swarsel/.dotfiles
1
0
Fork 0
mirror of https://github.com/Swarsel/.dotfiles.git synced 2025-12-06 00:57:22 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: improve yubikey related setting

Browse source
This commit is contained in:
Swarsel 2024-12-19 00:29:49 +01:00
parent 6fbc165cab
commit ffb331ff3e
Signed by: swarsel
GPG key ID: 26A54C31F2A4FD84
4 changed files with 45 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

22
SwarselSystems.org
View file

@ -8027,6 +8027,7 @@ I use sops-nix to handle secrets that I want to have available on my machines at
leon = { path = "/run/user/1000/secrets/leon"; };
swarselmail = { path = "/run/user/1000/secrets/swarselmail"; };
github_notif = { path = "/run/user/1000/secrets/github_notif"; };
u2f_keys = { path = "${config.home.homeDirectory}/.config/Yubico/u2f_keys"; };
};
};
}
@ -10295,7 +10296,7 @@ Currently, I am too lazy to explain every option here, but most of it is very se
Settinfs that are needed for the gpg-agent. Also we are enabling emacs support for unlocking my Yubikey here.
#+begin_src nix :tangle profiles/common/home/gpg-agent.nix
{ pkgs, ... }:
{ self, pkgs, ... }:
{
services.gpg-agent = {
enable = true;
@ -10308,7 +10309,26 @@ Settinfs that are needed for the gpg-agent. Also we are enabling emacs support f
allow-loopback-pinentry
allow-emacs-pinentry
'';
sshKeys = [
"4BE7925262289B476DBBC17B76FD3810215AE097"
];
};
programs.gpg = {
enable = true;
publicKeys = [
{
source = "${self}/secrets/keys/gpg/gpg-public-key-0x76FD3810215AE097.asc";
trust = 5;
}
];
};
# assure correct permissions
systemd.user.tmpfiles.rules = [
"d /home/swarsel/.gnupg 700 swarsel users"
];
}
#+end_src

21
profiles/common/home/gpg-agent.nix
View file

@ -1,4 +1,4 @@
{ pkgs, ... }:
{ self, pkgs, ... }:
{
services.gpg-agent = {
enable = true;
@ -11,5 +11,24 @@
allow-loopback-pinentry
allow-emacs-pinentry
'';
sshKeys = [
"4BE7925262289B476DBBC17B76FD3810215AE097"
];
};
programs.gpg = {
enable = true;
publicKeys = [
{
source = "${self}/secrets/keys/gpg/gpg-public-key-0x76FD3810215AE097.asc";
trust = 5;
}
];
};
# assure correct permissions
systemd.user.tmpfiles.rules = [
"d /home/swarsel/.gnupg 700 swarsel users"
];
}

1
profiles/common/home/sops.nix
View file

@ -17,6 +17,7 @@ in
leon = { path = "/run/user/1000/secrets/leon"; };
swarselmail = { path = "/run/user/1000/secrets/swarselmail"; };
github_notif = { path = "/run/user/1000/secrets/github_notif"; };
u2f_keys = { path = "${config.home.homeDirectory}/.config/Yubico/u2f_keys"; };
};
};
}

