Gave local passwordless sudo, rerolled and encrypted the authorized key.

Reviewed-on: Jan/dotfiles#2

README.md

@@ -4,8 +4,39 @@ My NixOS configuration.
 
 ## Installation
 
-For disk configuration we use disko, this means that installing the system from the configuration is just a single command:
+For disk configuration we use disko, but for secrets management we use sops-nix and the particular setup makes the installation process a bit more involved. It is required that the computer from which the installation is being run has access to the `nixos-secrets` repository, otherwise you will need to manually add the required ssh keys to the installation image. 
+```bash
+# Load into the installer
+sudo passwd # Set a root password
 
+# From a machine with network access to the installer
+# and access to the nixos-secrets repo
+ssh -A root@(installer-ip)
+
+# Set up disks
+nix-shell -p disko
+disko --mode disko --flake git+https://git.bulthuis.dev/Jan/nixos-config#(system)
+exit
+
+# Install NixOS
+nixos-install --no-channel-copy --no-root-password --flake git+https://git.bulthuis.dev/Jan/nixos-config#(system)
+cd /mnt/persist/system/etc/sops
+
+# Set up host credentials for access to the secrets
+touch sops_ed25519_key 
+chmod 600 sops_ed25519_key
+nano sops_ed25519_key
 ```
-sudo nix --experimental-features "nix-command flakes" run "github:nix-community/disko/latest#disko-install" -- --flake git+https://git.bulthuis.dev/Jan/dotfiles#<hostname> --disk main /dev/sda
+If `nixos-install` is being stopped by the OOM-killer, you can try adding `-j 1` to limit the amount of jobs that will be executed at the same time to 1. It might require running nixos-install multiple times untill it has managed to download all requirements and slowly start building the rest of the system.
+
+## Updating
+
+To update the system configuration, it is a single command:
+```bash
+sudo system-update
 ```
+Or if this shell script has not been installed for some reason:
+```bash
+sudo nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config
+```
+Sometimes it may be necessary to reboot of course.

flake.lock

@@ -154,7 +154,44 @@
         "impermanence": "impermanence",
         "nix-minecraft": "nix-minecraft",
         "nix-modpack": "nix-modpack",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "secrets": "secrets",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "secrets": {
+      "locked": {
+        "lastModified": 1748613807,
+        "narHash": "sha256-awE+2QvMkGP4OOPGniFMldvYnLYj60n4izgEJXcJUv0=",
+        "ref": "refs/heads/main",
+        "rev": "d120fcc272429517649402cf2ccefb9334f50535",
+        "revCount": 7,
+        "type": "git",
+        "url": "ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747603214,
+        "narHash": "sha256-lAblXm0VwifYCJ/ILPXJwlz0qNY07DDYdLD+9H+Wc8o=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "8d215e1c981be3aa37e47aeabd4e61bb069548fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -6,6 +6,13 @@
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     home-manager.url = "github:nix-community/home-manager";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
+
+    # Secrets
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+    secrets.url = "git+ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets";
+
+    # Disk setup
     disko.url = "github:nix-community/disko";
     disko.inputs.nixpkgs.follows = "nixpkgs";
     impermanence.url = "github:nix-community/impermanence";

modules/home/utilities/bitwarden.nix

@@ -0,0 +1,22 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.bitwarden;
+in
+{
+  options.modules.bitwarden = {
+    enable = mkEnableOption "Bitwarden";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      bitwarden-desktop
+    ];
+  };
+}

modules/home/utilities/secrets.nix

@@ -0,0 +1,39 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.secrets;
+  secrets = inputs.secrets;
+in
+{
+  options.modules.secrets = {
+    enable = mkEnableOption "secrets";
+    defaultFile = mkOption {
+      type = types.str;
+      default = "${secrets}/secrets/common.enc.yaml";
+      description = ''
+        The default file to use for SOPS.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrs;
+      default = { };
+      description = ''
+        All secrets that should be made available.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set up SOPS
+    sops.defaultSopsFile = cfg.defaultFile;
+    sops.age.sshKeyPaths = [ "${config.home.homeDirectory}/.config/sops/sops_ed25519_key" ];
+    sops.secrets = cfg.secrets;
+    modules.impermanence.directories = [ ".config/sops" ];
+  };
+}

