From 72fa9d89dc1fe7bb2c59338cd25ebab81008fd65 Mon Sep 17 00:00:00 2001 From: RGBCube Date: Fri, 12 Jan 2024 14:59:38 +0300 Subject: [PATCH] Fix passwordFile, make it hashedPasswordFile --- hosts/cube/default.nix | 6 +++--- hosts/enka/default.nix | 16 ++++++++-------- modules/users.nix | 5 +++++ secrets/acme.age | Bin 385 -> 385 bytes secrets/cube.id.age | Bin 1040 -> 1040 bytes secrets/cube.mail.password.hash.age | Bin 273 -> 273 bytes secrets/cube.password.age | 5 ----- secrets/cube.password.hash.age | Bin 0 -> 273 bytes secrets/enka.orhan.password.age | 13 ------------- secrets/enka.orhan.password.hash.age | Bin 0 -> 702 bytes secrets/enka.said.password.age | 13 ------------- secrets/enka.said.password.hash.age | 13 +++++++++++++ secrets/secrets.nix | 12 ++++++------ 13 files changed, 35 insertions(+), 48 deletions(-) create mode 100644 modules/users.nix delete mode 100644 secrets/cube.password.age create mode 100644 secrets/cube.password.hash.age delete mode 100644 secrets/enka.orhan.password.age create mode 100644 secrets/enka.orhan.password.hash.age delete mode 100644 secrets/enka.said.password.age create mode 100644 secrets/enka.said.password.hash.age diff --git a/hosts/cube/default.nix b/hosts/cube/default.nix index 9e90065..a6b95f3 100644 --- a/hosts/cube/default.nix +++ b/hosts/cube/default.nix @@ -11,10 +11,10 @@ users.users.root.passwordFile = config.age.secrets."cube.password".path; users.users.rgb = normalUser { - description = "RGB"; - extraGroups = [ "wheel" ]; + description = "RGB"; + extraGroups = [ "wheel" ]; openssh.authorizedKeys.keys = [ keys.rgbcube ]; - passwordFile = config.age.secrets."cube.password".path; + hashedPasswordFile = config.age.secrets."cube.password.hash".path; }; }) diff --git a/hosts/enka/default.nix b/hosts/enka/default.nix index 0350962..b6fe7b9 100644 --- a/hosts/enka/default.nix +++ b/hosts/enka/default.nix @@ -7,19 +7,19 @@ time.timeZone = "Europe/Istanbul"; - users.users.root.passwordFile = config.age.secrets."enka.said.password".path; + users.users.root.hashedPasswordFile = config.age.secrets."enka.said.password.hash".path; users.users.said = graphicalUser { - description = "Said"; - extraGroups = [ "wheel" ]; - passwordFile = config.age.secrets."enka.said.password".path; - uid = 1000; + description = "Said"; + extraGroups = [ "wheel" ]; + hashedPasswordFile = config.age.secrets."enka.said.password.hash".path; + uid = 1000; }; users.users.orhan = graphicalUser { - description = "Orhan"; - passwordFile = builtins.trace (config.age.secrets) config.age.secrets."enka.orhan.password".path; - uid = 1001; + description = "Orhan"; + hashedPasswordFile = builtins.trace (config.age.secrets) config.age.secrets."enka.orhan.password.hash".path; + uid = 1001; }; networking.firewall = enabled { diff --git a/modules/users.nix b/modules/users.nix new file mode 100644 index 0000000..b43732e --- /dev/null +++ b/modules/users.nix @@ -0,0 +1,5 @@ +{ ulib, ... }: with ulib; + +systemConfiguration { + users.mutableUsers = false; +} diff --git a/secrets/acme.age b/secrets/acme.age index 048845f7bfc7af945ebb09baecc356de56aee4a8..b386a61dc8008c17b7252f407798a47ae68c8d48 100644 GIT binary patch delta 350 zcmZoQr80=u?sxWNsN5Vwza!U*T05 z%4K2hR-Rr~;2YtcQ&{d7RAd~I+WwHP?hGAVwsi_lv|MFQV{Cp%cZNUs}Pp& z?qunh>lo>+@0b#(pP%F&k{p=t13K?2u^N#mN=rKGT|iccY%Q=;OO4sR#7{ D^!=5> delta 350 zcmZo}Kg$ z%;l0=nHp}H7!s1@nU>;Q?riR7;AvD6m>ZGe<7<|eSC*-5X%Ze36xQtevCpf&Z#RPU8*kyv0@=E%jW{>jNm>H_zUQjy%}-n?`;A@j%9Lz|`_l??A5{bzIwghIzKtv?`Ml8Y`SiS! z{$qQ+P9NO0bfv*WZviz`&xi4uO@az6A7!s7-roFfzOU1{Pls-AGtUu8n%$(DvS~xY zf!PNCtwnF=-C7VXtHqOi*!YL-*Rq0;V*44(cfV(4our|q9&IMr=6_7YN&K)TzrJeD zn%~KeXN1hT<{HoX{Oo!~HZvc09f!|Mrn~+w)wPaAo1_oU|6Kaj*LJGa`IEu94V?h@ C_KOh! diff --git a/secrets/cube.id.age b/secrets/cube.id.age index 0c5509d11f6f3a149f858fdf5ceefa85fcf06bd0..598a6a4f3e40e3feb4b6e5a29102fb217b13e16d 100644 GIT binary patch delta 1014 zcmbQhF@a-(MtyF6l&O2Rdq{wBRH~c1aYm3?fMrget6#RUUuv#vNm5a`X=z$jm4{cT zk5_tnv3`+Ra6ztFX?a?Xx4Wrhr8k#(V4jhwTa>qHYCxh{VM(&DYf@ymONeo5u#rJZ zZiT;ZrhaHjfk|*kWmZVJxsOqKwohnozP5KoqH%a~NPS=hmzQ5?PKs}2mA_$mu3xA{ zUUFKxkCA>rL_|`0fO&+An`2&xwy9@HMoE!hj%k2du~SLDL4|LolSi_Lo1ceY8kduH zNU)=}Yj}l)ucLoZpqocZMwzLpYl%;AT5f4>Ua6zAep+6xVV-NLi;Jsvc5aYmU}QvY zq?4O=WPNUCVqO`SlcAScrha8Qc9mzepYx$n2|}Ui)W;tiDQYYzIkAxrGZ;UR%%pmk$bX*nX?gB zfNyDbc6hR3cA8U&m!E-4P_}!Cg@vC}vXi?