Klaus
2dd5ed5877
check / flake-check (pull_request) Has been cancelled
- sops-nix flake input, age + ssh-to-age in devShell, .sops.yaml with per-host recipients (real pubkeys still TODO until lars bootstraps). - nix/modules/gebos-secrets.nix centralises per-host secret subsets and renders /run/secrets/gebos-env via sops.templates. Service modules now read EnvironmentFile= from services.gebos.secrets.envFile instead of the placeholder /etc/gebos/secrets.env. - Falls back to a writeText env file when nix/secrets/secrets.yaml is absent, so `nix flake check` and first-boot eval work pre-bootstrap. - nix/secrets/README.md walks through age key + sops bootstrap. - Dev defaults: ingester binary falls back to local tcp/postgres URLs, process-compose adds mosquitto and wires GEBOS_MQTT_BROKER / GEBOS_POSTGRES_URL / GEBOS_POSTGRES_PASSWORD + VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY, frontend defaults to 127.0.0.1:8000 in DEV. Refs #23 (comment #110).
72 lines
3.1 KiB
Markdown
72 lines
3.1 KiB
Markdown
# Secrets
|
|
|
|
Managed with [sops-nix](https://github.com/Mic92/sops-nix) + [age](https://github.com/FiloSottile/age).
|
|
|
|
## Layout
|
|
|
|
- `.sops.yaml` (repo root) — recipients and per-file creation rules.
|
|
- `nix/secrets/secrets.yaml.example` — plaintext template (committed).
|
|
- `nix/secrets/secrets.yaml` — sops-encrypted real values (committed once created).
|
|
|
|
Plaintext values never enter the Nix store or disk outside tmpfs. sops-nix
|
|
decrypts on activation into `/run/secrets/<name>` with declared owner/mode,
|
|
then renders `gebos-env` from those placeholders for systemd `EnvironmentFile=`.
|
|
|
|
## First-time bootstrap
|
|
|
|
```sh
|
|
# 1. Generate your personal age key (keep this private, NEVER commit).
|
|
mkdir -p ~/.config/sops/age
|
|
age-keygen -o ~/.config/sops/age/keys.txt
|
|
# → "Public key: age1abc..." ← paste this into .sops.yaml as &dev_<you>
|
|
|
|
# 2. Get each host's age pubkey (one per host).
|
|
# On each host as root:
|
|
ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub
|
|
# → "age1xyz..." ← paste into .sops.yaml as &host_<name>
|
|
|
|
# 3. Edit .sops.yaml — replace every "age1TODO_..." with the real pubkeys above.
|
|
|
|
# 4. Create the real secrets file from the template, fill in real values, encrypt.
|
|
cp nix/secrets/secrets.yaml.example nix/secrets/secrets.yaml
|
|
$EDITOR nix/secrets/secrets.yaml
|
|
sops -e -i nix/secrets/secrets.yaml
|
|
|
|
# 5. Commit .sops.yaml + the encrypted secrets.yaml.
|
|
git add .sops.yaml nix/secrets/secrets.yaml
|
|
git commit -m "secrets: initial sops bootstrap"
|
|
```
|
|
|
|
## Editing later
|
|
|
|
```sh
|
|
sops nix/secrets/secrets.yaml # opens $EDITOR, re-encrypts on save
|
|
```
|
|
|
|
## Rotation
|
|
|
|
- **Leaked value** → `sops nix/secrets/secrets.yaml`, change value, redeploy.
|
|
- **New host** → add its age pubkey to `.sops.yaml`, then `sops updatekeys nix/secrets/secrets.yaml`.
|
|
- **Compromised dev key** → remove from `.sops.yaml`, `sops updatekeys`, redeploy.
|
|
|
|
## Generating value material
|
|
|
|
| Field | How |
|
|
| ------------------------------ | ------------------------------------------------------------ |
|
|
| `supabase_postgres_password` | `openssl rand -hex 32` |
|
|
| `supabase_jwt_secret` | `openssl rand -hex 32` (must be ≥32 chars) |
|
|
| `supabase_anon_key` | JWT signed with `jwt_secret`, `role: anon`, long expiry |
|
|
| `supabase_service_role_key` | JWT signed with `jwt_secret`, `role: service_role` |
|
|
| `supabase_dashboard_password` | `openssl rand -hex 16` (Studio basic-auth, username `gebos`) |
|
|
| `ingester_postgres_password` | `openssl rand -hex 32` |
|
|
| `postgres_admin_password` | `openssl rand -hex 32` |
|
|
|
|
Self-hosted Supabase docs have a one-liner for signing the two JWTs offline.
|
|
|
|
## Local development
|
|
|
|
You do **not** need to bootstrap secrets for `nix run .#dev`. The dev process-compose
|
|
stack and the ingester binary both default to local-only values
|
|
(`GEBOS_POSTGRES_URL`, `GEBOS_MQTT_BROKER`, `GEBOS_POSTGRES_PASSWORD`, plus the
|
|
JWT/anon-key pair the frontend needs). See `nix/dev/process-compose.nix`.
|