon.nix
index e55df74ae1ba07a7898f2ec150b7f15ce39eca5d..df27d3229a5e54c767f110f299996e611673329e 100644 (file)
--- a/hosts/oignon.nix
+++ b/hosts/oignon.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, inputs, private, hostName, ... }:
+{ config, pkgs, lib, inputs, hostName, ... }:
 {
 imports = [
   ../nixos/profiles/builder.nix
@@ -27,15 +27,17 @@ systemd.services.home-manager-julm.postStart = ''
 '';
 users.users.root = {
   openssh.authorizedKeys.keys = map lib.readFile [
-    ../private/shared/ssh/julm/oignon.pub
+    # For nix -L run .#oignon.switch
+    ../users/julm/ssh/oignon.pub
   ];
 };
 users.users.julm = {
   isNormalUser = true;
   uid = 1000;
-  # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
-  # which is already world readable.
-  hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
+  # Put the hashedPassword in /nix/store,
+  # though /etc/shadow is not world readable...
+  # printf %s $(mkpasswd -m md5crypt)
+  hashedPassword = lib.readFile oignon/users/julm/login/hashedPassword;
   extraGroups = [
     "adbusers"
     "dialout"
@@ -53,14 +55,13 @@ users.users.julm = {
   # zfs set overlay=yes ${hostName}/home
   createHome = false;
   openssh.authorizedKeys.keys = map lib.readFile [
-    ../private/shared/ssh/julm/losurdo.pub
+    ../users/julm/ssh/losurdo.pub
   ];
 };
 
 nix = {
   extraOptions = ''
     #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
-    secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
   '';
   settings = {
     trusted-users = [ config.users.users."julm".name ];
@@ -69,7 +70,7 @@ nix = {
       "ssh://nix-ssh@losurdo.wg?priority=30"
     ];
     trusted-public-keys = map lib.readFile [
-      ../private/shared/nix/losurdo.pub
+      ../hosts/losurdo/nix/key.pub
     ];
   };
   nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
@@ -81,9 +82,9 @@ nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
 nix.sshServe = {
   enable = true;
   keys = map lib.readFile [
-    ../private/shared/ssh/julm/losurdo.pub
-    ../private/shared/ssh/sevy/patate.pub
-    ../private/shared/ssh/julm/oignon.pub
+    ../users/julm/ssh/losurdo.pub
+    ../users/julm/ssh/oignon.pub
+    ../users/sevy/ssh/patate.pub
   ];
 };
 
@@ -120,6 +121,11 @@ fileSystems =
         "ServerAliveInterval=15"
       ];
   in {
+  "/mnt/aubergine" = {
+    device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@aubergine.wg:/";
+    fsType = "fuse";
+    inherit options;
+  };
   "/mnt/losurdo" = {
     device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@losurdo.wg:/";
     fsType = "fuse";

diff --git a/hosts/oignon/.gpg-id b/hosts/oignon/.gpg-id
new file mode 100644 (file)
index 0000000..8d9dfdc
--- /dev/null
+++ b/hosts/oignon/.gpg-id
@@ -0,0 +1 @@
+@julm@autogeree.net

diff --git a/hosts/oignon/credential.secret.gpg b/hosts/oignon/credential.secret.gpg
new file mode 100644 (file)
index 0000000..4a878e2
Binary files /dev/null and b/hosts/oignon/credential.secret.gpg differ

diff --git a/hosts/oignon/machine-id b/hosts/oignon/machine-id
new file mode 100644 (file)
index 0000000..714a700
--- /dev/null
+++ b/hosts/oignon/machine-id
@@ -0,0 +1 @@
+65b44688876248cc90c71f1a839b5783

diff --git a/hosts/oignon/nix/secret-key-files.priv.pem.cred b/hosts/oignon/nix/secret-key-files.priv.pem.cred
new file mode 100644 (file)
index 0000000..0e770c0
--- /dev/null
+++ b/hosts/oignon/nix/secret-key-files.priv.pem.cred
@@ -0,0 +1,4 @@
+Whxqht+dQJax1aZeCGLxmiAAAAABAAAADAAAABAAAADd1Y8nx3Ngm4vDaWYAAAAA4tk7Ww1kOnvyOMt
+B2CtPSukYgpF4nINDe9ivdUSPc7745J5ta3OuBKvvGY1IQXQ6gzfgiW7AdGcpQmN82qQC1mHCFI20TK
+D/rzLEOaDUxPDF5Mud7sGA4VhynpIIRoXi0H6APGMo8jfIQIDozhw/77A0MgAPDOHjiT0Cg0Pxt7/U0
+7yp1e4UkFaibvk0QyDy99xyOoSf/3bmZex2dHuY4LddhMx78w1oXq8FAfS9