{zGbLoX?8%0QDAY2MYf+;iDQ{rx^teB zetlJPeo~lUN|~>(85ftXuC78^K!LGSNola5qp^{>zq?6taadJGYM`01Z$*f&X+V;p zVW56sZm^M0N-|fc=A#RHmIiwt{Gzn6HOXV|qgmn=bI-2H>4{sKrW^TTw$+^;dz)vh zaklR*#F+9OL%yaNvYyuLc)Q_GW$DD0PkY=a)#n_YHaFGcii6d?M$My2w5B~Rg zXL#;q*W7Ia4;DRrm3Ju7W%+ca178YtSeSbo?;QT zzu@0%iMbuom*0eL@MSmNyXRhq(z6|9 zU|K<#fk&mQYnY*bL|Q;avA2(NWu%FPepHEHRDGT!SCD(8c2J(HvAKIvc4$Ra zPiZu}gq|dPs3fm{(w4UQR|%WJ-CaQ)RZJQCNAZ zZ$*@eTfI-PS$GClS!jTnUvjFyPr6%~M?q$ZwttvMxmi}GMY>6fc6woiud_=~pl4EH zfQ3MK zdZxRjlY72zMp1c=wy%YWmvgpjUWikkQ9xKpSiNg{Wr#~iP63yxX|k6=ZgEJsyQx{F zd5Tw%Pi{)Sk9MYUL{)`p!Co=n=MUsD}MVU*LOO|=6U!=Ejg;{=xN3pg^RC=(FOQcD7 zWWA?(kbkJVQL>qfHW!z!uC9W=kzbH+l!tSmX`*R?Yf7-OONeVpiKDx}zF$Rgif3p> zpmwr;i9vS(xnUo5mW9oZ+mgjub$F%ayr8(nhQh46`rbtsoL93M=o-k~{#(Yd>o3ude;vvm@-J>i!5>o$D8kb9xpC z+|1_{*eKZHrT3|0`d|Gcu|aq9&NwQ$y8Y1p+#~aALsMr{{*JgT)d$zNn67P`7b*Ww z<3E>weo|u7i?IC)@4fOiIz?vek8M-;o}{p@v@dfWi*kkI-y8)~{bjM845@eYAAGAj z+O}b-$bka0@;LUlI!iiPwC->`@=#&=b3ootGUV=w+b#FwTiidq@n*KrG5#-e3IOT! Bf@1&x diff --git a/secrets/cube.mail.password.hash.age b/secrets/cube.mail.password.hash.age index 8cd11fdffb52f1680727f88c193fec6e0cce0825..e9f2d361501f57cfe73bd53207bbec5508046ff7 100644 GIT binary patch delta 237 zcmbQpG?8h7PJKw4Q&5DFK~7acSxTW-QkqYiPeoXfYe{aUPicBofJu;ca;9gnwvm6R z1(#W}OLmT{hnbhFpR0dlM5U{LnrDSYKzM<6cz#iei;<6uc44B6r;lMlD3`9Tu0nZ6 zNtC5~l4Xi}QNBy6Sx$C&RYYF6t7(#VfNO+nlA~KjV49OxWnzA1WhB@Adv*WC=j^^w z)B8oMUgNZ#-_)3+-_Fl!>u_52e#y&i1^KZu`C=i0?0=psNNw!b^|t?d*s?-6%zWD& pMa{RYGCG|PIc$FH*-?8~%VMqHdodAUoN zBbQTHUV3D?iN1SfQGvFvrF*)&N11-0xtXz{e^GXYt50&FpG9VImUo3;D3`9Tu0mj? zepsM^ds1*>YGP_~USv|Bv3GW{d9klacuJaSc79}TcAAsFX|a!+K{nR{Q70dhC!bBH zdp55u^4|ORiT%HSue&arO#5d0zQSa=9+%MSj{3zbnyTbg(j^)vS1k2fcH=Xj{_%|U pY)g;(z7bGYwamY~&1{=sLyxXi$5F4@A&*&7-S{SQGic6k0{}deT6X{d diff --git a/secrets/cube.password.age b/secrets/cube.password.age deleted file mode 100644 index 6804bf5..0000000 --- a/secrets/cube.password.age +++ /dev/null @@ -1,5 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 +rZ0Tw x9IJ2ck/8MA6Fs35/BMihuDmKQCSElWbOYJj0LjICm8 -05eogDn65uicgob/Y54fM48oPBEi6MG+MVYklCdGYCc ---- V2522x6kEJw9dTupA5GoH9n3bFCQwIoNbuRWmkNUb4E -5%## 9={[6Oů;o]z4/ \ No newline at end of file diff --git a/secrets/cube.password.hash.age b/secrets/cube.password.hash.age new file mode 100644 index 0000000000000000000000000000000000000000..5313c77ba9e169e59b9fbf9cd211d02d532a9699 GIT binary patch literal 273 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUFE{ZY;DOU(ij4TZ* zaP$l-t;#C&%ByfStZ)u<%=Ac#G&2f!