feat: try rework

2026-04-04 11:42:19 +02:00 · 2026-04-04 11:42:19 +02:00 · ecf10628c3
commit ecf10628c3
parent 1ddbd3b8b6
51 changed files with 1941 additions and 445 deletions
--- a/secrets/README.md
+++ b/secrets/README.md
@ -0,0 +1,56 @@
+# Encrypted Secrets
+
+This directory is intended for encrypted secret files managed with sops.
+
+Phase 1 notes:
+- Keep encrypted files in git under `secrets/`.
+- Do not commit plaintext secret material.
+- Update `.sops.yaml` recipients before creating real secrets.
+
+Typical next step:
+1. Set real age recipients in `.sops.yaml`.
+2. Fill the template YAML files with real secret values.
+3. Encrypt them in place using `sops`.
+
+## Phase 3 expected file
+
+Create these encrypted files:
+
+- `secrets/autossh/remote_proxy_key`
+- `secrets/autossh/remote_proxy_known_hosts`
+- `secrets/openssh/authorized_keys`
+
+Expected YAML keys:
+
+- `qbittorrent.vpn.username`
+- `qbittorrent.vpn.password`
+
+These are materialized at runtime to:
+
+- `/run/secrets/autossh/remote_proxy_key`
+- `/run/secrets/autossh/remote_proxy_known_hosts`
+- `/run/secrets/openssh_authorized_keys`
+
+File secrets are stored as encrypted whole files, so the decrypted runtime content is exactly the file body. That is the right choice for bigger files like SSH private keys and known_hosts files.
+
+`config/secrets.nix` is the source of truth for the tree, and `config/sops.nix` is derived from it.
+
+## How to encrypt them
+
+Fill in the placeholders, then run:
+
+```bash
+sops -e -i secrets/autossh/remote_proxy_key
+sops -e -i secrets/autossh/remote_proxy_known_hosts
+sops -e -i secrets/openssh/authorized_keys
+```
+
+For scalar secrets such as `secrets/qbittorrent/vpn.yaml`, use the same command and keep the YAML structure.
+
+## Template files to fill
+
+- `secrets/autossh/remote_proxy.yaml`
+- `secrets/qbittorrent/vpn.yaml`
+- `secrets/openssh/authorized_keys.yaml`
+
+After editing, encrypt each file in place with `sops -e -i <file>`.
--- a/secrets/autossh/remote_proxy_key
+++ b/secrets/autossh/remote_proxy_key
@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:Iym3BrpihMwVIVxaMIRDP0PDmrdAKv+MBhn9PVoejrnHmPjhlFKGVzVYaH7ch2KlggiNNO8ywQfkGjbJyLKjs8489pCmOAOoc3HoVGbf5qvo34ZdBQfv3G+GRaKQXAuQOK61is3fNMo5cVBuRFdjba10pnUQrbEahNyhzCH6TwFUyX2YcUo5zoc5RNjMGt9UfS0Prr95Lnejpu3YGJ+yQnKBFFAnjjJaOtLj//sUfF2bngZk/KmqHqaAj0GM6ZB5wJi76Z3q1Z+jUfYSIqv8chqLFdo5s+mttEtYDAdqeTKmyMrpRMtLQ09H1Rwuu10Uklk2VW7PU7+pwJfH3VVRAqW63rM2woQeEg9Gs4AQzo0sLhCmHw6CppIe1Hi3ZzHBYQbu+rFlWHS9ohHgWx1OQEENtYH1ZKy2Gt9BgbmgY6QGbGnuh+ROlyNp8EQaLXoEg8KSfC7i8VhqBkBUp8UZaQWvmYI9SOd5sRESMONBOwLfDL+zsZi+7lDtiKqUQgXpW4lhiL9toqjeUlqmAk2P/Dz+54rM5WeNf/gh,iv:RxTg1LCac+vbluKNQD5Zdf8BZISIWkqRGUqV80CBIv4=,tag:jmkYsdgMBAJUfxMxnuc13g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1g5q3hwnpgsas682jkq0zmee3zqggucfe0v5ec0a6pv7wzexadehqne66cj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNWjRJbGZNeEU0MTVhZUlU\nbnJPYlNOcU5raUtUUnlDTmdzWWgwRDExZVMwCk1IUUNnbnQ2UU94N0psR3V6bGlD\neXUySktnZDRPeWtER3VNNDFhUThtMmsKLS0tIGFtRW5BZ1VyZHdOdHA0T3dWcFhL\nSmpBTzBBdEZMMlVjYTBObXFXSElWN3cKvwUP6fse0T8+cF1EMOnlK9J/gDLokTCk\nI2WzU8fTLxpO/ioieQSm0MtpGm30hyXk8JbhSgZ1rRw1tQTQynLSfw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qmnmge7atpg5k0zdaky0tuux2rgtehxfhtnshcjpyl0n2hx2udhqe62wyj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMmNsVThSNGhrQ1VWckkx\neER2c3BLbVIxTTFJaGVhNVlOT202UHhCaERBCjk5bXZmZjhlOFRSWHh3cnhDbGFm\nN3Boc1pzWVR2cE94a0xFSnBybFpVQ2cKLS0tIG81RzVtZXVIcGo4Q083YzNoZm9x\nOEkvaDVFdE0wb1Y0NnlOR0dlM2V4Vm8Kl8GsimjzsnLDnvF0I2B9K79Ohj7aoITo\nlJ8O8BlixGhK3LmxAaHDihiqnV+YMWROorF+8z1eJ+wtBOU1ON8F4Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-04-04T13:36:38Z",
+		"mac": "ENC[AES256_GCM,data:6stnsbcCiaiAkjZ4kWZ8FHxLuoxsH5vPoZclhnSY0GmFlhD17i+qJBiD21KBO5fhnOmQdku3x18XeHvzjbommlmDRaaIcTk71phkP9c5eVOQSuQCe/02xTBDGriCTT/NFgoLBIM5VGp1ItI8BxNEL/Lp29ugjQqCVqHV9sXYihc=,iv:lL0UfNYe4Y0S7whNts5BSc/AYxpeuWbwifRFqqiz7tI=,tag:XWVlf5+QDetmkgQlmPgyIg==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/secrets/autossh/remote_proxy_known_hosts
+++ b/secrets/autossh/remote_proxy_known_hosts
@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:1ZzjJFqw28vXu6cw9efESy11132ntsaZwBmNqupqWju+y2iT2qq1wE+meGVH/e59YMC0ptNpsm+RbcfvC81vFvTFu46FUXPw2fXPb5UQmyDZxN7q+AM8SuOCqSy6,iv:FguIXmdsNUvhoqME97e5OIY+LMy5uuNd+d295U4lTuE=,tag:QlKokl5sOAtgwu06pnuRgA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1g5q3hwnpgsas682jkq0zmee3zqggucfe0v5ec0a6pv7wzexadehqne66cj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMOFZDME1qTXlPVFp4Y3No\nQzJvSHJrOUVGMGRtNkpOeXVDYkRjT1NJSmhVCk9zVUxTZFA3RXUwbURiS2ltUGFF\ncms4YmZuRzgxR05ybEJxRUt5MHFyaHcKLS0tIExzRE9peG1TOU9EY21CejFWeHJY\nQ09VRjd0OURiYWlRenVLeEVTNnEva00KXqvLbJUtdQPp0miPg2dXBHEX3z8WpdoL\n64Wc3iIMRZmOruWdlij5cstcV4pDIAkDHk5rVvOthXOhGWARFSySbQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qmnmge7atpg5k0zdaky0tuux2rgtehxfhtnshcjpyl0n2hx2udhqe62wyj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSVhGUHVJNVZVRXhxZzhx\ncEVSNWZBQW8vQXlYdnFUQTg4Q2VlY0lZckRnCkRKNnF5R3ZlUElWN0FOL1hrNHAr\nT2JPaDJ3bzVhZzZONHBkRHBueW16eVEKLS0tIEFxU2pWMVRqaC9BeGRsaWppT1lO\nMzI4UmkybmROL3dKK0xEaWpCM1VPQzQKWsLEb0Z7fbTVF8WQ8a1Lom8Bh7FQ2cPB\nIwIqWRM1L0oXNHyBoFkmHO434DZ8SXlyUYegBwrbVZGedRQFLQ4ibg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-04-04T09:12:02Z",
+		"mac": "ENC[AES256_GCM,data:C6jOqg6lFy8A2UTIfZXjtNB/F+0UZJV8/F1sOm4aGgR5B4e2JT+3vL/A62m6pvrj1zSuoD1dH47y3OcpmO/FmsnYcCTdWW2MPEOA63NkHJMScaLJry8JDHpColG8WYmJfGb9QwLJ1O64vpUNXNscmUFs7PomBgJnMCmTyo3twKk=,iv:wiAJw8Vk70b/gnfcgPlT3exsnnp87mGoIXMtzqd5m88=,tag:oT9TPTNSDX9y0cJJCP/JkQ==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/secrets/openssh/nudelerde/pub_keys
+++ b/secrets/openssh/nudelerde/pub_keys
