From eb5fffaaa05a56079eef3bdc9949f897d792c2c3 Mon Sep 17 00:00:00 2001 From: Crony Akatsuki Date: Fri, 16 May 2025 08:18:46 +0200 Subject: [PATCH] feat(servers): set passwords using hashedPasswordFile. --- modules/servers/general/default.nix | 1 + modules/servers/general/root.nix | 5 +++++ modules/servers/general/secrets.nix | 6 ++++++ modules/servers/general/user.nix | 4 ++-- secrets/conduit.age | Bin 1028 -> 1028 bytes secrets/crony-passwd-servers.age | 18 ++++++++++++++++++ secrets/forgejo-db.age | Bin 1074 -> 1074 bytes secrets/miniflux.age | Bin 981 -> 981 bytes secrets/root-passwd.age | 17 +++++++++++++++++ secrets/secrets.nix | 3 +++ 10 files changed, 52 insertions(+), 2 deletions(-) create mode 100644 modules/servers/general/root.nix create mode 100644 secrets/crony-passwd-servers.age create mode 100644 secrets/root-passwd.age diff --git a/modules/servers/general/default.nix b/modules/servers/general/default.nix index 43495e0..f6005fe 100644 --- a/modules/servers/general/default.nix +++ b/modules/servers/general/default.nix @@ -6,5 +6,6 @@ ./secrets.nix ./podman.nix ./additional-pkgs.nix + ./root.nix ]; } diff --git a/modules/servers/general/root.nix b/modules/servers/general/root.nix new file mode 100644 index 0000000..413e9c7 --- /dev/null +++ b/modules/servers/general/root.nix @@ -0,0 +1,5 @@ +{config, ...}: { + users.users.root = { + hashedPasswordFile = "${config.age.secrets.root-passwd.path}"; + }; +} diff --git a/modules/servers/general/secrets.nix b/modules/servers/general/secrets.nix index edf22d0..935a8bb 100644 --- a/modules/servers/general/secrets.nix +++ b/modules/servers/general/secrets.nix @@ -5,6 +5,12 @@ file = ../../../secrets/traefik.age; owner = "traefik"; }; + crony-passwd = { + file = ../../../secrets/crony-passwd-servers.age; + }; + root-passwd = { + file = ../../../secrets/root-passwd.age; + }; }; }; } diff --git a/modules/servers/general/user.nix b/modules/servers/general/user.nix index 672f925..6399bdb 100644 --- a/modules/servers/general/user.nix +++ b/modules/servers/general/user.nix @@ -1,6 +1,6 @@ -{...}: { +{config, ...