rain
103153ae6c
Tadbit is the 7th machine in the homelab. Generated a per-machine age key on tadbit, added the pubkey as 8th recipient in .chezmoi.yaml.tmpl, and re-encrypted the two .age secrets with all 8 recipients (1 recovery + 7 machines).
98 lines
No EOL
4.9 KiB
Cheetah
98 lines
No EOL
4.9 KiB
Cheetah
{{- $osFamily := "unknown" -}}
|
|
{{- $idLike := "" -}}
|
|
{{- if hasKey .chezmoi.osRelease "idLike" -}}
|
|
{{- $idLike = .chezmoi.osRelease.idLike -}}
|
|
{{- end -}}
|
|
{{- $osId := .chezmoi.osRelease.id -}}
|
|
{{- /* Gentoo's /etc/os-release uses single-quoted values (e.g. ID='gentoo'),
|
|
and the parser doesn't strip them, so strip here. Other distros use
|
|
double-quoted or unquoted values which the parser handles. */ -}}
|
|
{{- if hasPrefix "'" $osId -}}
|
|
{{- $osId = trimAll "'" $osId -}}
|
|
{{- end -}}
|
|
{{- if or (eq $osId "arch") (contains "arch" $idLike) -}}
|
|
{{- $osFamily = "arch" -}}
|
|
{{- else if or (eq $osId "debian") (contains "debian" $idLike) -}}
|
|
{{- $osFamily = "debian" -}}
|
|
{{- else if eq $osId "gentoo" -}}
|
|
{{- $osFamily = "gentoo" -}}
|
|
{{- end -}}
|
|
encryption: "age"
|
|
# chezmoi's builtin age implementation requires a TTY for passphrase-style
|
|
# decryption prompts and doesn't support all features. Force the external
|
|
# age binary instead. If chezmoi can't find `age` on PATH at apply time,
|
|
# the absolute path is used as a fallback.
|
|
useBuiltinAge: false
|
|
sourceDir: {{ .chezmoi.sourceDir | quote }}
|
|
|
|
# age config — see https://www.chezmoi.io/user-guide/encryption/age/
|
|
#
|
|
# To bootstrap age on a new box:
|
|
# 1. Generate a recovery key (offline, store secret in password manager):
|
|
# age-keygen -o ~/.config/chezmoi/keys/recovery.key
|
|
# Add the printed public key below as a recipient.
|
|
# 2. Generate a per-machine key on each box:
|
|
# age-keygen -o ~/.config/chezmoi/key.txt
|
|
# Add its public key below, then `chezmoi age rekey` to rewrite *.age files.
|
|
#
|
|
# To encrypt a new secret:
|
|
# echo 'secret' | chezmoi encrypt --output private_dot_.../<name>.age
|
|
#
|
|
# To decrypt (auto, on apply):
|
|
# chezmoi uses ~/.config/chezmoi/key.txt (per-machine) by default.
|
|
|
|
age:
|
|
# Absolute path to age binary. Most distros install to /usr/bin/age;
|
|
# Arch's pacman and Debian's apt both put it there. Using the absolute
|
|
# path means chezmoi can find age even if PATH isn't set correctly
|
|
# (which happens in some non-interactive SSH contexts).
|
|
#
|
|
# On a per-machine bootstrap, this might not be installed yet (sudo
|
|
# required). The bootstrap detects the fallback path and re-renders
|
|
# the config to use it. See run_once_00-install-bootstrap-tools.sh.tmpl.
|
|
{{- if stat "/usr/bin/age" }}
|
|
command: "/usr/bin/age"
|
|
{{- else if stat (joinPath .chezmoi.homeDir ".local/bin/age") }}
|
|
command: "{{ joinPath .chezmoi.homeDir ".local/bin/age" }}"
|
|
{{- else if stat "/usr/local/bin/age" }}
|
|
command: "/usr/local/bin/age"
|
|
{{- end }}
|
|
identity: "~/.config/chezmoi/key.txt"
|
|
|
|
# Multiple recipients: every listed recipient can decrypt every *.age file.
|
|
# Add a new recipient by pasting their public key below, then
|
|
# `chezmoi age rekey` to rewrite existing files with the new recipient.
|
|
recipients:
|
|
# Recovery key — secret stored offline (password manager, USB stick).
|
|
# Don't lose this: it's the only way to recover secrets if every
|
|
# machine key is lost.
|
|
- age1yyq42ctqwp5s5yd64week3aav9getk3p8aeyr5n5454d0v59a4dsjljsgs
|
|
|
|
# Per-machine keys — one per box. Generate on the box itself with
|
|
# `age-keygen -o ~/.config/chezmoi/key.txt`, paste its public key
|
|
# here, then `chezmoi age rekey`.
|
|
- age1eja7trs8mmsgf0qga0h5fsdltaryxgk4ksumshar5xxtdx0exy3q0a5hc5 # miche (Strix Halo GPU host)
|
|
- age1tzmsrw59zkvh47pwz66gly3s4hdcru76569s8cgv0syfrpmutdxsnlke30 # byte (CachyOS laptop)
|
|
- age16pl6ad3r44hf3q70xra7fadmllhmnnpmksetr3hr6a0q55kd3f9slvpsdg # kaiser (services host)
|
|
- age14yfcz6k3m4q99nuvd22ka8zgtgj6q5jmt0sz3cz0004uhcgddfpq49kxw7 # rye (Debian Pi)
|
|
- age19d0dqm6nzmhlhuns2qa3z64rua294xvf6l2uy5we5dlrq6z4yvwq6g4y4e # crouton (Debian Pi)
|
|
- age1jk0xy6ltmd00x36jswxlj9c94pap3yu82usj2lzsxnqqdtngupnsyqjyv4 # bit (CachyOS laptop)
|
|
- age1f3snmdh0ra83lq8tly2t823dp6u6sluepf3kcj9xcyg4wh722fuqptwnpq # tadbit (Gentoo laptop)
|
|
|
|
data:
|
|
os_family: {{ $osFamily | quote }}
|
|
os_id: {{ $osId | quote }}
|
|
|
|
# Sway/Wayland desktop stack — opt-in at bootstrap time. When you
|
|
# run `chezmoi init` for the first time, you'll be asked:
|
|
# "Install the sway + wofi + foot Wayland desktop stack? [y/N]"
|
|
# Answering `y` installs the packages and writes the configs.
|
|
# Answering `N` (or pressing enter for default) skips both.
|
|
#
|
|
# To flip later: `touch ~/.config/chezmoi/features/sway` to enable,
|
|
# or `touch ~/.config/chezmoi/features/no-sway` to disable, then
|
|
# `chezmoi apply`. The marker files override the bootstrap answer.
|
|
{{- $swayMarker := not (not (stat (joinPath .chezmoi.homeDir ".config/chezmoi/features/sway"))) }}
|
|
{{- $noSwayMarker := not (not (stat (joinPath .chezmoi.homeDir ".config/chezmoi/features/no-sway"))) }}
|
|
{{- $swayPrompt := promptBool "sway_setup" false }}
|
|
sway_setup: {{ or $swayMarker (and $swayPrompt (not $noSwayMarker)) }} |