5
secrets/general/secrets.yaml
View file

@ -24,6 +24,7 @@ githubforgeuser: ENC[AES256_GCM,data:O3shEkYkq+u/rCy4XQ==,iv:Oq109o5dhbl7bqgbeTx
githubforgepass: ENC[AES256_GCM,data:CS1ZmDjQQIjGrmaDTzkut/tethQueEyKomc=,iv:k8MK4ItU1jUqXbEx2Ods0YvycWVF8wgLgllTx0PuWj8=,tag:zYdPReSfFF4ar5neys976w==,type:str]
gitlabforgeuser: ENC[AES256_GCM,data:SrQw69bvtYUcVSePCg==,iv:PlaTHDWJRMtf0HQCG/fVUfw+/91x3ubJKSrcEf+R/Ck=,tag:8E+ZlJE+O+mmcPjhEc/2DA==,type:str]
gitlabforgepass: ENC[AES256_GCM,data:WvUFqQtBqqlWvUWhF7x46RcjqA3RPnKSgbd3ZIr1kHO+Vmh5zUh+LA==,iv:+n2VPdLdxFFVHlzRdMCi1lyqGLH+U3RRZX/qfs42I0s=,tag:1iBorR1N1HDRtrqcAcSmvA==,type:str]
u2f_keys: ENC[AES256_GCM,data:jk1IDfO778V3MCQ8fGoO87lCmqj2Dw+vNRfT4JuWXZ6cB/ARYblnGIpEfogciXJbmYWc4MiKHcO2PkXFdCynpniU3pf3stvNYjTV/TdUpNXkAyho1OjBXwisOMFMcqF3I8yI/XpaMr+5aL6tyMLZ4wIsa0tP4FH74BxCt426uhH8YKLCXREaLRy2PFEQS2MVwKL8i41LDhrkVaJIEMZJ34rvHQqsjckjvwEtCHzBh8XVqdJXAKPq1EgR+9gTVhixwvceDsoSAC0/q2RkSfKhqhOFnj6e09GM7i+o1e98INyABHmd3OHxzTydYk6nrcJHFWIBZlushSgVI0qn+JL+e+2CF8NFtshHH7CGI7ws23n1DZz/BkjQtcfjZEnJv5uAZ9oOt4R0hOSpXn0rGQRNgo5JSMGR37ywyJlaDHmRolS6lRk/7pEdO3jCEMSwjjitWK1/iNDSgEExclQZ/cSL2svPZmwiTKrf0wm/+gbGrd+BxzJmHCopFyNG47kweyR7iMcknF/4+iJj9t2Mi+xOxYdqmQB+I6140DOqcMz9sA0tzqV+Ou6Jf4H4w9sqvI10pnw2sK7OuvFZQ442H+iLelRiZLA/ZCzDCieddLJBtqSsmgEJtJpRsiJXUzDn4CzaAFWrNvNaU/MKAAZwsPeJywmwKgjOUSdHz3YKVDhP/TDqvlzvjKYDte7+6baAYKjVNPJpMy4aQ4/m2FnUEcgRdwct3G8JCe1CORIZSFbO9fkgEgJK6WN3XyQn1nAcDGZdmS95O5Ajmj6a1f5nZQ==,iv:B/Nf1lS0gKW43Nq8QuwJD6GCzzvx35LBw1q1OmZMfF8=,tag:gVNKbyq514J1eoM03JoQYg==,type:str]
sops:
kms: []
gcp_kms: []
@ -66,8 +67,8 @@ sops:
RW9nYmdzV3o5YjZRdVVPN0dkMGN6aXMKovEW5hIMX0qQFBszxQQjdO0DtHZ+swJA
Le4TQXWDW2I0sNK6FySEUf/KS52KuimhV96qKB10D5QZxKJrFYp91g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-12-16T16:58:01Z"
mac: ENC[AES256_GCM,data:lCviR1wZSczhqqjGztecB5XAYjHSh7rEtk0ffKkcAHkiCm8Lefc288MiM8pvxPqLUANHdfick9uMQqdUEgl25fuk7T62IoFOfXSS9gN9xpiOjw0C72gZmomhZ/IOYFtcw77jrS5C2FmXRBjCS/fvaOO41liLg/KYJQdnyT6D0OA=,iv:AOuzPidkMEDBgym8hOimLabQJ6JpxAyggfa6w2I1rWE=,tag:paR5w7yT7vpORfkiMcHgag==,type:str]
lastmodified: "2024-12-18T22:08:25Z"
mac: ENC[AES256_GCM,data:vU+7/VLEzwDOrScD/HTo9JBf4ixtmcBmjtSUEtaVHwZuPMJ0OpydwcBPYKvhvU6z9xNecCcuiY7beJ5sq7fnv8XY66TOZWq/2tTZPXdJwpfAyHqBhf7uoCiOmSl53tpWzUFbfT8fQQwjKmBO1079Op24WNWzG3w0i9BsoYTYrpY=,iv:9bLlRg28paoitcK1lFc4ipsgMVvr/zECNozwXU2qJTM=,tag:uRviXeIlwUnvJqHwWuoYcA==,type:str]
pgp:
- created_at: "2024-12-18T00:16:17Z"
enc: |-