Secrets (agenix)

Encrypted secrets for the fleet, managed with agenix.

Each secret is an age-encrypted file (*.age) encrypted to a set of recipient public keys declared in secrets.nix. A host decrypts its secrets at activation using its SSH host key (/etc/ssh/ssh_host_ed25519_key), so every host that must read a secret has to be listed as a recipient for it.

secrets.nix is read only by the agenix CLI. It is never imported into the NixOS evaluation.

Secrets in this repo

File	Purpose	Recipients
`ldap-bind.age`	SSSD → Authentik LDAP bind credential, as an `sssd.conf` drop-in snippet	all SSSD-enabled hosts (not EDaaS)

Consumed by modules/sssd.nix via age.secrets.ldap-bind.path, which places the decrypted snippet at /etc/sssd/conf.d/01-ldap-authtok.conf.

ldap-bind.age is not committed yet. Only ldap-bind.age.PLACEHOLDER ships in this change (real host recipient keys and the real password were not available when it was written). Follow the steps below to create the real secret, then delete the .PLACEHOLDER.

Owner setup checklist

Run these once (per new host or when the bind password rotates):

1. Collect host recipient keys

On each SSSD-enabled host (all Linux hosts except EDaaS):

cat /etc/ssh/ssh_host_ed25519_key.pub

Paste each value into the matching placeholder in secrets.nix, replacing the AAAA_PLACEHOLDER_REPLACE_ME_* strings. (Optionally uncomment and set admin to an operator user key so the secret can be edited off-host.)

2. Encrypt the bind password

The plaintext must be a full sssd.conf drop-in snippet, because SSSD cannot read ldap_default_authtok from a separate file — it only merges conf.d/*.conf. The content is exactly:

[domain/default]
ldap_default_authtok = <the sssd-bind service-account password>

Use the password of the sssd-bind (Terraform: sssd-bind) Authentik LDAP service account. Then, from the repo root:

# Requires the agenix CLI: `nix run github:ryantm/agenix -- -e secrets/ldap-bind.age`
cd secrets
agenix -e ldap-bind.age

An $EDITOR opens; paste the two-line snippet above, save, quit. agenix writes the encrypted ldap-bind.age. Commit it and delete ldap-bind.age.PLACEHOLDER.

3. Rekey after changing recipients

If you add/remove hosts in secrets.nix, re-encrypt every secret to the new recipient set:

cd secrets
agenix -r

4. DNS

ldap.lyrapup.pet must resolve to the Authentik LDAP outpost and serve LDAPS on port 636 with a certificate the hosts trust (ldap_tls_reqcert = demand). If the cert is not from a system-trusted CA, add it to the hosts' trust store (security.pki.certificateFiles) or relax ldap_tls_reqcert in modules/sssd.nix.

5. Rebuild

sudo nixos-rebuild switch --flake .#<host>

Verify with getent passwd <ldap-user> and id <ldap-user>.

3.1 KiB Raw Blame History