titaniumtown/server-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

install: cleanup key and secrets handling

Browse Source
This commit is contained in:
Simon Gardling 2025-11-20 21:02:33 -05:00
parent 8d420ea86b
commit bc55d4203f
Signed by: titaniumtown
GPG Key ID: 9AB28AC10ECE533D
4 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitattributes vendored
View File

@ -1,3 +1,3 @@
secrets/** filter=git-crypt diff=git-crypt secrets/** filter=git-crypt diff=git-crypt
usb-secrets/usb-secrets/usb-secrets-key filter=git-crypt diff=git-crypt usb-secrets/usb-secrets-key* filter=git-crypt diff=git-crypt

8
install.sh
View File

@ -30,12 +30,12 @@ trap cleanup EXIT
# Decrypt secureboot keys using the key in the repo # Decrypt secureboot keys using the key in the repo
echo "Decrypting secureboot keys..." echo "Decrypting secureboot keys..."
if [[ ! -f "$FLAKE_DIR/usb-secrets/usb-secrets/usb-secrets-key" ]]; then if [[ ! -f "$FLAKE_DIR/usb-secrets/usb-secrets-key" ]]; then
echo "Error: usb-secrets-key not found at $FLAKE_DIR/usb-secrets/usb-secrets/usb-secrets-key" echo "Error: usb-secrets-key not found at $FLAKE_DIR/usb-secrets/usb-secrets-key"
exit 1 exit 1
fi fi
nix-shell -p age --run "age -d -i '$FLAKE_DIR/usb-secrets/usb-secrets/usb-secrets-key' '$FLAKE_DIR/secrets/secureboot.tar.age'" | \ nix-shell -p age --run "age -d -i '$FLAKE_DIR/usb-secrets/usb-secrets-key' '$FLAKE_DIR/secrets/secureboot.tar.age'" | \
tar -x -C /tmp/secureboot tar -x -C /tmp/secureboot
echo "Secureboot keys extracted" echo "Secureboot keys extracted"
@ -56,4 +56,4 @@ sudo $DISKO_INSTALL \
--flake "$FLAKE_DIR#muffin" \ --flake "$FLAKE_DIR#muffin" \
--disk main "$DISK" \ --disk main "$DISK" \
--extra-files /tmp/secureboot /etc/secureboot \ --extra-files /tmp/secureboot /etc/secureboot \
--extra-files "$FLAKE_DIR/usb-secrets/usb-secrets" /mnt/usb-secrets --extra-files "$FLAKE_DIR/usb-secrets/usb-secrets-key" /mnt/usb-secrets/usb-secrets-key

0
usb-secrets/usb-secrets/usb-secrets-key → usb-secrets/usb-secrets-key
View File

1
usb-secrets/usb-secrets/usb-secrets-key.pub
View File

@ -1 +0,0 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN8+eSX2LH5wEHVG9sSv97ceD5zdTarV0lRvoUso4A7p USB secrets decryption key