%Pw?xPs>co%k*_KPUo`pDb6TP_RI?N%5kem z%#U*Ss!B9-&CB(!%g2h-vocJ(c85#QvODMDF6)jXxjh) literal 0 HcmV?d00001 diff --git a/secrets/enka.orhan.password.age b/secrets/enka.orhan.password.age deleted file mode 100644 index d4e03b3..0000000 --- a/secrets/enka.orhan.password.age +++ /dev/null @@ -1,13 +0,0 @@ -age-encryption.org/v1 --> ssh-rsa jPaU3Q -GlmABFdE3kDBw9CViYn1me+juMa33cJnG2A+JbFLkf0kxIjOc60fu1V94NgmkX+c -GDwVJf3orhjdNPX74we7hjQh2Qr4TlgQJiBm8InqU5B+hM7UHU9rVkTXi0VGf+WP -2AQM6ROk+zzGdfT2wGf9Q49DQ/hVLqTsY+CZI4+UvqUFYP8n/GiXAC4RaTAYA+RB -krD5pFTsxRIu+l7J3JrbFDna1YpeYZhCXeIt5tvKOhJFUklzvlYhSc8g9kNKmE1/ -aN1wCy86vaHcxe3MBIBdj0vfqyQk+wx9lInW2GIqmjn84+HG/r4k9hShljdrJHLe -h99xblajmoCSuLrw7Bx/zz9Bb9UApP0Jybn+2YKh0dKmFl/twIDZhNOUlxI6r/XM -h8puG7Fmh/jaqrWFBflh4f73PcLuCUU93t0D29HRzELL1l99ZZNednSTj8BVnE0o -kgOGpKzoC7B+T6SA8+9wg1RnXOCS5EjLhsNuIiOGr5Z/iIxpSG8ZyaE9IR/qHgXx - ---- H1Sj5NTcvGobXVCgNTrFlJ43hM+M9wy02THaguqhvL8 -4k>f(;lXU L'Ȏ|C̓xrL\iO \ No newline at end of file diff --git a/secrets/enka.orhan.password.hash.age b/secrets/enka.orhan.password.hash.age new file mode 100644 index 0000000000000000000000000000000000000000..224ec2cf98309943695c314ae08047a9c66675ce GIT binary patch literal 702 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!*`Do#|$3P=n!4&-tT4k;*gDvHRB zN_7kh3373aEOaU}(YMTXt}@lGEYi>ScMUD|DDrjA2{ca4w)FCk3eWX)cQ!Q5^C-`< zNDk*RGxQD2EH>~C$}sYF^*1i}4|MaW@J=%c3Qh?~^@;K+GEeg?^2sd>&NFcg%!w>1 z4-P7GE2%6Gat{pgbItYVDs|5bFU}~=v`jHh@k%uCEeI+zEpRV#HBAiEE-lMTG7E6^ zGl?vWuyoAN&ogle@eM22PBSUaOtegOcdN=T=E}*oOpkDKsW7ex_RMkhG4l(}HL@rO ztjs7*Hg|D$Hq6a1s4_3M)c4H`Do-;H_Am}|PcDwkcQte_sWOiA&*k#-E_V$#Fex`P z^QtIz(NA$N%y5qk@pJPJFv|!rH%!SgHVQM)P7HA?