}: { users.users.crony = { - password = "whatever i will change it right away"; + hashedPasswordFile = "${config.age.secrets.crony-passwd.path}"; isNormalUser = true; description = "crony"; extraGroups = [ diff --git a/secrets/conduit.age b/secrets/conduit.age index 806868aa54c6eb45bdd90bb91470a852af221377..ab4241fed5501c56aa7f6aad283de924253121f0 100644 GIT binary patch delta 940 zcmZqSXyKTkQ(va7pKO_$5|Qlg;^&@d66$K27Fw8@R9IFHP%5$td#aIfN`Qx3N_nDjWx0=2sChxLiOJ+RMv3qw{ZbE8|BMP} zqipR|?Sjx`w}2uKXAi@yGEcJt{mc^cMBlJ5Z(ol<<8rQo?0mm`O9N+fGvC6jv_Ny; zg2bw%Feh!#MCX#kv^2MDbA3;jWRD`F(BjEw8O7^;L%b~`vds*9oPzS5%JYj8gY(nf zy!?X`U5cYp9Ss8wd@@4~^WAfz3=Fu^U4tw2%lur-ERB-5 z-71|eigOE0T&vuxTwT#4AlcQ^&(~4GCp;`TBB@H-BqJiAJRl`KsovGq#WSkNFtx-m zJ;GDJG(EyA#KkP9IMcYC%e%_Sx56YS#n&(-%_uS5C^;(JJ+wH}**B*oEH}p}qOwTa zqO{mo+o;4B-MX|C{V1P6h1BA((p00e;*x-rqEwH>Gz+(UcOOFwvyA+dB(LOR!|cF% zZ)YRZ{HUaI1Fpc9pzzcz?a06sOUFV(?Oc!IQq!ccNUro1 z8|FtCUA$xddxJzoWBlEcKK5NbJuAC^)VrL&UHzc+$HUXg2Je5BUC!Kd;hOZt=T(Oz zUopPP^z@mh#=go#eTV(FwIYu)T8lrm8Z>r#IPSh2pL1f#whJrLo^XjpzKP}(xg{bb zz9Ka;`a|csn#0M4Eq521+8-!7kUnGcbBWgzM5IK*BDp@hO6Rs-U-y)T~yYTz3A~#aXHW8F1^SSs|C-)8C3wCjZnG( delta 940 zcmZqSXyKTkQ*UYPX6YZCt{-mco>t^u;ZtQA?(19?SG!h z%4L-6uI+5(X&91iT;dfPP2pR9Kngp6?ZzV_a+!>SY)fVj3I}%B5?kP+Xj$ zo0?)|YHDbyV5XfBSP-ZX;9XgiS?H1!5t!#0780QE?&fG5Y2j(+=x6Mo5|QNTmR9N= z7MbrG;GSo}`{@O80P0y7?tK`5tdPvXk@0JQxK6C7F3>}9poD2oo=4v80zde z@uPT{cezuNVT4n9N_mO5V^L;!fL~sqpGAb5MP)!)P@;QPv4>|$U}B|zL53%nyL*6> zw`Eq8wqZm_Wkx}Gn0L96M^s8$V2Op9wt`asL5O2dM^D^`F%yh26fOPHPbmuTv{Zf<6PyPJPVKX#7zCPOq0oH8O7_JGSgfPT?)ff(v!0-5)DI4T#{T0 z3Y?0gvOR-KOaQ~FNAOojhZ`YL4K+8glP%f=Q z+-okhz5dgG(V}nBhc%P@TXH+@$ZC14t-n!b%p|(DIMA`(^i_Yu*{3@gB)Ar5nc5!c zFqmhTwM=&xr>gJ$Nm5Mx*Q6CXN*NW`P87Hx*&-z+jLKpcnfB3f**~@=g(44ya-j?L^W&8sBAADYxp7G^?hnwu0$)|6;?P?Qw uxiCqkjjfUF(?)wg3Ql??+|; diff --git a/secrets/crony-passwd-servers.age b/secrets/crony-passwd-servers.age new file mode 100644 index 0000000..22a6a49 --- /dev/null +++ b/secrets/crony-passwd-servers.age @@ -0,0 +1,18 @@ +age-encryption.org/v1 +-> ssh-ed25519 2P4nKw uE50KrXeVqboQgR3E4jBMyEY1Eag0iYyBqsFcNq46kA +L0hB1KJ/93ZoGJA82sFK/yCp6Iqw3jGqCOs6jZg7fM8 +-> ssh-ed25519 6+hQpQ IBPIcFcduVkdO8eBZ+JnBaDGkB6BRVSKNz1JrR154Gk +25Qa1YvB3MjwmRFuoHCPvEn/sjc14Em+cokMEKy0OGk +-> ssh-ed25519 l/ODWA +6i2fEJzr3pwkfL/vLQcCEi8uInG44Ki89PJVN72WAg +eI03G48J5JGKGGfMnVTy6i7yki4s5WAtx9KjTWJx+tg +-> ssh-ed25519 7+5K3Q Z8Vcpm8f5wqyVuK5iGGOVWzB2uH/PfiW5+AF2h8wZFc +jUuXzfNFTcI0775pp2j2QHntrcNHG47T4QT00qxZ3WU +-> ssh-ed25519 Ow0TGw OLfB0cEoQCEbCy3qKtIk0srwSJYt8BdxO4QcWcEziCo +KipTui0UB//I1ktebLzrursmtnhijEsJ7OqF51QRI2A +-> ssh-ed25519 cEINMA I3KqLlTXhxMDx/m3kot4H7FQqWvYGlh9VlKYYjeWmlc +3VYcLSHU6lDRUgQDLW32jVYiZW6NhNfFcKU15KZqSNI +-> ssh-ed25519 fd/ZLQ LCpZ1/kZk0wcoqVyga0dKwheZbG64wUZhNjVlzxsJVM +gj8tePLX1WKR6tPdE9ii9zKiqXDC3nCpVYES+YVKuUM +--- 0+ou8pl8fJW8xWQeJ1v0ALJmt/GVi/hjVYY/q/Az574 +8@`HHDp\0~`Hg\S"䴏nb-ּp.F/]bـa`b0nNp^+bHVfR{<0iL+;r zFPC##qIaTCVR}SraA|H@d4OqVg=tw;VwRlz zT5^!9rIT|ym%hJIfMG?EYhIXFc~w!Gk8yBPVyIbIV!CfyerlLmeojbzL8U&KZWYeu9tG}Iq1nY;W))$c zVea`!ITgM+Ns&HoZYIh3rImRWAvyW(ZqELh6~_9dW{LjB8GezI;~B-nE3@*_^E1+& z%q_J8J&jEZgTh_(4J&dYT+8yqN>V+lEX=g?ll{znoQ%u4(meypyo2*f%6#;b!&B12 zGxHNO3%mo|jlw za|_S1G}kV7b@8+`h$_tuHq0z5OAd_WGR?~~iOA9S2~BhgHqR+DD^3k74b8|ekBs!p zN_7eH4tCGYi%j=3&GjiqkAY-YPd{Hr1^uwB2(O$Z!@@MPG=mEB(5(89_xvo^ijuG_S1#YIv;a2?@63#3!w~l}ui_9Rk1SXHO1IQ1APju_jQuL#I0u?+0f`UCGk}T7+9Q`~4@|=vaeF`0&{4&yw%`Ge{bKDaH z>h<&e@&mm*99_9wl8r0!5`%mbL(?OJ3d(X^!rcn|T%$}aB0SQZyn-@|eIk=8L(KC_ z4I;U8b#)c|N{l^=atz!pGP1%-BfayJ%KggAQ?tC2eOjH#!*6-=g+LVQnpo@RBHot!u32-j@0C`@fdI)s*+!wsvvun0z84 s`RPYfXYI5@*Os=l{P7AA{Psj#q@%xIV5`}k6`2!vgnUT#n)5Xm08}h%1poj5 delta 987 zcmdnQv58}XPQ7EQnSWkzL3xHrps9D1Uy+}8aYjXx^SX}P&)abk+TW2KozpjmNt zIhTofjP{WSXI$c4CxsaAAapWrjzKIc0;bGb?$x$9Yp{b5W#cr0#rXhvdF7DZr;~B-n&77-(eX7cw z4BSHlbN%%_i-Su|3L-6vd?O07^&=BAGlINJ3{!GV{j<`!lG4(uqSBKp4ARX!3%qkJ zBcm+Biv6-&ESwC}ef@&WGa@}xEmMtCs&XACpJf!U5B4ue$;m5@3XbwmD^7HYFmo#? zt~4`qvNUq6@YdFLO!IZMC<)362+mCBa<7ak%5}>wO34rRFUl-1i3s#5PA{wSFLNx3 zN-=XyD#~|q3dpL+clC@!kAY-YPd{Hrg`grw)6#5r4|mrLmoz7{l9KwY^2*RKf0x7z z*St($a|`p-ymB97ckimabgqhmuuScuDuZONDz6Z;(qt23w~BP%a>EqUD*q(?Lj9`D zf?!K?!zdraP;~3kQuL#I0u?-+b1f`#)16IAGNXzOlEZyMlfxrTgZ;`AwUetdOv@{i z>r0KR5*^bm$_==(ECLK&Lc_~*Eu50W(jCpb3yh+wBE164(tX^$^YkNKOf!R$GTptC z^dq@+b#)c891HY4ohp5T42+A6w7pBBJc{xy(<%$JOY_sBoPsQJ{GB87Qv$;aj6%5> zHWg2~wtUm-j;zCF2N^d-mCi8U@;$;}cUQgck@;(~-_`zpyy?luqicW6u_`=xdHepevFx&%^}gqv;YZ(nN6(qe-srRAz>9NQ^F&|1n`V1CjIVifUDwhZ zC6mhSLt=s|JcJLNSgZIge^W}6{X~KH^Y6>ZmU3OOS}82<@pN^g`$;Y4V<)3Zm5Scq uv(B9NAtdu)lE%Y-xuUBYQ+8-)ANkez1`Be@~h0!LyJo@yn`akA`HvZ zj9rbZvZE~BEW>lmO!F+AeN)5CgEEuLDlB~`pJf!UcQgy|_0x9siYUl44{qa!aGCV)rti zJnbxlz}%8Z_rQ{zpyHqi11=|@OvB9JqM-7~P)Eb;;)tBoz@m&i=g2_wBnwwdpTt6g zMDxmUOII^LM|A7bQuL#I0u}rUj4UjTgY%<25)DhEd=m3Ls-p6W!ZU&j0*kdB&7&-n z>rF#aEz*ip97DOHB3;AulgpD+3&RXNeZ#b~LjA(clFS0q4IKmZy^?