diff --git a/hosts/oignon/nix/secret-key-files.priv.pem.gpg b/hosts/oignon/nix/secret-key-files.priv.pem.gpg
new file mode 100644 (file)
index 0000000..d6da414
--- /dev/null
+++ b/hosts/oignon/nix/secret-key-files.priv.pem.gpg
@@ -0,0 +1,6 @@
+�\ 2\f\ 3Ù`�!��\ 1\ f�zF �\ 4`��maa��*���0\15B3\10'@����xj|7\\1f:��7��\ 5|����_�����w往B\ ej�{Ȼ���    *�
+TQ��!��nf���\1c�,\10\1ca/k~���()us����,�ނ6[�C��\7fHQ��"Y\v
+-]�\ 2G�o\10�𨗭��\ e��O�F���K��aOo�˂���\f@a��U���ݭV��Ңe(E.u�e�>���\19<���\ 5:G�\1c�=�]�J\�iݹ\15\ f�N��
+\ 5*\ f�F���؄ȸ���\7f\11+��>�gkV(�� �ϯa���pX����U�A>��\ f��'\ f6z�C��}\f�}�\ 2%[�7Z��]K����y|���\ 2Q��9���?��\16\11�\15ѵ�\e7�B�W� �\ 4�\ 6�p&0�\ 5ҞUY�\ 6        p��b�
+�\15V3\18�\vc�&\13��D�4�N���U�ਭՑ`\1f\16�\10\18+\1du\12zj&�_\17|\1c\17\1cҢFl��\7f}\ 6\1a`I���V�\10*\1c/�$g:��.{/��=ϱ�  �\a�\18�c\14�p�݅�q�&�\ e8;\11J�r����z$���\16j�ݬ�\11Gt��    x?\16�\1a�2wۍ���v���\ 4=�ҟ\ 1�7\ 2b@�M�V�\1f   �E\ e�\1fM:��\1c|���7��g�I�D�b��Rđqp�/�6\ 2��\10�<\ f%:P�b��\15��x��tV�*0�k�\18��\a\ f�
+�\1f$4�eweB�4ӿ�P~�\ 4ȩ�+��AD��h�w�B�z\13�W��-�\17�\1c3�33j\e����}R�)�,[��\ 4Q�����
\ No newline at end of file

diff --git a/hosts/oignon/nix/secret-key-files.pub.pem b/hosts/oignon/nix/secret-key-files.pub.pem
new file mode 100644 (file)
index 0000000..2978e84
--- /dev/null
+++ b/hosts/oignon/nix/secret-key-files.pub.pem
@@ -0,0 +1 @@
+oignon.sourcephile.fr:atcadS2SbSN8tWlx3V3LweckNTbnO/7oaltyi+F0rSk=
\ No newline at end of file

diff --git a/hosts/oignon/users/julm/login/hashedPassword b/hosts/oignon/users/julm/login/hashedPassword
new file mode 100644 (file)
index 0000000..7647c61
--- /dev/null
+++ b/hosts/oignon/users/julm/login/hashedPassword
@@ -0,0 +1 @@
+$1$2XnK6jdY$gzI9EtBWqpCsIs.oxfv19/
\ No newline at end of file

diff --git a/hosts/oignon/wireguard/wg-intra/privateKey.cred b/hosts/oignon/wireguard/wg-intra/privateKey.cred
new file mode 100644 (file)
index 0000000..4e53c36
--- /dev/null
+++ b/hosts/oignon/wireguard/wg-intra/privateKey.cred
@@ -0,0 +1,3 @@
+Whxqht+dQJax1aZeCGLxmiAAAAABAAAADAAAABAAAABN7VGPc0uJLQrlzSwAAAAAyEmnV6PePEKHoZ5
+6G/026hVy1JRWoMqGuxW4KjuPDXbZ+wLzDU121zaW0P7A4TSghk+aDcF0wGLA/a0zs180HMiVqF81iJ
+1E1eSHZwWJNJ+nubrwzfDH3k8S+v0b

diff --git a/hosts/oignon/wireguard/wg-intra/privateKey.gpg b/hosts/oignon/wireguard/wg-intra/privateKey.gpg
new file mode 100644 (file)
index 0000000..b292961
Binary files /dev/null and b/hosts/oignon/wireguard/wg-intra/privateKey.gpg differ