&oguP@CkG?H+A$5O)IN1aWeAB z47cPmDfCY_HB7CD3Jh`%Ef4TE@Jy@p$c>0F4D$=h2{kk?Fif^gH;gb%uZRjXFz^Vi z2uRm1$}$SiHmnTI3D&OQN_IEQO7@G)Gxy3$&Ik=n$|*9fu&k_f_6~F}E-TKm$Z#zS zi84!0Px15g3XC+2)D8>|C=4xf%6E$}EC{ZM;EFWPGcodWFY-|gcyplgP<>js~GVEN ssh-rsa jPaU3Q -n0HmR5sh8691NXK0g1f4IlxFsVDVD1/WFqOUHdIDIJCZJQJlnto+dAxK/Lm3116/ -F+4ptdlLrmOsK45KkKXqXGn2mVEDXUAtj6cfxO0uIF8hX6vdMI+pKkWkmGQrIMlP -WExmWAB5aPdtMiKq/ON9OWzCgAGrrOxvt944tIcA/7JvtD/fiOB/n1CLq7xnG0z4 -wsnL5qxujrVYi5kfejPKH9iMLc0W9/4TBh99xlfCOSvu7ZdJSMeTBe3gYVSCS30n -BiLwSXByQ9vhGjWOzw9WYRAR2QWh+Nez9z5O7RUTH4QyCnWNaqza9lixAid6GU9P -eqScuqJD7t8/bbVB+AATlEcNKhajwg0+rI17rKAYavP5YBQMW3Wh8J6MeHDRNoll -SjjN/JnSPzny2+UtaWxx86uM8r18l1aC1X3/yIHEU39IZNtEsRTXEeahszveT10j -OKBd6DwDPHjP38Hz1hmg0VSqmZ88pLJjmx4nW5C/zBrzErl09aeYHDYaxBzLoaIv - ---- E48Sdci1uNpRiCQUtsmHvrXfVp09RP1PZyYGE8fy/MA -ga9ߎ+?Ԭ)PXDZN\ ^s5 \ No newline at end of file diff --git a/secrets/enka.said.password.hash.age b/secrets/enka.said.password.hash.age new file mode 100644 index 0000000..09e141d --- /dev/null +++ b/secrets/enka.said.password.hash.age @@ -0,0 +1,13 @@ +age-encryption.org/v1 +-> ssh-rsa jPaU3Q +fcLnXbOJUuKFwACpygk4zFbvl77TiC/xhsqYKjqOBbuWUq29rvj1nBVAXMkaKBtY +NZmJ21FIvvYhu7Yt8C49ePVdHbQnxix9TDjzAz8D3G3uuKcBJ8SO9t2faA64hPjV +uNHWO5KMrtjdmYl195yg2BS//gBMgQVcoOSkE1ydla8Dso4pv27x6ZULVqeTlV+Z +WMuK6RUknqJqlCLjaAIcUd7y/ALZJFucJ6yJk4JtUVbyxEYGt52wBEiELD/rXWop +LWMgzKnLrL5xK07Z+9X94HUigtOMvpUDQUak6e4P46cZwzic6qZOCWBswnkQSuIe +yWkGD0hpYkCDNlUkQXAs2jqICbpGXCNQ3plCeFp84B0hSs1gcg3gSkY8S8s9vUIv +yx/BGdqz/Ev6tvqvYpSB8EN3bMEXzhW1wr698GFQVHNdcIAQrhuyPboa5rbsJZn5 +KueQnyH0ZNCBYs1tJC3u9IjRjS1Zi8i86nWmLvpKa6RXKHqVsbvi2Llvqn7SSE2o + +--- mkKbbwjMlBGtzye+ey4JDdT1zWxoI6nU2l8pNlG44ow +)n_K=M\`&rv V#)Nq߸Uԓ(ܸOڋZf3xB9eESݫа#1u%b \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 1e9ca60..ee0de1f 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -1,10 +1,10 @@ with import ./keys.nix; { - "acme.age".publicKeys = [ cube ]; - "cube.password.age".publicKeys = [ cube ]; - "cube.mail.password.hash.age".publicKeys = [ cube ]; - "cube.id.age".publicKeys = [ rgbcube ]; - "enka.said.password.age".publicKeys = [ rgbcube ]; - "enka.orhan.password.age".publicKeys = [ rgbcube ]; + "acme.age".publicKeys = [ cube ]; + "cube.password.hash.age".publicKeys = [ cube ]; + "cube.mail.password.hash.age".publicKeys = [ cube ]; + "cube.id.age".publicKeys = [ rgbcube ]; + "enka.said.password.hash.age".publicKeys = [ rgbcube ]; + "enka.orhan.password.hash.age".publicKeys = [ rgbcube ]; }