diff options
| -rw-r--r-- | home/profiles/communication/default.nix | 14 | ||||
| -rw-r--r-- | home/secrets/secrets.yaml | 30 |
2 files changed, 37 insertions, 7 deletions
diff --git a/home/profiles/communication/default.nix b/home/profiles/communication/default.nix index 03f1f3c..1e65cc3 100644 --- a/home/profiles/communication/default.nix +++ b/home/profiles/communication/default.nix @@ -13,6 +13,8 @@ let action = lib.last x'; }); mbsyncCmd = if pkgs.stdenv.isLinux then "${config.programs.mbsync.package}/bin/mbsync" else ""; + # https://github.com/Mic92/sops-nix/issues/284 + fixSopsPrefix = x: y: builtins.replaceStrings ["%r"] ["/run/user/${toString x}"] y; in { imports = [ ../../modules/programs/nixpkgs ]; @@ -23,8 +25,10 @@ in }; config = lib.mkIf cfg.enable (lib.mkMerge [ + # TODO: is this needed? (lib.mkIf pkgs.stdenv.isLinux { - # TODO: is this needed? + sops.secrets.sef-email-password = { }; + accounts.email = { maildirBasePath = "${config.home.homeDirectory}/mail"; @@ -71,7 +75,7 @@ in primary = true; realName = "***REMOVED***"; userName = poorObfuscation "sefidel.com" "contact"; - passwordCommand = "${pkgs.passage}/bin/passage show email/sef"; + passwordCommand = "${pkgs.coreutils}/bin/cat ${fixSopsPrefix 1000 config.sops.secrets.sef-email-password.path}"; }; }; @@ -265,13 +269,9 @@ in Service = { Type = "oneshot"; ExecStart = "${mbsyncCmd} -Va"; + After = [ "sops-nix.service" ]; RemainAfterExit = true; TimeoutStartSec = "5min"; - Environment = "PATH=${lib.makeBinPath [ - # passage dependencies - pkgs.util-linux - pkgs.coreutils - ]}"; }; Install.WantedBy = [ "default.target" ]; }; diff --git a/home/secrets/secrets.yaml b/home/secrets/secrets.yaml new file mode 100644 index 0000000..5149b59 --- /dev/null +++ b/home/secrets/secrets.yaml @@ -0,0 +1,30 @@ +sef-email-password: ENC[AES256_GCM,data:K1D+d8nly3POMLM1qHQPr0emF4qScEb1UjAyhaUd,iv:odkiOVPxckfsfcY5ZRuQ++L35kZ8cemnuRKWTUpjNWs=,tag:QwOs2oOxGTyy2kdIWyzSRA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1jt8xg0lvzj5q4f7fn7nw670qsszm3kv3caa654eh62azra4x44zss4fad8 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzN3lSWWs3c3Y1RmsxTk9u + NEpURnBUV204MUpmZEFwQnIySStLMUV2TmxRClZOUFRoc1g0LytSTTN3eUJkRlV2 + U0lkcFZEaWR3OHZqNDZFNWlFU0RVUVUKLS0tIHhONW9UMldKSVBIYk9UcGQxRnpZ + UDJVc1U0bllGMlA2eGJWL0ZWVWJVOFkKA0zG+7HcAeEUfINt9WpdHkxl+wl9bwOa + WGBGRJBJOIJv5GJs/rJCSgmZ1vLQBvqUpFiHs7XvKWGJPQh+Zn8SrQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1k585l9d34j77htwmzk79ms0wcfyltz5d3v87pnjkvrzru85vke4q2q0qjd + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzRFh0VVJKNHFyMmhvejJ2 + M3RBS3ZwZE5BdDBSbFBjOWpoRUl1TUUvNERJCmljSTdxUlVDQS95dUU5ZmV5Rm1n + MUpVcHI0MWFMVVQxMUFsNEkvRHltRG8KLS0tIFZtVmhLb0E4ZUg2R2V5dWhISFB1 + SDl5RTUvUXVSdmc0aEc0aFd2akdkY0UKJFEvPFe2xalBb5Y2fxSbCeB6vHf15OXw + LzSmm+8T7kvCUvJG+TEu1qOaR16RSWHSv/A9F4IfmE0V8YTRdgbgrQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2023-03-09T07:55:37Z" + mac: ENC[AES256_GCM,data:SzuAZEwRy/sziLdHJ+IpjUJRTY6FTv8l5lKWM/Ylhww58/VzoDvPGbcr6npV3uKPy/B+bUFkzrhtF+DnlD44o8aVGfwXOrVNT5+2mxzG3+u22ZYBDOQE/LB84EkV4/0XVJ8pZGBCTQlqI+rmoNdT1tzsdH4oh4bMZp+6+vLGGzU=,iv:WOpM7Rn0s9w+t0kLdSSmWU2EOOqdnylnmNxyYqyfMmk=,tag:3IQ2k0vIVnONSXvUQ0XALA==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.7.3 |