diff --git a/hosts/patate/.gpg-id b/hosts/patate/.gpg-id
new file mode 100644 (file)
index 0000000..428206f
--- /dev/null
+++ b/hosts/patate/.gpg-id
@@ -0,0 +1,2 @@
+@julm@autogeree.net
+@severine.popek@autistici.org

diff --git a/nixos/profiles/networking.nix b/nixos/profiles/networking.nix
index e7df5464b2a142a51462b8846ad7994fdf1a6d8c..285642ad61bb9feea062e72d001c7da634b28d74 100644 (file)
--- a/nixos/profiles/networking.nix
+++ b/nixos/profiles/networking.nix
@@ -57,8 +57,10 @@ services.openssh = {
   enable = lib.mkDefault true;
   forwardX11 = lib.mkDefault true;
   openFirewall = lib.mkDefault false;
+  # Enable to switch-to-configuration
+  # with the same remotely and locally
   listenAddresses = [
-    { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
+    { addr = "127.0.0.1"; port = 22; }
   ];
 };
 

diff --git a/nixos/profiles/wireguard/wg-intra.nix b/nixos/profiles/wireguard/wg-intra.nix
index c4b3b6f7fa55015f44ddcc1d01dadf849eb069ff..36c961052b9e25fbb11d66a2c4470631d426b9c0 100644 (file)
--- a/nixos/profiles/wireguard/wg-intra.nix
+++ b/nixos/profiles/wireguard/wg-intra.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, config, hostName, credentials, ... }:
+{ inputs, pkgs, lib, config, hostName, ... }:
 let
   wgIface = "wg-intra";
   peers = import wg-intra/peers.nix;
@@ -11,7 +11,8 @@ options.networking.wireguard.${wgIface}.peers =
     enable = lib.mkEnableOption "this peer";
   });
 config = {
-systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = "privateKey:${credentials}/wireguard/${wgIface}/privateKey.secret";
+systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted =
+  "privateKey:" + inputs.self.outPath + "/hosts/${hostName}/wireguard/${wgIface}/privateKey.cred";
 networking.wireguard.interfaces.${wgIface} = lib.recursiveUpdate
   (removeAttrs peers.${hostName} ["ipv4" "persistentKeepalive" "peer"])
   {
@@ -108,5 +109,8 @@ services.fail2ban.ignoreIP = lib.concatMap
   (lib.attrValues peers);
 networking.networkmanager.unmanaged = [ wgIface ];
 systemd.services.sshd.after = ["wireguard-${wgIface}.service"];
+services.openssh.listenAddresses = [
+  { addr = peers.${hostName}.ipv4; port = 22; }
+];
 };
 }

diff --git a/private/hosts/aubergine/credentials/wireguard/wg-intra/privateKey.secret b/private/hosts/aubergine/credentials/wireguard/wg-intra/privateKey.secret
deleted file mode 100644 (file)
index a9796b7..0000000
Binary files a/private/hosts/aubergine/credentials/wireguard/wg-intra/privateKey.secret and /dev/null differ

diff --git a/private/hosts/aubergine/root/credential.secret b/private/hosts/aubergine/root/credential.secret
deleted file mode 100644 (file)
index 1972399..0000000
Binary files a/private/hosts/aubergine/root/credential.secret and /dev/null differ

diff --git a/private/hosts/aubergine/root/machine-id b/private/hosts/aubergine/root/machine-id
deleted file mode 100644 (file)
index ab13cb6..0000000
Binary files a/private/hosts/aubergine/root/machine-id and /dev/null differ

diff --git a/private/hosts/decrypt.sh b/private/hosts/decrypt.sh
deleted file mode 100755 (executable)
index eb19a50..0000000
--- a/private/hosts/decrypt.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-dir=${0%/*}
-key=$1
-host=${key##*hosts/}
-host=${host%%/*}
-name=${key##*/}
-name=${name%.secret}
-sudo unshare --mount sh -xc "
-  mount --bind $dir/$host/root/credential.secret /var/lib/systemd/credential.secret &&
-  mount --bind $dir/$host/root/machine-id /etc/machine-id &&
-  systemd-creds decrypt --with-key=host --name '$name' '$key' -
-"

