hd/cfg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

syncthing setup

Browse source
This commit is contained in:
Henri Dohmen 2025-12-30 13:54:59 +01:00
parent 24df8a251b
commit 52c074f973
Signed by: hd
GPG key ID: AB79213B044674AE
19 changed files with 244 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

21
secrets.nix
View file

@ -1,12 +1,29 @@
let
pkgs = import <nixpkgs> { };
inherit (pkgs) lib;
keys = (import ./var { inherit lib; }).ssh-keys.root;
ssh-keys = (import ./var { inherit lib; }).ssh-keys;
keys = ssh-keys.root;
trusted-keys = ssh-keys.trusted-root;
secrets = [
"roam/rclone-conf"
"roam/firefox-sync-secret"
"hd-password"
"tlskey"
];
trusted-secrets = [
# Can only be decrypted by clients
"syncthing-password"
];
mkSecrets =
keys: secrets: lib.mergeAttrsList (map (x: { "secrets/${x}.age".publicKeys = keys; }) secrets);
syncthingManagedClients = (lib.importJSON ./var/syncthing-managed-clients.json).managed_clients;
mkSyncthingSecret = client: {
"secrets/syncthing/${client}.age".publicKeys = [ ssh-keys.by-host.root.${client} ];
};
syncthingSercrets = lib.mergeAttrsList (map mkSyncthingSecret syncthingManagedClients);
in
builtins.foldl' (acc: x: acc // { "secrets/${x}.age".publicKeys = keys; }) { } secrets
lib.mergeAttrsList ([
(mkSecrets keys secrets)
(mkSecrets trusted-keys trusted-secrets)
(syncthingSercrets)
])