hosts/dn42-il-gw1: Migrate secrets to sops

configuration/common/programs.nix

@@ -10,7 +10,6 @@
     # Normal usage
     htop
     tmux
-    vim
 
     # Deployment
     bij
@@ -24,6 +23,8 @@
     curl
   ];
 
+  programs.vim.defaultEditor = true;
+
   programs.mtr.enable = true;
 
   programs.git.enable = true;

hosts/dn42-il-gw1/configuration.nix

@@ -47,7 +47,7 @@
           publicKey = "ObF+xGC6DdddJer0IUw6nzC0RqzeKWwEiQU0ieowzhg=";
         }
       ];
-      privateKeyFile = config.age.secrets.wg0197.path;
+      privateKeyFile = config.sops.secrets.wg0197.path;
     };
     # e1mo
     wg0565 = {
@@ -68,7 +68,7 @@
           publicKey = "qYaDuYYVpuFqy7KyC5PmJavqs0a7GtyuES8VwugdPSQ=";
         }
       ];
-      privateKeyFile = config.age.secrets.wg0565.path;
+      privateKeyFile = config.sops.secrets.wg0565.path;
     };
     # fooker
     wg1271 = {
@@ -89,7 +89,7 @@
           publicKey = "xxPjHWVzePinOOMnuhwGAI3PKY9pvpifIvIbPu3IwQw=";
         }
       ];
-      privateKeyFile = config.age.secrets.wg1271.path;
+      privateKeyFile = config.sops.secrets.wg1271.path;
     };
     wg1272 = {
       ips = [
@@ -109,7 +109,7 @@
           publicKey = "Iae2R4B7VVsloKWK8T1j1vLMuxpP4dVDUdzEg/YpAjE=";
         }
       ];
-      privateKeyFile = config.age.secrets.wg1272.path;
+      privateKeyFile = config.sops.secrets.wg1272.path;
     };
     # margau
     wg1280 = {
@@ -126,7 +126,7 @@
           publicKey = "CEge9jdHQArzdniUiWyB3IUZOjGiew3gPmz/MOf4ahU=";
         }
       ];
-      privateKeyFile = config.age.secrets.wg1280.path;
+      privateKeyFile = config.sops.secrets.wg1280.path;
     };
     # perflyst
     wg1302 = {
@@ -147,7 +147,7 @@
           publicKey = "TSPvvpMY8dCFk6gd58aYtkibtqUn8EzIF6dXP52b3y8=";
         }
       ];
-      privateKeyFile = config.age.secrets.wg1302.path;
+      privateKeyFile = config.sops.secrets.wg1302.path;
     };
     # lutoma
     wg4719 = {
@@ -167,7 +167,7 @@
           publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ=";
         }
       ];
-      privateKeyFile = config.age.secrets.wg4719.path;
+      privateKeyFile = config.sops.secrets.wg4719.path;
     };
   };
 

