mikl
2d023fc86d
- flake.nix: mkHost helper, SOPS-age integration - hosts/common: locale, sshd, universal packages - hosts/muscari: k3s host with Cilium flags - modules/users/mikl: SSH keys via forgejo .keys + sha256 pinning - modules/services/k3s: k3s daemon with Cilium-compatible flags - hardware-configuration.nix: placeholder, will be regenerated on real VM Stack: - NixOS 25.11 - k3s single-node (Cilium CNI, Traefik ingress) - SOPS + age for secrets - Multi-host ready (rosemary planned)
13 lines
No EOL
492 B
YAML
13 lines
No EOL
492 B
YAML
# SOPS config — шифрование secrets/<hostname>.yaml age-ключом mikl
|
|
# Публичный age-ключ вставляется ниже после генерации:
|
|
# age-keygen -o ~/.config/sops/age/mikl.txt
|
|
# cat ~/.config/sops/age/mikl.txt # последняя строка = public key
|
|
|
|
keys:
|
|
- &admin_key age1placeholder_replace_with_real_key_after_age_keygen
|
|
|
|
creation_rules:
|
|
- path_regex: secrets/.*\.ya?ml$
|
|
key_groups:
|
|
- age:
|
|
- *admin_key |