e8bbd5ab4d
wpa_supplicant needs key=value external passwords, while pinix-wifi.age holds hostapd's raw passphrase. A oneshot unit merges both into a root-only runtime file under /run before wpa_supplicant starts. Also resolve ereader.domain2 via the pinix-dns node like git. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
44 lines
1.4 KiB
Nix
44 lines
1.4 KiB
Nix
{ lib, ... }:
|
|
{
|
|
# These globally declared secrets belong to services that run only on the
|
|
# server hosts. Root ownership keeps agenix activation independent of users
|
|
# that intentionally do not exist on tnix.
|
|
age.secrets.bindPW.owner = lib.mkForce "root";
|
|
age.secrets.oidcGTS.owner = lib.mkForce "root";
|
|
age.secrets.oidcGTSEnv.owner = lib.mkForce "root";
|
|
age.secrets.oidcHeadscale.owner = lib.mkForce "root";
|
|
age.secrets.traefik.owner = lib.mkForce "root";
|
|
age.secrets.webdav.owner = lib.mkForce "root";
|
|
age.secrets.lldapAdmin.mode = lib.mkForce "400";
|
|
|
|
age.secrets.wirelessSecretsFile = {
|
|
file = ../../../secrets/wirelessSecretsFile.age;
|
|
owner = "wpa_supplicant";
|
|
};
|
|
|
|
# The pinix access-point passphrase is a standalone hostapd secret. Keep
|
|
# it root-only here; tnix-wpa-secrets.service converts it into the
|
|
# wpa_supplicant external-password format only at runtime.
|
|
age.secrets.pinixWifi = {
|
|
file = ../../../secrets/pinix-wifi.age;
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0400";
|
|
};
|
|
|
|
age.secrets.headscalePreAuthKey = {
|
|
file = ../../../secrets/headscalePreAuthKey.age;
|
|
owner = "builder";
|
|
};
|
|
|
|
age.secrets.pinixHeadscalePreAuthKey = {
|
|
file = ../../../secrets/pinixHeadscalePreAuthKey.age;
|
|
owner = "root";
|
|
mode = "400";
|
|
};
|
|
|
|
age.secrets.mailPW = {
|
|
file = ../../../secrets/mailPW.age;
|
|
owner = "builder";
|
|
};
|
|
}
|