hosts/dn42-il-gw1/secrets.json

@@ -0,0 +1,33 @@
+{
+	"wg0197": "ENC[AES256_GCM,data:1QJ5GXLMLIOj6xNC4sMnShjyB1wqfTkhkPTlLJz6AJxMjA0BsBZvZ1Pdln4=,iv:nVRIQB8/Ged616ELhkGnDyAz6A+3HQ55+yG0vf0f7aQ=,tag:GtI8ICMCih1tN4Xoc+8RdQ==,type:str]",
+	"wg0565": "ENC[AES256_GCM,data:kLgKOGDA+kPDB0SZ/yU7Ax7NYn28LiVT2W6zSsc0APfyoZWW6nF0fUQFv4s=,iv:6zjLGAOROifubQUMxRLvoFzN6GRYob841rzNiVyrt84=,tag:Gh15/ROPYiqqobcJcTzmGQ==,type:str]",
+	"wg1271": "ENC[AES256_GCM,data:NPcFMxVNpwoPkLsb6NvZVxGxw+Og3RzlYx7TAL9nT95x6I8aDRpOnR5tY5w=,iv:gYuem6vX+jRQvirrt3lZQb5gKnN/z32W/MgmGuzQ/Ks=,tag:I9qZJSNKFEM3Vx4Yugxy1w==,type:str]",
+	"wg1272": "ENC[AES256_GCM,data:LU6jtNkNn2Xs+0OH8cD1HJnbHsNNnqlY83lDFa11/dHwVgdFxMtDXMqIMEc=,iv:/A8rWGR6jExa4ms7jTYC0eZVGCvlKw1I58Co41gw3TU=,tag:tIBRkQzFFpEEzflnDrpcOA==,type:str]",
+	"wg1280": "ENC[AES256_GCM,data:F4KLY6jiZNl52ko32nM0iTER0DyHvaCSmxeYAKB0MLUD8l9u1Ugk6kYZnUc=,iv:XcaxnvxM1kE/ahNFX+BH7Jmr9q2Py1vHHqOjFUqs5O8=,tag:a1up4gGFqyHz2lmDRJl3bA==,type:str]",
+	"wg1302": "ENC[AES256_GCM,data:+MzuBPg3ql0/MEnpVvhQTsPIkKB9xnHN9Fk4VlZwK4ijKl+26d6oTSM7/R0=,iv:bPPmhenQLaKTGaDo4rBlKkrXrS1YysRuntbKq6zi2aQ=,tag:lztaTfDGT4kAq+HZMLl0Dw==,type:str]",
+	"wg4719": "ENC[AES256_GCM,data:hoOOCUGdYFaAQZ6wkgmQl65M1qArvXa826IeJl+BUGf7UX0vxx9J0C2epTE=,iv:+1JcOgzClehkE0Ihd2mmoenPk51OBZMF0bMqapWah/c=,tag:xI5FU+GJU6BER9/n04ccLA==,type:str]",
+	"wg-monitoring": "ENC[AES256_GCM,data:aw11Ygfll6llabXkuxtbTcCn1eb4NZX1IwArcXoRJCJSgwDrQZ3HLatov3w=,iv:J2VD5XS+BrIKeFb0NW1UYZUuGPkbjFmooZ93PVK31gw=,tag:2XLSa/2s6LRq3L7UdrTs/g==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1f0hscql4f4w7vyukzeu693xfedsl596dpjekc23q77ylp92zsvcqf9u75t",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3QWdFYjFjTmRVRlV3U3p4\nTSsyc1E0dWtiYjNtVkV2SXJEWkxnTDhLN1Y0Cng4aGlidjhydUVGaFcvK215aGdq\nN0FGajYwa1lPUCsva0tmNkErUGtlOWsKLS0tIG9pLzJEUDA2WWUzd1kzSVZrdVRX\nbUxjQzBCd3p0R1dWTTJaRmZNQjJEUVkKPz6OUQHpYrhRxMdQzpZRR3exVqkG2JvX\nI32PwvbeQK8cgpYwKLGar8U8aiPPm0Y64pID1wedDsNZzLqLOrS3wQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-04-28T09:28:04Z",
+		"mac": "ENC[AES256_GCM,data:PHdhyie0Ya/nN9Kqj4z+zPyyKZFvGkznkv8Uf3LNSdPKWVtXARZc8Xodm4MjI2HvooryyyMFHkW75Aln02Rlvk3R8oI7rfFZC7s2P+LotumsYgRFf0JOUMxsxOtKW0ehuLy83Bw0rMJQo1gzTgBykcvdc2pkMmALF/vU/1VqgJ4=,iv:0JwcY0Q+8VAiVHYjynhcpsobQXOkK8EBe3QUJ8YUwFE=,tag:9xAcoxAPGxTvHVBydf3u9Q==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2024-04-28T09:25:37Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA5OzEzXewpmPARAAlFtkAfaMk8tnLsnJwAJXqrwUMxojYbMcxTDokKUqaQFE\ndlirkl0o0Kgk78BINxV0hjBpu54DvpBMl/Iv8TVpnZqCgNli4WOrOVg3OwVWqbmw\nZ4Hu3ToeogVlFx5U9tB/u/Z3tvsf3TpznansXmP1GaTt0P2Ur3Xn4Gvsgc5ikSXs\nZSwPpmDJiJwa49empWjUtYnMVo48l6midUny4JR1CC6Gr8QobBtImMXFNTQc4q37\nmDV5mkDCsdyDhEFMX8VXDHPMdLKl8zg1B46AqMQE88Rr8mROuZVuC6sjC4NY8YLn\nqwuUGr8AnNvU/e0/HTdnYwrqDZxBaqg9RylEJjU00aVj5Sea4/AiK+e4QpLukhFN\naul3XWB+aQ3VcspsDv/n/TK9d0Db0fniTdQEGDfaXRJi2bDRZUkneELQ+Z4BCgHw\nu9XlJJt+Ts6Gx22c24BpaR5H4IpY2wqkhLHm/kdzu082pKPfHQojtJopX1N5sHjJ\nrwF+y1xuWnucOyzbKCIHYv5BIxlTeftLyzwzZWWUjaidj2xWmHWnPo+27/+jb1IQ\ntXs3rD8dI4Sc5gxgHtC/jRGyFKOoiva+xzKF4qLZI2MYnhXa+ITF9LabdXj083T/\nVR1gdsgQjgPSgrIl/8oqw4oF95y0gQctTmvuV4XLI9ZbZDoEHsRxq43OxkpnVR2F\nAgwDvZ9WSAhwutIBD/0f45DOEuN2gGUfFgxlpUeJ/ToRqFbgRJxGGS8PY23YStsE\n4H9ZVcV5NmBiu9bZOzDYy25Lp1Sox1ciAkId7gZL+3QIRbvL554MT6DTC2E+zdqk\n+QstJ67jmzauDwPZBtjjxv8VbndoUtVsUKQzVFNoyDbtoKfiUUsowDdJerqF9eO9\npvylIkU7X4UOApOgFM9y7iXB0RDsuiszSKUP81Sexn97NvhLig9FMGAUpCsWjNZ1\nOAJzTOOuw99vLRZQIZj8F10B2dHxi3iAMsfJPltLfNt3JzSTvT219ObcqRfMZdtQ\nGy9wAkoC+pfRVCwb7sYbe+evTtTwPP4OHarUJxCPbCiwieD+GW9szyeLIGjn3NE2\nZDxFOnkzrVV4VKL9J6KXLI5g3wpPaTg9enJ+7izNRmU497SL2oBOfoz6hjb15E0N\n9Ebq0Kpb7dinCB/UU2RHvHn2gixCaYWwPBDIJqv3AL1hfz+dmu0HTUL5uUxkCRUy\nT1V6aTyHe4fb/tL1CFiGBuL+IQg76JmmSjWrpYsNyMkOgCAfmkFeSd0YTnd04pnf\nFqcstU42OnJxtjylaSLQDjnBZ8HDSuWrOGdNppw2ZmD/mCeqfZoSb1XDdFXJbKdO\nwFbs7znx5ZObN+06nD04mqT28/YaY6juNBlhZZz27+vZhzWA1b+97V4stxxRbYUC\nDAM1GWv08EiACgEQAIovtpP23VT3HKWrqDSjAdssTBUncJNWxNhZvp5VS6axsfnU\njDeMAJSOS6c/+RolvKZ2Y4T8XovSSqMC1U598AkPMIbb0eQ8IvuA5UIDZgvIBEKl\nwzyo9myppeN/l910WJs+Vo6DFKLQfBTpRjOzqC/YvzLZUUVFhr+6l4lOWx/lkEFP\n+mt86GALAJT1HT047hebLeQZPnIj/BhPagbD4qR4sJUc5wQxc25T1Oxb5/ToFR0t\nBSqEUdUIG0rvMsDRzpQ4mdg7i6D6PXb4eweTTOCWzpyiFSLfWE9qWXpqCFgpd4xI\nzAEofhbSQH5HqAvTplDhIRKtwK6Ze1aticuRdWjrorHVa602PR3RzFMWMtQa9j12\nK4igA3FD6cHdoRUMoLq8YAyxEwUOgHPmOub+9MOOMmI7Q5bj+oByK2Q2Thq1T6Px\nIVQzq6J5nWFXtRpx9/UFPLnjEqc3ehOItQrnH8980Ocy4nghaKqJGpAQtoP2t5nV\n6aGJ7tqTsv5MDZ+b4pRE/7GjG4v2t4I/BQd/0GU0vndfZx5KmwmTsCrVmrmwhFr8\nBNNNngqsHUZxK0RVI0sA90N23om0ATLWl8gt1mvMWZ8p9NPWQdDa1AVkLBgq6hZN\n9JtRacIS2zuiib5AohijVwp3uTDPL/32au2rAg2vWEFy1jSMnEUDCqTKGJIu1GYB\nCQIQANxUiUXBtAhd1pBA9VOhhD1T57AkDvHfk8gEyNKPC3+RI1GL2ImA+dEQY0Ie\nl4P0mcQTf8tlRgnHZhvf1ktXp46oAV1StGfKEil8WU3N/5gFeCNvRRuGMx05av+t\nfgAAnS4=\n=Ew+/\n-----END PGP MESSAGE-----",
+				"fp": "0C982F87B7AFBA0F504F90A2629E741947C87928"
+			}
+		],
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}

