forked from lukas/nixos-config
68d8526542
Move service credentials and Wi-Fi keys behind agenix, rotate exposed LLDAP and Vikunja credentials, disable SSH password authentication, and remove obsolete CLAUDE.md guidance.
30 lines
948 B
Nix
30 lines
948 B
Nix
{config, lib, ...}:
|
|
{
|
|
# These secrets are declared globally but their services run on other hosts.
|
|
# Keep their pinix copies root-owned so missing service users do not make
|
|
# activation fail.
|
|
age.secrets.mailPW.owner = lib.mkForce "root";
|
|
age.secrets.oidcHeadscale.owner = lib.mkForce "root";
|
|
age.secrets.traefik.owner = lib.mkForce "root";
|
|
age.secrets.lldapAdmin.group = "radicale";
|
|
age.secrets.lldapAdmin.mode = lib.mkForce "440";
|
|
|
|
# Vikunja receives this root-owned file through systemd credentials.
|
|
age.secrets.oidcVikunja.file = ../../../secrets/oidcVikunja.age;
|
|
|
|
age.secrets.motd = {
|
|
file = ../../../secrets/motd.age;
|
|
name = "motd.cfg.lua";
|
|
owner = "prosody";
|
|
};
|
|
|
|
age.secrets.headscalePreAuthKey = {
|
|
file = ../../../secrets/headscalePreAuthKey.age;
|
|
owner = "drone";
|
|
};
|
|
|
|
age.secrets.wirelessSecretsFile = {
|
|
file = ../../../secrets/wirelessSecretsFile.age;
|
|
owner = "drone";
|
|
};
|
|
}
|