diff --git a/private/hosts/encrypt.sh b/private/hosts/encrypt.sh
deleted file mode 100755 (executable)
index 151b31e..0000000
--- a/private/hosts/encrypt.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env sh
-set -eux
-dir=${0%/*}
-key=$1
-host=${key#*/}
-host=${host%%/*}
-hostkey=${key#*/*/}
-mkdir -p "$dir/$host/credentials/${hostkey%/*}"
-${pass:-pass} "$key" |
-sudo unshare --mount sh -xc "
-  mount --bind $dir/$host/root /var/lib/systemd &&
-  mount --bind $dir/$host/root/machine-id /etc/machine-id &&
-  systemd-creds setup &&
-  chown $USER:users /var/lib/systemd/crendentials.secret &&
-  systemd-creds encrypt --with-key=host --name '${hostkey##*/}' - - |
-  install -m 400 -o $USER -g users /dev/stdin '$dir/$host/credentials/$hostkey.secret'
-"

diff --git a/private/hosts/oignon/credentials/wireguard/wg-intra/privateKey.secret b/private/hosts/oignon/credentials/wireguard/wg-intra/privateKey.secret
deleted file mode 100644 (file)
index 299e0c5..0000000
Binary files a/private/hosts/oignon/credentials/wireguard/wg-intra/privateKey.secret and /dev/null differ

diff --git a/private/hosts/oignon/root/credential.secret b/private/hosts/oignon/root/credential.secret
deleted file mode 100644 (file)
index 50ca278..0000000
Binary files a/private/hosts/oignon/root/credential.secret and /dev/null differ

diff --git a/private/hosts/oignon/root/machine-id b/private/hosts/oignon/root/machine-id
deleted file mode 100644 (file)
index 96abd3f..0000000
Binary files a/private/hosts/oignon/root/machine-id and /dev/null differ

diff --git a/private/hosts/patate/root/machine-id b/private/hosts/patate/root/machine-id
deleted file mode 100644 (file)
index 7bfceb1..0000000
Binary files a/private/hosts/patate/root/machine-id and /dev/null differ

diff --git a/private/root/oignon/credential.secret b/private/root/oignon/credential.secret
deleted file mode 100644 (file)
index 50ca278..0000000
Binary files a/private/root/oignon/credential.secret and /dev/null differ

diff --git a/private/root/oignon/decrypt.sh b/private/root/oignon/decrypt.sh
deleted file mode 100755 (executable)
index adc677f..0000000
Binary files a/private/root/oignon/decrypt.sh and /dev/null differ

diff --git a/private/root/oignon/encrypt.sh b/private/root/oignon/encrypt.sh
deleted file mode 100755 (executable)
index d2236d2..0000000
Binary files a/private/root/oignon/encrypt.sh and /dev/null differ

diff --git a/private/root/oignon/nix/binary-cache/priv.pem b/private/root/oignon/nix/binary-cache/priv.pem
deleted file mode 100644 (file)
index c79390e..0000000
Binary files a/private/root/oignon/nix/binary-cache/priv.pem and /dev/null differ

diff --git a/private/root/oignon/nix/binary-cache/priv.pem.secret b/private/root/oignon/nix/binary-cache/priv.pem.secret
deleted file mode 100644 (file)
index e7548a0..0000000
Binary files a/private/root/oignon/nix/binary-cache/priv.pem.secret and /dev/null differ

diff --git a/private/root/oignon/nix/binary-cache/pub.pem b/private/root/oignon/nix/binary-cache/pub.pem
deleted file mode 100644 (file)
index 66be1b8..0000000
Binary files a/private/root/oignon/nix/binary-cache/pub.pem and /dev/null differ

diff --git a/private/shared/nix/losurdo.pub b/private/shared/nix/losurdo.pub
deleted file mode 100644 (file)
index 0d0ed68..0000000
Binary files a/private/shared/nix/losurdo.pub and /dev/null differ

diff --git a/private/shared/nix/oignon.pub b/private/shared/nix/oignon.pub
deleted file mode 100644 (file)
index 5f45ab9..0000000
Binary files a/private/shared/nix/oignon.pub and /dev/null differ

diff --git a/private/shared/ssh/julm/losurdo.pub b/private/shared/ssh/julm/losurdo.pub
deleted file mode 100644 (file)
index adba22c..0000000
Binary files a/private/shared/ssh/julm/losurdo.pub and /dev/null differ

diff --git a/private/shared/ssh/julm/oignon.pub b/private/shared/ssh/julm/oignon.pub
deleted file mode 100644 (file)
index 70200e2..0000000
Binary files a/private/shared/ssh/julm/oignon.pub and /dev/null differ

