Add secrets and cleanup

flake.nix

@@ -18,7 +18,6 @@
         modules = [
           ./hosts/common.nix
           ./hosts/syedm
-
           home-manager.nixosModules.home-manager
           { home-manager.users.me = import ./home; }
         ];
@@ -29,7 +28,6 @@
         modules = [
           ./hosts/common.nix
           ./hosts/tardis
-
           home-manager.nixosModules.home-manager
           { home-manager.users.me = import ./home; }
         ];

hosts/common.nix

@@ -1,6 +1,11 @@
 { config, lib, pkgs, ... }:
 
 {
+  imports =
+    [
+      ../modules/secrets
+    ];
+
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
@@ -31,6 +36,7 @@
     shell = pkgs.fish;
     extraGroups = [ "wheel" ];
     openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPFh01e9doyInt0980V8T4xaakcSaOyXaxxYE4+oSwM me@syedm # server"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJFUwk54CNtSLUyXSTLsIs5KXgEsjOgE4HGlA4FacKjV me@tardis # msi laptop"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMeU7L0yQ4+O1GME4D4UM4f6nqua+pWt/zdsMvyHV94 u0_a309@localhost # mobile"
     ];

modules/cloudflare-ddns/ddns.sh

@@ -1,6 +1,6 @@
 #!@bash@/bin/bash
 
-source /run/secrets/main.env
+source /run/secrets.env
 
 cache=/var/lib/cloudflare-ddns/old_ip
 IP=$(@curl@/bin/curl -s 'https://api.ipify.org')

modules/cloudflare-ddns/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 let
   script = pkgs.replaceVars ./ddns.sh {
@@ -8,7 +8,6 @@ let
   };
 
   cloudflare-ddns = pkgs.writeShellScriptBin "cloudflare-ddns" (builtins.readFile script);
-
 in
 {
   environment.systemPackages = [ cloudflare-ddns ];

modules/msjd.nix

@@ -1,5 +1,8 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
+let
+  projectDir ="${config.users.users."me".home}/main/msjd";
+in
 {
   systemd.services.msjd = {
     description = "Msjd";
@@ -7,7 +10,7 @@
     wantedBy = [ "multi-user.target" ];
 
     serviceConfig = {
-      WorkingDirectory = "/home/me/main/msjd";
+      WorkingDirectory = projectDir;
       ExecStart = "${pkgs.nodejs}/bin/node index.mjs";
 
       User = "me";
@@ -19,5 +22,7 @@
         "PORT=3709"
       ];
     };
+
+    ConditionPathIsDirectory = projectDir;
   };
 }

modules/secrets/default.nix

@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+let
+  thisDir = ./.;
+
+  unlocker = pkgs.writeScriptBin "unlocker" ''
+    #!${pkgs.bash}/bin/bash
+    set -euo pipefail
+    if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
+      ${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age"
+    end
+  '';
+in
+{
+  environment.systemPackages = [ unlocker ];
+
+  systemd.services.unlocker = {
+    description = "Secrets manager";
+    serviceConfig = {
+      Type = "oneshot";
+      StandardOutput = "file:/run/secrets.env";
+      RemainAfterExit = true;
+    };
+    script = "${unlocker}/bin/unlocker";
+  };
+}

modules/secrets/locker.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+AGE_PRIVATE_KEY="$HOME/.ssh/id_ed25519"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RECIPIENTS_FILE="$SCRIPT_DIR/recipients.txt"
+ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
+
+TMP_FILE=$(mktemp)
+
+cleanup() {
+  rm -f "$TMP_FILE"
+}
+trap cleanup EXIT
+
+if [[ -f "$ENCRYPTED_FILE" ]]; then
+  age -d -i "$AGE_PRIVATE_KEY" -o "$TMP_FILE" "$ENCRYPTED_FILE"
+fi
+
+"${EDITOR:-vi}" "$TMP_FILE"
+
+age -R "$RECIPIENTS_FILE" -o "$ENCRYPTED_FILE" "$TMP_FILE"
+
+echo "Updated $ENCRYPTED_FILE"

modules/secrets/recipients.txt

@@ -0,0 +1,2 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPFh01e9doyInt0980V8T4xaakcSaOyXaxxYE4+oSwM me@syedm
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJFUwk54CNtSLUyXSTLsIs5KXgEsjOgE4HGlA4FacKjV me@tardis

modules/secrets/secrets.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 ZK0gQw 9LrC4V6ibhKKKoE8Dtm+caoI2z6tT6oBnfNAl5qlcQ8
+NWqFWrj49jp2e8our9rpYpHZZny8t4mKGogeRNMFCkk
+-> ssh-ed25519 CjJArg bxVL+Is1oNN4QLRW24hPOpFFAhGmGyF611o3oASaJFk
+K8a5oDyvQ4k0YeDBseS2/SmvPhu39LWyRuFkWi0gm2s
+--- wjAuZMd2h4fvKfKtIdHmEYPO1sEC64tmU4uZarAK4io
+Ô@àˆó,RîžÐÙ$øôG—8Š‘WÇì×®µ–žñ[