Initial sops setup

nixos/poseidon/configuration.nix

@@ -5,10 +5,9 @@
 { config, pkgs, ... }:
 
 {
-  imports =
+  imports = [ # Include the results of the hardware scan.
-    [ # Include the results of the hardware scan.
+    ./hardware-configuration.nix
-      ./hardware-configuration.nix
+  ];
-    ];
 
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot.enable = true;
@@ -52,7 +51,6 @@
 
   # Configure console keymap
   console.keyMap = "no";
-  
 
   # Configure keymap in X11
   # services.xserver.xkb.layout = "us";
@@ -81,22 +79,14 @@
       "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBDpeouwzFZoYA7AYARaJ/qdQHORJB2h1V73PXQYEAI7sDrc3kYwgZPbrZ3pGkGKaHBl45kiV6SYsC7191OCwIl8AAAAEc3NoOg== A"
       "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBHlAtX4mBifZZ8u6sJckCgA6skwN7aamVK+lQuXLQ6kQWJy7GlEXEmoR9RW/0UIrQYLC+wd8Q5MROkYpn+cHLSoAAAAEc3NoOg== B"
     ];
-    packages = with pkgs; [
+    packages = with pkgs; [ ];
-    ];
   };
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [ btop vim tailscale python3 htop ];
-    btop
-    vim
-    tailscale
-    python3
-    htop
-  ];
   nixpkgs.config.allowUnfree = true;
 
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   # programs.firefox.enable = true;
-  services.tailscale.enable = true;
   # Enable the OpenSSH daemon.
   # List packages installed in system profile. To search, run:
   # $ nix search wget
@@ -115,15 +105,6 @@
 
   # List services that you want to enable:
 
-  # Enable the OpenSSH daemon.
-  services.openssh = {
-    enable = true;
-    settings = {
-      PermitRootLogin = "no";
-      PasswordAuthentication = true;
-    };
-  };
-
   nix.settings.trusted-users = [ "poseidon" ];
   # Open ports in the firewall.
   # networking.firewall.allowedTCPPorts = [ ... ];

nixos/poseidon/flake.lock

@@ -21,6 +21,24 @@
         "type": "github"
       }
     },
+    "homelabSecrets": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747945363,
+        "narHash": "sha256-gKUhfQzbwtXTEQoPIAkOhlbyu/WQBPk+Tl2va7iwjKQ=",
+        "ref": "master",
+        "rev": "cc48a631fb9470e3a6a07ca8660b7caf56b0ae06",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://forgejo@code.polsevev.dev/polsevev/nix-secrets-homelab.git"
+      },
+      "original": {
+        "ref": "master",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://forgejo@code.polsevev.dev/polsevev/nix-secrets-homelab.git"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1747676747,
@@ -40,7 +58,29 @@
     "root": {
       "inputs": {
         "disko": "disko",
-        "nixpkgs": "nixpkgs"
+        "homelabSecrets": "homelabSecrets",
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747603214,
+        "narHash": "sha256-lAblXm0VwifYCJ/ILPXJwlz0qNY07DDYdLD+9H+Wc8o=",
+        "owner": "mic92",
+        "repo": "sops-nix",
+        "rev": "8d215e1c981be3aa37e47aeabd4e61bb069548fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     }
   },

nixos/poseidon/flake.nix

@@ -4,16 +4,28 @@
   inputs = {
     # NixOS official package source, using the nixos-24.11 branch here
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-    disko = { 
+    disko = {
       url = "github:nix-community/disko/latest";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    sops-nix = {
+      url = "github:mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+
+    };
+    # Personal Repositories
+    homelabSecrets = {
+      url =
+        "git+ssh://forgejo@code.polsevev.dev/polsevev/nix-secrets-homelab.git?ref=master&shallow=1";
+      flake = false;
+    };
   };
 
   outputs = { self, nixpkgs, disko, ... }@inputs: {
     # Please replace my-nixos with your hostname
     nixosConfigurations.poseidon = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
+      specialArgs = { inherit inputs; };
       modules = [
         # Import the previous configuration.nix we used,
         # so the old configuration file still takes effect
@@ -21,7 +33,11 @@
         ./configuration.nix
         ./disko-config.nix
         ./hardware-configuration.nix
+        ../shared/tailscale.nix
+        ../shared/ssh.nix
+        ../shared/sops.nix
       ];
+
     };
   };
-}
+}

nixos/shared/sops.nix

@@ -1,13 +1,16 @@
-{ config, pkgs, homelabSecrets, ... }:
+{ config, inputs, ... }:
-let secretsPath = inputs.homelabSecrets;
+let secretsPath = builtins.toString inputs.homelabSecrets;
 in {
-  imports = [
+  imports = [ inputs.sops-nix.nixosModules.sops ];
-    inputs.sops-nix.nixosModules.sops
-  ];
 
   sops = {
     defaultSopsFile = "${secretsPath}/secrets.yaml";
-    validateSopsFile = false;
+    age = {
+      sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+  };
+  sops.secrets = { "tailscale/preauthkeys/poseidon" = { }; };
 
-  }
 }

nixos/shared/ssh.nix

@@ -4,7 +4,7 @@
     enable = true;
     settings = {
       PermitRootLogin = "no";
-      PasswordAuthentication = true;
+      PasswordAuthentication = false;
     };
   };
 }

nixos/shared/tailscale.nix

@@ -5,9 +5,10 @@
   services.tailscale = {
     enable = true;
     openFirewall = true;
-    authKeyFile = config.sops.secrets."tailscale.preauthkeys.poseidon".path;
+    authKeyFile = config.sops.secrets."tailscale/preauthkeys/poseidon".path;
     extraUpFlags =
       [ "--login-server=https://headscale.polsevev.dev" "--accept-dns=false" ];
   };
 
 }
+