Start using age for secret management

modules/accentor.nix

@@ -106,7 +106,7 @@ in
         environment = env;
         path = [ pkgs.ffmpeg gems gems.wrappedRuby ];
         serviceConfig = {
-          EnvironmentFile = "${config.chvp.dataPrefix}/var/secrets/accentor-api";
+          EnvironmentFile = config.age.secrets."passwords/services/accentor".path;
           Type = "simple";
           User = "accentor";
           Group = "accentor";
@@ -128,7 +128,7 @@ in
           environment = env;
           path = [ pkgs.ffmpeg gems gems.wrappedRuby ];
           serviceConfig = {
-            EnvironmentFile = "${config.chvp.dataPrefix}/var/secrets/accentor-api";
+            EnvironmentFile = config.age.secrets."passwords/services/accentor".path;
             Type = "simple";
             User = "accentor";
             Group = "accentor";
@@ -140,6 +140,11 @@ in
 
       }) 4));
 
+    age.secrets."passwords/services/accentor" = {
+      file = ../secrets/passwords/services/accentor.age;
+      owner = "accentor";
+    };
+
     users.users.accentor = {
       group = "accentor";
       home = "${config.chvp.dataPrefix}/var/lib/accentor";

modules/default.nix

@@ -2,7 +2,6 @@
 
 {
   imports = [
-    ./default/secret.nix
     ./accentor.nix
     ./bluetooth.nix
     ./docker.nix
@@ -132,8 +131,15 @@
           home = "/home/charlotte";
           description = "Charlotte Van Petegem";
           extraGroups = [ "systemd-journal" ] ++ lib.optionals config.chvp.graphical [ "input" "video" ];
+          passwordFile = config.age.secrets."passwords/users/charlotte".path;
         };
+        root.passwordFile = config.age.secrets."passwords/users/root".path;
       };
     };
+
+    age.secrets = {
+      "passwords/users/charlotte".file = ../secrets/passwords/users/charlotte.age;
+      "passwords/users/root".file = ../secrets/passwords/users/root.age;
+    };
   };
 }

modules/global-mailer.nix

@@ -6,16 +6,18 @@
     example = true;
   };
 
-  config = lib.mkIf config.chvp.smartd.enable {
+  config = lib.mkIf config.chvp.globalMailer.enable {
     services.ssmtp = {
       enable = true;
       authUser = "webmaster@vanpetegem.me";
-      authPassFile = "/data/var/secrets/ssmtp-mail-pass";
+      authPassFile = config.age.secrets."passwords/services/ssmtp-pass".path;
       domain = "${config.networking.hostName}.vanpetegem.me";
       hostName = "mail.vanpetegem.me:465";
       root = "webmaster@vanpetegem.me";
       setSendmail = true;
       useTLS = true;
     };
+
+    age.secrets."passwords/services/ssmtp-pass".file = ../secrets/passwords/services/ssmtp-pass.age;
   };
 }

modules/nextcloud.nix

@@ -20,7 +20,7 @@
           dbtype = "pgsql";
           dbhost = "/run/postgresql";
           adminuser = "admin";
-          adminpassFile = "${config.chvp.dataPrefix}/var/secrets/nextcloud-admin-password";
+          adminpassFile = config.age.secrets."passwords/services/nextcloud-admin".path;
         };
       };
       nginx.virtualHosts."nextcloud.vanpetegem.me" = {
@@ -37,6 +37,10 @@
         }];
       };
     };
+    age.secrets."passwords/services/nextcloud-admin" = {
+      file = ../secrets/passwords/services/nextcloud-admin.age;
+      owner = "nextcloud";
+    };
     systemd.services."nextcloud-setup" = {
       requires = [ "postgresql.service" ];
       after = [ "postgresql.service" ];

modules/nginx.nix

@@ -13,7 +13,6 @@
           fqdn = "data.vanpetegem.me";
           options = {
             default = true;
-            basicAuthFile = "/data/var/secrets/data.vanpetegem.me.htpasswd";
             root = "/srv/data";
             locations = {
               "/".extraConfig = ''
@@ -47,7 +46,7 @@
     security.acme = {
       certs."vanpetegem.me" = {
         dnsProvider = "cloudflare";
-        credentialsFile = "/data/var/secrets/vanpetegem.me-cloudflare";
+        credentialsFile =  config.age.secrets."passwords/services/acme".path;
         extraDomainNames = [
           "*.vanpetegem.me"
           "cvpetegem.be"
@@ -61,6 +60,10 @@
       acceptTerms = true;
       preliminarySelfsigned = false;
     };
+    age.secrets."passwords/services/acme" = {
+      file = ../secrets/passwords/services/acme.age;
+      owner = "acme";
+    };
     chvp.zfs.systemLinks = [
       { type = "data"; path = "/var/lib/acme"; }
     ];

modules/sshd.nix

@@ -1,10 +1,6 @@
 { config, lib, ... }:
 
 {
-  imports = [
-    ./sshd/secret.nix
-  ];
-
   options.chvp.sshd.enable = lib.mkOption {
     default = false;
     example = true;
@@ -19,6 +15,10 @@
         { bits = 4096; path = "${config.chvp.dataPrefix}/etc/ssh/ssh_host_rsa_key"; type = "rsa"; }
         { path = "${config.chvp.dataPrefix}/etc/ssh/ssh_host_ed25519_key"; type = "ed25519"; }
       ];
+      authorizedKeysFiles = [ "/run/secrets/authorized_keys/%u" ];
     };
+
+    age.secrets."authorized_keys/charlotte".file = ../secrets/authorized_keys/charlotte.age;
+    age.secrets."authorized_keys/root".file = ../secrets/authorized_keys/root.age;
   };
 }

modules/syncthing-server.nix

@@ -9,8 +9,8 @@
   config = lib.mkIf config.chvp.syncthing-server.enable {
     services.syncthing = {
       enable = true;
-      dataDir = "${config.chvp.dataPrefix}/var/lib/synthing";
-      configDir = "${config.chvp.dataPrefix}/var/lib/synthing/.config";
+      dataDir = "${config.chvp.dataPrefix}/var/lib/syncthing";
+      configDir = "${config.chvp.dataPrefix}/var/lib/syncthing/.config";
       openDefaultPorts = true;
       guiAddress = "127.0.0.1:8384";
     };
@@ -20,9 +20,13 @@
         fqdn = "syncthing.vanpetegem.me";
         basicProxy = "http://localhost:8384";
         options = {
-          basicAuthFile = "${config.chvp.dataPrefix}/var/secrets/syncthing.vanpetegem.me.htpasswd";
+          basicAuthFile = config.age.secrets."passwords/services/syncthing-basic-auth".path;
         };
       }
     ];
+    age.secrets."passwords/services/syncthing-basic-auth" = {
+      file = ../secrets/passwords/services/syncthing-basic-auth.age;
+      owner = "nginx";
+    };
   };
 }