lars/Gebos

Files

T

check / flake-check (pull_request) Has been cancelled

Details

Add sops-nix secrets + dev defaults so local stack runs with zero setup

- sops-nix flake input, age + ssh-to-age in devShell, .sops.yaml with
  per-host recipients (real pubkeys still TODO until lars bootstraps).
- nix/modules/gebos-secrets.nix centralises per-host secret subsets and
  renders /run/secrets/gebos-env via sops.templates. Service modules now
  read EnvironmentFile= from services.gebos.secrets.envFile instead of
  the placeholder /etc/gebos/secrets.env.
- Falls back to a writeText env file when nix/secrets/secrets.yaml is
  absent, so `nix flake check` and first-boot eval work pre-bootstrap.
- nix/secrets/README.md walks through age key + sops bootstrap.
- Dev defaults: ingester binary falls back to local tcp/postgres URLs,
  process-compose adds mosquitto and wires GEBOS_MQTT_BROKER /
  GEBOS_POSTGRES_URL / GEBOS_POSTGRES_PASSWORD + VITE_SUPABASE_URL /
  VITE_SUPABASE_ANON_KEY, frontend defaults to 127.0.0.1:8000 in DEV.

Refs #23 (comment #110).

2026-05-30 00:17:13 +00:00

3.1 KiB

Raw Blame History

Secrets

Managed with sops-nix + age.

Layout

.sops.yaml (repo root) — recipients and per-file creation rules.
nix/secrets/secrets.yaml.example — plaintext template (committed).
nix/secrets/secrets.yaml — sops-encrypted real values (committed once created).

Plaintext values never enter the Nix store or disk outside tmpfs. sops-nix decrypts on activation into /run/secrets/<name> with declared owner/mode, then renders gebos-env from those placeholders for systemd EnvironmentFile=.

First-time bootstrap

# 1. Generate your personal age key (keep this private, NEVER commit).
mkdir -p ~/.config/sops/age
age-keygen -o ~/.config/sops/age/keys.txt
# → "Public key: age1abc..."  ← paste this into .sops.yaml as &dev_<you>

# 2. Get each host's age pubkey (one per host).
#    On each host as root:
ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub
# → "age1xyz..."  ← paste into .sops.yaml as &host_<name>

# 3. Edit .sops.yaml — replace every "age1TODO_..." with the real pubkeys above.

# 4. Create the real secrets file from the template, fill in real values, encrypt.
cp nix/secrets/secrets.yaml.example nix/secrets/secrets.yaml
$EDITOR nix/secrets/secrets.yaml
sops -e -i nix/secrets/secrets.yaml

# 5. Commit .sops.yaml + the encrypted secrets.yaml.
git add .sops.yaml nix/secrets/secrets.yaml
git commit -m "secrets: initial sops bootstrap"

Editing later

sops nix/secrets/secrets.yaml   # opens $EDITOR, re-encrypts on save

Rotation

Leaked value → sops nix/secrets/secrets.yaml, change value, redeploy.
New host → add its age pubkey to .sops.yaml, then sops updatekeys nix/secrets/secrets.yaml.
Compromised dev key → remove from .sops.yaml, sops updatekeys, redeploy.

Generating value material

Field	How
`supabase_postgres_password`	`openssl rand -hex 32`
`supabase_jwt_secret`	`openssl rand -hex 32` (must be ≥32 chars)
`supabase_anon_key`	JWT signed with `jwt_secret`, `role: anon`, long expiry
`supabase_service_role_key`	JWT signed with `jwt_secret`, `role: service_role`
`supabase_dashboard_password`	`openssl rand -hex 16` (Studio basic-auth, username `gebos`)
`ingester_postgres_password`	`openssl rand -hex 32`
`postgres_admin_password`	`openssl rand -hex 32`

Self-hosted Supabase docs have a one-liner for signing the two JWTs offline.

Local development

You do not need to bootstrap secrets for nix run .#dev. The dev process-compose stack and the ingester binary both default to local-only values (GEBOS_POSTGRES_URL, GEBOS_MQTT_BROKER, GEBOS_POSTGRES_PASSWORD, plus the JWT/anon-key pair the frontend needs). See nix/dev/process-compose.nix.

3.1 KiB Raw Blame History