(`L&`jYBMMy$ z!jidkb#)aYJp3#3Q^S*TwDZH{PDrXxiN3eLE0?aFLUD11 zZfc5=si~o*f|+(kU_qclhHGVIo_=YfaeknCVL`S*n45`_X<(F3dSZF9Pj;GVdWyGq zr9qN$no&qLmx-IBud7Ezd8tvEp;v0Mk#nd)YN%IbQJQmPxTC9cen_H;X;ns=Q&e#A z#E;_P+T|twMW!hsNiIo7PLYm@fnEikDZb@~m8IULk*UQN?&)d9p1Jvk{@Dgx+1|#v zmg!}Fh3RI6RVB%VL4jr=6t^&_At$KN%!)rtO#~7 zEGWVsz`$QuL#I0u@|B0?SQH(<-adGSb}KJTfD*gEEXwoXtG6D}8e!f)XoS z>I0(8l7sy7@?5zrg0y`rtD=1L3vui)3?c~z2jY`a$CqZpt4dlqSH3p<;!>9R)~|8%?2 z^&vro{fxc$26ruYNAqLH+@ibB`2XCsX1C_?f1&)hS6!&Sy`X(xCqqVFk8|UZsgouj y%X)A9z=HMhw|SfLo0w)g{;162zP^ofYw!BWOFRzQoZC0)-BroTmFsy<`T+ov^E;>j diff --git a/secrets/root-passwd.age b/secrets/root-passwd.age new file mode 100644 index 0000000..b6a75f5 --- /dev/null +++ b/secrets/root-passwd.age @@ -0,0 +1,17 @@ +age-encryption.org/v1 +-> ssh-ed25519 2P4nKw SRZ46jEyxBUlfg+t25OcceZlxftixfwhZrGnMyhu8Tw +khskBqjrEszMI8aV/DmDygqAii1SwpFKsn6luSssEgY +-> ssh-ed25519 6+hQpQ k3Cz7H4EK/kgHycD+5KopNxaKCfGNrE8uAgbrIl1fyM +tyvq6xS11MahN4CFQLKnQQvo0cMAFkbBP942gPsQM4Y +-> ssh-ed25519 l/ODWA d3/L4FVQbcB9bx8gkwfSEW50h1fjJXuWNL5AVH73Vnw +l08tXj6+7lnPiJcJn5VQfxJiOD8qV+5wCB/XMtPmFDE +-> ssh-ed25519 7+5K3Q BEblcFpA0JHJWHHPyElzJpfYVOK35+cG9Io/LXVPwEk +SwHqJU0pWLDxWPLoVBT8B/v41uEVxGckRCF6vj/NgGA +-> ssh-ed25519 Ow0TGw Hkn4XZMDAJEF1agRN3tVwyNmCXiuvlcgcN+/dUbYKAg +uf6f5PcIHdzsxF0LyrXkkConGCARZW3ORw9S5TCl+nw +-> ssh-ed25519 cEINMA InM7UKDH5j86IKxEp7NjXbitrwNg++oUrWwURs3fuhc +HdRySiqzff23IGwLIAuaxYO7gp7vN+eegNVWB/ds9EM +-> ssh-ed25519 fd/ZLQ wPaoRwfInUvsNhrjV3QLy8akQXAE1Z/xaAO6V0Z8aFE +bn+bdfqKzm1H/gLTWD+6Iu4ccCJfmUEA6dCYu9ixdeI +--- VzTkVf1tEmnZ1qLDsMHndgjkTRBCMnasQx3NbWSw/y4 + ͒ ƵqX7/4 WUw䱦QO+TF;f1TDeqYo?d,l7t֩,+u(f1 \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 3cf4326..55f5bc1 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -25,4 +25,7 @@ in { "conduit.age".publicKeys = systems ++ users; "searx.age".publicKeys = systems ++ users; "miniflux.age".publicKeys = systems ++ users; + "crony-passwd-desktop.age".publicKeys = systems ++ users; + "crony-passwd-servers.age".publicKeys = systems ++ users; + "root-passwd.age".publicKeys = systems ++ users; }