diff --git a/private/shared/ssh/julm/redmi.pub b/private/shared/ssh/julm/redmi.pub
deleted file mode 100644 (file)
index 144780f..0000000
Binary files a/private/shared/ssh/julm/redmi.pub and /dev/null differ

diff --git a/private/shared/ssh/root/losurdo.pub b/private/shared/ssh/root/losurdo.pub
deleted file mode 100644 (file)
index 9397a83..0000000
Binary files a/private/shared/ssh/root/losurdo.pub and /dev/null differ

diff --git a/private/shared/ssh/sevy/patate.pub b/private/shared/ssh/sevy/patate.pub
deleted file mode 100644 (file)
index ea46151..0000000
Binary files a/private/shared/ssh/sevy/patate.pub and /dev/null differ

diff --git a/private/world/julm/hashedPassword b/private/world/julm/hashedPassword
deleted file mode 100644 (file)
index 4fedbc2..0000000
Binary files a/private/world/julm/hashedPassword and /dev/null differ

diff --git a/shell.nix b/shell.nix
index 0eec0fe60acc30b66a75d4f4c3b80971e123f04d..25c29d8a5ab627137e35388734dd337c8b30b8e5 100644 (file)
--- a/shell.nix
+++ b/shell.nix
@@ -8,7 +8,6 @@ pkgs.mkShell {
     (pkgs.nixos []).nixos-install
   ];
   #enableParallelBuilding = true;
-  PASSWORD_STORE_DIR = "pass";
   NIX_PATH = pkgs.lib.concatStringsSep ":" [
     "nixpkgs=${inputs.nixpkgs}"
     "nixpkgs-overlays=${inputs.self}/nixpkgs/overlays.nix"
@@ -17,5 +16,6 @@ pkgs.mkShell {
   shellHook = ''
     echo >&2 "nix: running shellHook"
     PATH="${inputs.home-manager.defaultPackage.${system}}/bin:$PATH"
+    PASSWORD_STORE_DIR=$PWD
   '';
 }

diff --git a/users/julm/ssh/losurdo.pub b/users/julm/ssh/losurdo.pub
new file mode 100644 (file)
index 0000000..18ea208
--- /dev/null
+++ b/users/julm/ssh/losurdo.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ7x5HBzsaocE2UBgfPRQyyeQxjYfIbhEx/LYIqXi5EV julm@losurdo

diff --git a/users/julm/ssh/oignon.pub b/users/julm/ssh/oignon.pub
new file mode 100644 (file)
index 0000000..eed4127
--- /dev/null
+++ b/users/julm/ssh/oignon.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAC1q2wHyOKumrw8O5pEFavZXeXf3P5332jGGB3EuXAb julm@oignon

diff --git a/users/julm/ssh/redmi.pub b/users/julm/ssh/redmi.pub
new file mode 100644 (file)
index 0000000..f822a6e
--- /dev/null
+++ b/users/julm/ssh/redmi.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKlhpn9VE6+neq2TENE9Hl7FjFFy1HAX3yn7h0bN7LtG julm@redmi

diff --git a/users/root/nix/losurdo.pub b/users/root/nix/losurdo.pub
new file mode 100644 (file)
index 0000000..61ffd95
--- /dev/null
+++ b/users/root/nix/losurdo.pub
@@ -0,0 +1 @@
+losurdo.sourcephile.fr-1:XGeaIE2AA2mZskSZ5bIDrfx53q+TDDWJOUEpZDX7los=
\ No newline at end of file

diff --git a/users/root/nix/oignon.pub b/users/root/nix/oignon.pub
new file mode 100644 (file)
index 0000000..0f68d8f
--- /dev/null
+++ b/users/root/nix/oignon.pub
@@ -0,0 +1 @@
+oignon.sourcephile.fr:slxL7XLsGXlD1r6gvw1imL5uQntW0TTlQgGQt3LBJgQ=
\ No newline at end of file

diff --git a/users/root/ssh/losurdo.pub b/users/root/ssh/losurdo.pub
new file mode 100644 (file)
index 0000000..0b8003f
--- /dev/null
+++ b/users/root/ssh/losurdo.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F root@losurdo

diff --git a/users/sevy/ssh/patate.pub b/users/sevy/ssh/patate.pub
new file mode 100644 (file)
index 0000000..2fe0f73
--- /dev/null
+++ b/users/sevy/ssh/patate.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOaag1MS41CRZrAji3K5IDROh5szSo34SDB0HNXGQtX sevy@patate