mirror of
https://codeberg.org/polyteknisk-radiogruppe/the_prg_server_configuration.git
synced 2026-10-21 03:15:46 +02:00
34 lines
1.1 KiB
Nix
34 lines
1.1 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}: {
|
|
# This will add secrets.yml to the Nix store
|
|
# You can avoid this by adding a string to the full path instead, i.e.
|
|
# sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
|
|
sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml;
|
|
# This will automatically import SSH keys as age keys
|
|
#sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
|
|
# This is using an age key that is expected to already be in the filesystem
|
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
# This will generate a new key if the key specified above does not exist
|
|
sops.age.generateKey = true;
|
|
|
|
# Export individual WireGuard keys from the SOPS YAML as text secrets so they
|
|
# are available both as strings and as files (.path)
|
|
sops.secrets."runner_token" = {
|
|
format = "yaml";
|
|
sopsFile = ../../secrets/build_machine/secrets.yaml;
|
|
owner = "root";
|
|
mode = "0400";
|
|
};
|
|
|
|
sops.secrets."github_runner_token" = {
|
|
format = "yaml";
|
|
sopsFile = ../../secrets/build_machine/secrets.yaml;
|
|
owner = "root";
|
|
mode = "0400";
|
|
restartUnits = ["github-runner-build-machine.service"];
|
|
};
|
|
}
|