Commit `e7d50ad`

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 7JvPpg XC78eZJvLqOYagQ4m6AT/bSUCYay+tD9dAaqi8BrVBU
+7F3pPShUPr4ZLutbK6YTqLa7hnLh6s3OGPIbEfbY5F4
+-> $DhJ-grease
+8APKfh4/dTGTk09Bw1qiSpwUlfR6U35Cq1VoaO68P6AbRdP3/VgoAIjfutI
+--- znUc5sBrxD1GdTKAewKvAq50rjNVaE/YnHHCEBp0+UQ
+o�I�YhAT�K���ϭ�Ta�
L��ݶ��^��:��	������g�R
�{�`��p����1z*qG޽�w�OVv�6�X1�a��lo]B��.��_
\ No newline at end of file

Binary file

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 qzANJQ 7pUTtNXo2bMX/i8g3ZFRTDxvbpZb4eq+muG1JrPJzHM
+DggkU9yamP2rUeh+S1I1A9YTN3GwB1kHzlFv4RzVqu0
+-> vHs;ts7S-grease 0nhM58 ^^Pe skU
+V0n2U2sxln0RXPmw8Nfug02kWCsTHP95a+exHz3C5PyoqbmTgOjbjyc
+--- cMawiRlKkH087iOkOD5TpKFAcyHO4LRcJRKTXVWHS7g
+�ܭ%��!��袉�pg����~��b��%<Rq=݇J1b�=��b�u���]�%���(���o�Gԃ!,Z �θ������UqG0�����0���s�Q���ެ
\ No newline at end of file

Binary file

@@ -0,0 +1,3 @@
+# Generated Agenix Secrets
+
+This folder contains secrets for each host and user generated by agenix-rekey.

@@ -11,5 +11,7 @@
       admin = true;
       classes = ["user" "hjem"];
     };
+
+    settings.secret.pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOhtRc77FG6usuOu3KQ6ar1Qc8j52RZ4L7RSJlyl8qxK root@cyrene";
   };
 }

@@ -11,5 +11,7 @@
       admin = true;
       classes = ["user" "hjem"];
     };
+
+    settings.secret.pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAlF4NQvg+huSucSEvnS8vxwqyNPPTa4kxNW184WxnhH root@hyacine";
   };
 }

@@ -11,5 +11,7 @@
       admin = true;
       classes = ["user" "hjem"];
     };
+
+    settings.secret.pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOO9CyAqGo/WbJkncrt1a9jxS1E+hd550SC4A08I/l0/ root@kevin";
   };
 }

@@ -11,5 +11,7 @@
       admin = true;
       classes = ["user" "hjem"];
     };
+
+    settings.secret.pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKSHlIARpQYDi744NML9QmFMxOEZwShfyj/ovQh6lCt7 root@mobius";
   };
 }

@@ -11,5 +11,7 @@
       admin = true;
       classes = ["user" "hjem"];
     };
+
+    settings.secret.pubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMQTx9RhZJa4WOAJyAUzlQLaFExcDv921sVsfM02vB9h root@tribios";
   };
 }

@@ -0,0 +1,7 @@
+#       Serial: 34752807, Slot: 1
+#         Name: age identity for Nix configuration
+#      Created: Mon, 25 May 2026 10:01:34 +0000
+#   PIN policy: Once   (A PIN is required once per session, if set)
+# Touch policy: Always (A physical touch is required for every decryption)
+#    Recipient: age1yubikey1qf38em555plx705xy9x5nvdv5tuksendzwngm3n45fdkz4jcw33hjapxgmu
+AGE-PLUGIN-YUBIKEY-1YAY3YQ5ZCSSNPDGQUXFL7