hosts/dn42-il-gw1/secrets/wg-monitoring.age

@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 HwR33w +AFhSTsqwKkww+OGHnKI+qi0JvrQVe8p+XRVnn1oZk4
-t7nBc4g5guqSsP6XFWYLAXPZEKFJA0tk4GM9XP3uoUo
--> ssh-ed25519 g+l3bg LjbGz8bbxotI4uhVaFzCjaOohfjJbTgPCbQ5UgCVgEI
-+7h66Z41OSyvZjJ7ANYFA+ut1FWQXE79WonaXE5HREc
--> OapV-grease jkg)M@ NO4*'ml? lUG]H liUD3iK>
-628DJDgpTFp0XP05robVn8j6/3f340BaYvdZIKLKvqXp93GufqwBnfYRIjYDyolA
-Kt0M59kSw2DOtaYaOEk/E5BJhdYa+cDBEs8
---- 0V08Pg4II/yihrNWngXKWXwr6+Lcu9+XijZYupCyzHo
-E¾‡?aÿ•S,¨Ï&<26>\‚BÒ—8ãÃXüó]S^BûHIÆ-Ý«øê/­F™'#ç;Cî@o&~©iû «Ã‰Ý\=éÍÔ¯¦

hosts/dn42-il-gw1/secrets/wg0197.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 HwR33w Hb6ZchUcn7PeLYtJymInIlAZxlk2uUxGSMk5QsqDFw0
-zHX84c7HCwbc4+h8UlU1C6odjaIboUx0++2LMW/vED8
--> ssh-ed25519 g+l3bg y3kh96FH2V85RL8r43Mv10gZGnGG3VHu+XFR2uXrlDs
-tND1crcFQFybtFWdRgyavQhDeP6A2aEDbojasOvgVqg
--> %-grease 0/m 5Fx\P
-Pg0l
---- hohimWCpUhWAHRe4HXxpmxd9iMrNBC695Deinyp4kLA
-íMâ£=<3D>X4	Ï;ò¾”Ó‡%‰NzB`
Äû›“õúïèU¥Œjo7—
ìÉ	ZáÊ{bb1LÀãoƒ
®[½°Šìí•þîÀÆ]

hosts/dn42-il-gw1/secrets/wg0565.age

@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 HwR33w h5TekYPHD7ZppCsdbFXwSropEh3Pvju1VXyrPrI26i0
-Uqa6Wn1WiGhqig3xfLEXI2d40vtEuBt9CHHhXgTR0qk
--> ssh-ed25519 g+l3bg cj76svaWJQARTcVsxbKe7lzn4s2iF2D+npuhUic0J18
-wqYWyunIERPkP/nHhABt6Ksg8Nu99Ca5Oee9OBFEz8Q
--> o;|'Um8-grease q6 8l.de~N t[|ArlU
-H/aOw57Pk0nW+L7pQE7qyc2yCxCEMaC9i6iFWCrkzHHly4bQWwJh9M5QWtv64IcY
-VTo03EINmPdhIm46aA
---- fKdGdLoSJUu+99ieftkcbJ7EwMBkCXPcpqSvgydyUxw
-üb)šdBvÄŽõ”¶š ™ŸØ(6nÖ5-1”Ü%g•` n
¥§Æã4ÍH^DJëY
-8Òó5XGM—ì»гAR;×]ofr-5