@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:nRYC+xLnrS3nWrAeohjrIxZpmxWJgw8KxyPOTlnsQLZ3TnGFETPwtF1d6zkqOA4PRmx7j9FrvBSVXMuPCOjk+buy9VWg0FbUBbPXkvZIlYujO65PNDhtan0nHVmMLmc=,iv:xbAu2PamJZQL5mRk6ltgvqbuWoqW6cBPcFMAbUTxtw0=,tag:BRlpJK++1zo26gZNuTdo0A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1g5q3hwnpgsas682jkq0zmee3zqggucfe0v5ec0a6pv7wzexadehqne66cj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TjFGc3o2WDd6LzFndmRX\ncTFOenBZMVhHQTFwZ3ZhbUZoQ3d0U0NFVlFNCnBac3lhV0MrTTVOMGM0UVdzZWph\nR2dMMm1Wd0Y5RTZaR3JsZlkyUUExSkEKLS0tIDF1Ykk3WUlFR1NobjlMb0t2amQr\nS0pxRTExd2RUbnpQS01jRFhOeTZqbEUKAqTUCqboGDjhxZhbtRzNGCFdmNqfRnd2\nNk0r7MyT0HWOcJ7RR3iuYaDOM+mTWPcVkg49qjlBvqDf7V48/BP0Yw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qmnmge7atpg5k0zdaky0tuux2rgtehxfhtnshcjpyl0n2hx2udhqe62wyj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoUHkvcWN4cmY1TlJoN3Zu\nc1ZyWGdLSk9VR2hVTmNkemZpbVd2ZTY5UTJJCmFCK2RQNnEyQkNPU0VTUHowT3NP\nckFkZWRtWU1nWVZibkcvZXhXZ0ZRaG8KLS0tIEZZU0c4eDljRlNIbmFHZXprSGc2\nQTFHZW02cWVZeXJja3FvbnhQNkozaTgKQV71qhDor/GFMtxh0Hq/7cRIBYHLvVG+\nSXV6kleiGrv1KdHLrhzJWdOBIhHRcC1ttQESCPRo9Wu7YBCN0KMUmQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-04-04T09:18:27Z",
+		"mac": "ENC[AES256_GCM,data:7GX0/YPMQpv/BHGc3RCqtxVHs2q44s1BWLim4eNuOH9AwMSQ5DohexuWS8hh0zGzthG8Nhv/X+R1Z0B3yXJyWkYiRuuAfO5RKMRWYNWQuCg1dsvkdDA+75D1Ffx6JuyzW+veqNJltDhEE6Jy9S9k14pGUXhjOmufxANUFjQULWo=,iv:9uW4ivEvdQI7ZA5+yJTKVAUrNpbN8lOLo/mJire1d0s=,tag:qgUZPZLFR/u+Dmuqyl764Q==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/secrets/qbittorrent/vpn.json
+++ b/secrets/qbittorrent/vpn.json
@ -0,0 +1,22 @@
+{
+	"vpn": {
+		"username": "ENC[AES256_GCM,data:xEt09ZfPxp2n1G4c1R2X0Q==,iv:7PrsBmyMKcZKKvBhMSRBCKRmiPDjaBIUp+eQEOVVsFM=,tag:njOQl6plAdWe721cqI222w==,type:str]",
+		"password": "ENC[AES256_GCM,data:i96WgN69BCmV0yGBtpa2BYtpeyy9rSQqt2RW0hJHlog=,iv:1s24mv/jot4mOAn77DqI6Iw/Tzkl0g0cz95jOwWwiRE=,tag:Gqlv24hGgyRTw0EpNf8JGQ==,type:str]"
+	},
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1g5q3hwnpgsas682jkq0zmee3zqggucfe0v5ec0a6pv7wzexadehqne66cj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIL3VaMG53OFZrWVdQLzM0\nSkxBckVvRHNKZ3kxMTBwNHhEY3R0R2RjM1RvCkxyditvRzhNYUhVMlNXMWRtb2pF\nZGFZZkF1WlFUMlFHN1hGTmVibmtndzgKLS0tIFp3USsvMityTXBWU3g4MWV4dmkx\nVldLdkh4QXJsZWhyalVlaUwrMGVoQ2sKYFNkF41ba+rv0MsJ3PCw+HFejMsAv9MK\nt1GhHCXdTXqtw2DgjdvFePf8CHgTwBdVt7iLL2BDOE79S2PkXXEbng==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qmnmge7atpg5k0zdaky0tuux2rgtehxfhtnshcjpyl0n2hx2udhqe62wyj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOS1FFR2tuMkZkbFZzR0E3\nMVdHRTJaNXZMNXJrdTFJZVhFU3lsamUxckhJCnBYQXFPbjNpWTZzb0R4d0duQi8v\nODU1Y0RmWXl3UXJHTDVIdVROTDlMRkEKLS0tIFFGNENjMUR5OVROWi9aTEsvWDNG\naEx0WmZtUVZuN01FU0wrUnY3SCtuQ1UKKxh+u5LBjDJsrYxXrWAY56HO7d1THJ0f\noLzDgVPZMc9Eh+uwiV3/B3U6d9IPMPOEEHaG0KUpx0lffrFxjqreEg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-04-04T12:05:03Z",
+		"mac": "ENC[AES256_GCM,data:drwuU+ixqj6BtG7sDbn+skge5PxaXUzwLObiDCUd59yXQ3yIKatDk5E0Z4F4jliV3O/5Gq96u/GxAfojCeyBnfuXQ9TaX0ooxUj7uzGRn84DaD5f60gAn/h4H/HwfDUIEzw0jdME8zJ/tIetOIpwXXk5IWdnSUd+/qQE+6vX2HU=,iv:4lEJiE7JrRI5wnhw4DcNwbeek9bdrCyJykv0JZhNJDI=,tag:WSX+5vHaZVrdZCrfs5/VjA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.12.1"
+	}
+}