sops

modules/system/default.nix

@@ -13,7 +13,9 @@
     ./nix.nix
     ./power.nix
     ./secure-boot.nix
+    ./sops.nix
     ./user
     ./version.nix
+    ./secret.nix
   ];
 }

modules/system/secret.nix

@@ -0,0 +1,14 @@
+_:
+let
+  commonSyetemSecrets = ../../secrets/common/system.yaml;
+in
+{
+  sops.secrets = {
+    "users/moons/hashedPassword" = {
+      sopsFile = commonSyetemSecrets;
+
+      # need before user creation
+      neededForUsers = true;
+    };
+  };
+}

modules/system/sops.nix

@@ -0,0 +1,41 @@
+{
+  inputs,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
+  environment.systemPackages = with pkgs; [
+    # sops / age
+    sops
+    age
+    ssh-to-age
+
+    # YubiKey edit key
+    age-plugin-yubikey
+    yubikey-manager
+    pcsc-tools
+
+    # password hash generation
+    mkpasswd
+  ];
+
+  # age-plugin-yubikey depend
+  services.pcscd.enable = true;
+
+  services.openssh.enable = true;
+
+  sops = {
+    defaultSopsFormat = "yaml";
+
+    age = {
+      # system keys
+      sshKeyPaths = [
+        "/etc/ssh/ssh_host_ed25519_key"
+      ];
+    };
+  };
+}

modules/system/user/moons.nix

@@ -1,8 +1,15 @@
-{ pkgs, ... }:
 {
+  pkgs,
+  config,
+  ...
+}:
+{
+  users.mutableUsers = false;
+
   users.users.moons = {
     isNormalUser = true;
     description = "moons-14";
+    hashedPasswordFile = config.sops.secrets."users/moons/hashedPassword".path;
     extraGroups = [
       "adbusers"
       "docker"