@@ -0,0 +1,92 @@
+{
+  inputs,
+  self,
+  den,
+  lib,
+  withSystem,
+  ...
+}: {
+  flake-file.inputs.vaultix = {
+    url = "github:HPCesia/vaultix";
+    inputs.nixpkgs.follows = "nixpkgs";
+    inputs.flake-parts.follows = "flake-parts";
+    inputs.pre-commit-hooks.inputs.flake-compat.follows = "flake-compat";
+  };
+
+  imports = [(inputs.vaultix.flakeModules.default or {})];
+
+  flake.vaultix = {
+    identity = ./age-yubikey.pub;
+    cache = "./.secrets/cache";
+    defaultSecretDirectory = "./.secrets";
+    nodes = lib.filterAttrs (_: nixos: nixos.config ? vaultix) self.nixosConfigurations;
+  };
+  perSystem = {
+    pkgs,
+    system,
+    ...
+  }: {
+    vaultix = {
+      extraPackages = [pkgs.age-plugin-yubikey];
+    };
+    devshells.default = {
+      commands = [
+        {
+          name = "edit-secret";
+          help = "view and edit secrets managed by vaultix";
+          command = ''nix run .#vaultix.app.${system}.edit "$@"'';
+          category = "secret";
+        }
+        {
+          help = "cache secrets managed by vaultix for all hosts";
+          name = "cache-secret";
+          command = ''nix run .#vaultix.app.${system}.renc "$@"'';
+          category = "secret";
+        }
+      ];
+    };
+  };
+
+  den.aspects.secret = {
+    settings = {
+      host.pubKey = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
+    };
+
+    nixos = {
+      host,
+      pkgs,
+      lib,
+      config,
+      ...
+    } @ args: let
+      cfg = host.settings.secret;
+      dummyPubkey = "age1qyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqs3290gq";
+    in {
+      imports = [
+        (import (inputs.vaultix.outPath + "/module") (args // {inherit self;}))
+      ];
+
+      vaultix = {
+        package = withSystem host.system (
+          {inputs', ...}: inputs'.vaultix.packages.default
+        );
+        settings = {
+          hostPubkey =
+            if (cfg.pubKey != null)
+            then cfg.pubKey
+            else dummyPubkey;
+
+          hostKeys = config.services.openssh.hostKeys;
+        };
+      };
+
+      services.userborn.enable = true;
+      users.mutableUsers = false;
+    };
+  };
+
+  den.default.includes = [den.aspects.secret];
+}

@@ -4,6 +4,9 @@
       displayName = "HPCesia";
       email = "me@hpcesia.com";
     };
+    system = {
+      hashedPasswordAged = ./hashed-password.age;
+    };
   };
 
   den.aspects.hpcesia = {

Binary file

@@ -16,6 +16,16 @@
       name = "user-description/${user.userName}";
       user.description = user.identity.displayName;
     })
+    ({user, ...}: {
+      name = "user-password/${user.userName}";
+      nixos = {config, ...}: let
+        secretName = "hashed-password-user-${user.userName}";
+      in {
+        users.users.${user.userName}.hashedPasswordFile = config.vaultix.secrets.${secretName}.path;
+        vaultix.secrets.${secretName}.file = user.system.hashedPasswordAged;
+        vaultix.beforeUserborn = [secretName];
+      };
+    })
     ({
       host,
       user,

@@ -30,6 +30,10 @@
           system = lib.mkOption {
             type = lib.types.submodule {
               options = {
+                hashedPasswordAged = lib.mkOption {
+                  type = lib.types.path;
+                  description = "Age encryped hashed password file for user";
+                };
                 settings = lib.mkOption {
                   type = lib.types.anything;
                 };

@@ -1,5 +1,20 @@
 {
   "nodes": {
+    "crane": {
+      "locked": {
+        "lastModified": 1780532242,
+        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "den": {
       "locked": {
         "lastModified": 1786475005,
@@ -83,6 +98,28 @@
         "type": "github"
       }
     },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "vaultix",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "hjem": {
       "inputs": {
         "nixpkgs": [
@@ -134,6 +171,31 @@
         "type": "github"
       }
     },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "vaultix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778507602,
+        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "den": "den",
@@ -143,7 +205,33 @@
         "flake-parts": "flake-parts",
         "hjem": "hjem",
         "import-tree": "import-tree",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "vaultix": "vaultix"
+      }
+    },
+    "vaultix": {
+      "inputs": {
+        "crane": "crane",
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks": "pre-commit-hooks"
+      },
+      "locked": {
+        "lastModified": 1786987884,
+        "narHash": "sha256-jy9VXxVaFiHd2QOH0sIJzrfcTmX1prpaVA9G3FM3jCk=",
+        "owner": "HPCesia",
+        "repo": "vaultix",
+        "rev": "64416010693cffbf8348851604f335a47d60e4c0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "HPCesia",
+        "repo": "vaultix",
+        "type": "github"
       }
     }
   },

@@ -23,5 +23,13 @@
     };
     import-tree.url = "github:denful/import-tree";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    vaultix = {
+      url = "github:HPCesia/vaultix";
+      inputs = {
+        flake-parts.follows = "flake-parts";
+        nixpkgs.follows = "nixpkgs";
+        pre-commit-hooks.inputs.flake-compat.follows = "flake-compat";
+      };
+    };
   };
 }

Commit e7d50ad

Commit `e7d50ad`