modules/nixos/secrets.nix

@@ -0,0 +1,43 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.secrets;
+  secrets = inputs.secrets;
+in
+{
+  options.modules.secrets = {
+    enable = mkEnableOption "secrets";
+    defaultFile = mkOption {
+      type = types.str;
+      default = "${secrets}/secrets/common.enc.yaml";
+      description = ''
+        The default file to use for SOPS.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrs;
+      default = { };
+      description = ''
+        All secrets that should be made available.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set up SOPS
+    # TODO: Fix the key not being present in /etc/sops before sops-nix runs
+    sops.defaultSopsFile = cfg.defaultFile;
+    sops.age.sshKeyPaths = [
+      "/etc/sops/sops_ed25519_key"
+      "/persist/system/etc/sops/sops_ed25519_key"
+    ];
+    sops.secrets = cfg.secrets;
+    modules.impermanence.directories = [ "/etc/sops" ];
+  };
+}

modules/nixos/ssh.nix

@@ -11,5 +11,17 @@ in
   config = mkIf cfg.enable {
     services.openssh.enable = true;
     # TODO: Is this default configuration secure?
+
+    services.openssh.hostKeys = mkIf (config.modules.impermanence.enable) [
+      {
+        type = "ed25519";
+        path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
+      }
+      {
+        type = "rsa";
+        bits = 4096;
+        path = "/persist/system/etc/ssh/ssh_host_rsa_key";
+      }
+    ];
   };
 }

profiles/disko/vm.nix

@@ -3,6 +3,7 @@
     disk = {
       main = {
         type = "disk";
+        device = "/dev/sda";
         content = {
           type = "gpt";
           partitions = {

profiles/home/jan.nix

@@ -24,7 +24,6 @@ in
       freecad-wayland
       inkscape
       ente-auth
-      bitwarden
       carla
       winbox
       whatsapp-for-linux
@@ -61,6 +60,7 @@ in
           "flake.lock"
         ];
       };
+      bitwarden.enable = true;
       xpra = {
         enable = true;
         hosts = [

profiles/nixos/base.nix

@@ -1,5 +1,4 @@
 {
-  mkModule,
   pkgs,
   lib,
   config,
@@ -20,13 +19,18 @@ in
       bootloader.enable = mkDefault true;
       ssh.enable = mkDefault true;
 
-      # Setup sensible default persistent data
       impermanence.directories = [
         "/var/lib/nixos"
       ];
-      impermanence.files = [
+
-        "/etc/shadow"
+      secrets = {
-      ];
+        enable = true;
+        secrets = {
+          "ssh-keys/deploy-priv" = {
+            path = "/root/.ssh/id_ed25519";
+          };
+        };
+      };
     };
 
     # Localization

profiles/nixos/vm.nix

@@ -1,5 +1,4 @@
 {
-  mkModule,
   pkgs,
   lib,
   config,
@@ -33,15 +32,28 @@ in
       ssh.enable = true;
     };
 
-    # Admin users
+    # Local user
+    services.getty.autologinUser = "local";
+    security.sudo.extraRules = [
+      {
+        users = [ "local" ];
+        options = [ "NOPASSWD" ];
+      }
+    ];
+    users.mutableUsers = false;
     users.users.local = {
-      initialPassword = "local";
       extraGroups = [ "wheel" ];
-      openssh.authorizedKeys.keys = [
+      openssh.authorizedKeys.keyFiles = [
-        "ssh-ed25519  jan@bulthuis.dev"
+        config.sops.secrets."ssh-keys/admin-pub".path
       ];
     };
 
+    # System packages
+    environment.systemPackages = with pkgs; [
+      # TODO: Make module for utilities/scripts
+      (writeShellScriptBin "system-update" "nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config")
+    ];
+
     # Enable qemu guest agent
     services.qemuGuest.enable = true;