hosts/dn42-il-gw1/secrets/wg1272.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 HwR33w Y7czsW3L3uROocoH8iMOjQeKE/yGSu5S0h++r5Mcuyw
-7hkpnDGEKsUg6+RB4FqjX4+Bi9oELXsbRicJaY5tUV4
--> ssh-ed25519 g+l3bg c01IeQ7LJgY8dlMVBmzzWcQ8bO2EaqBpkz9yBRljyX0
-HGywAguTfrDOQuvgKVv5k18RjY/T58Kg5Qtj+4V3BcQ
--> BX_.c-grease
-lePY2fkQuB6flw
---- FXuXx4dx13ZIvEL68OiY8r5erOf3Duzn1NEyow0Kjw4
-Š<12>[~
”CúŠŠ´*gX³7*<2A>‰¬o ¢<1F>·$ç_M”¯åóÆ<C3B3>‚V-º
XÙ¸D§ã{~âɯý!ཪö

hosts/dn42-il-gw1/secrets/wg1280.age

@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 HwR33w oU0m9iZWa/Cgsp0aXT4EQvfBj1q1V9zGEfbsE0S71ng
-hHr7o1olUSQK2qsN8+EX7aYHCCsRHXqd26261Wa2zMg
--> ssh-ed25519 g+l3bg ZMS6yAQZoUSuPe39zGwRGWt82yk/W4L8dIR235zX82o
-UMdF90/fPh4RPE3xP71cSWlnXbufnoKXtktOom/Huko
--> z>uG/-grease J}D$mL Akt_ zP'h@
-Jqokzvw+5CD+qBxfAUaM/dVhzki7/rJpentlwyVjxDjC7g18bBHdCadLvOun0CsJ
-PE8wq6dGpPEMctd3PLdWAqK+yxTC6KHgdr5m+78qAuy0/pwfuAakm8QZzchDPDU8
-Cw
---- Z/qEM/pbq4n11B5ludgCFLPcsWLN/9yU4f2Yooh5Oe8
-H!Ó’ňç©<C3A7>(öE€żlŻ,6i?tś˛mËSőPĎ Ő’­k­)ÁÍJbµáłŕ¤»ţ@)Żh#Üóń5µo&…ë<E280A6>—Fia<69>żľŔOč

hosts/dn42-il-gw1/secrets/wg1302.age

@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 HwR33w ZEFj+UhMCXhYuOBbKRE4NVZWkSDjIny+KZaLvNyB93A
-KS4gCFlLChfWfpowk2SNQOiEhyWc4cWFY0IETz1iHD4
--> ssh-ed25519 g+l3bg kcmzQPIdyO0ulLbqEY5k0MByj16oRtB7x0zILxlt00w
-HHRYxY21U4nRE2Iq0A0xQWIvMSrlp24oeRH66fDiNMk
--> !CT-grease %xRuyV3
-XnNFHtT5of+0pXksm5y7o/3gRwaR8yxPErHWTnZHGslydc6fOxl1m4NNFkMGsvYp
-XPxhT8HPbjm4stQ7q6uj+GTRvY3E9InGj1dODZwr+HyFykYmHkhyIZtqsjb5f33y
-iw2G
---- eSQ/0WzRlVz3zmMm08ZA40G/+xbWtjCgYS4FFLAwx68
-mßõ›âò™<C3B2>‚
Kô)¤
™1ò™v–#ÄRÔ&¿xIú…ö‘ÇÒä¡öVúü½æ'Å_cåp75<37>cœº~%)RjßSÀõÝ×­

hosts/dn42-il-gw1/secrets/wg4719.age

@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 HwR33w UeMcdbkpB2kyZb7ND1KEWuaJlAIYK6At8lrc0tHo0Sc
-hMBJdGqBl+RQJZCf44aDfQ29432UJokhERRxMZo1Ob8
--> ssh-ed25519 g+l3bg +FK749MpyUVJd4JKoBd8i1heq+Ad5c2Km2seyDXU320
-d+Lq3tZI+KIHQzqr7PhlSkIEtPW9Bv8CTDueeuEHtSc
--> 8#9iy-grease I 3;JW|; %M<}_cj_ eaH(5
-cBjbN201DFcdN2MJRxHjGJluhh/0q+E2R4TD55jHjkn/SDBMiZ1zuprWebXJp4Kk
-FAAfJw
---- 4Nzghsh/lFOzov9JEKOxELBHOrd6Uz1QOzDNHeNzZ20
-6ãÇÜs–æ<E28093>o#žø(Ð:Ÿ•ÿ uÍ_†#«Ç´™.š]XzVš…B ÁR¨O†X€JÊœê>¡õÆŽhN1AO3—íR]Îäd34“