From 516e0d27fe1343af7a122fe45457d714052ac6f4 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Wed, 29 Jul 2026 08:39:50 +0200 Subject: ... --- hosts/vidhar/network/dhcp/default.nix | 31 ++++++++------------------- hosts/vidhar/network/dhcp/knot-tsig | 22 +++++++++++++++++++ hosts/vidhar/network/dhcp/knot-tsig.json.frag | 26 ---------------------- 3 files changed, 31 insertions(+), 48 deletions(-) create mode 100644 hosts/vidhar/network/dhcp/knot-tsig delete mode 100644 hosts/vidhar/network/dhcp/knot-tsig.json.frag (limited to 'hosts/vidhar/network') diff --git a/hosts/vidhar/network/dhcp/default.nix b/hosts/vidhar/network/dhcp/default.nix index 557794e0..e4c3f16e 100644 --- a/hosts/vidhar/network/dhcp/default.nix +++ b/hosts/vidhar/network/dhcp/default.nix @@ -256,40 +256,27 @@ in { } ]; }; + tsig-keys = [ + { name = "local_key"; + algorithm = "HMAC-SHA256"; + secret-file = "/run/credentials/kea-dhcp-ddns-server.service/local_key"; + } + ]; }; }; }; systemd.services.kea-dhcp-ddns-server = { - preStart = let - configLines = [ - "" - ] ++ mapAttrsToList (k: v: - "\"${k}\": ${builtins.toJSON v}" - ) config.services.kea.dhcp-ddns.settings; - - config-template = pkgs.writeText "dhcp-ddns.conf" '' - {"DhcpDdns": { - ${concatStringsSep ",\n " configLines} - }} - ''; - in '' - ${pkgs.envsubst}/bin/envsubst -i "${config-template}" -o "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf" - ''; - serviceConfig = { - ExecStart = mkForce '' - ${pkgs.kea}/bin/kea-dhcp-ddns -c "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf" ${escapeShellArgs config.services.kea.dhcp-ddns.extraArgs} - ''; LoadCredential = [ - "knot-tsig.json.frag:${config.sops.secrets."kea-knot-tsig.json.frag".path}" + "local_key:${config.sops.secrets."kea-knot-tsig".path}" ]; }; }; - sops.secrets."kea-knot-tsig.json.frag" = { + sops.secrets."kea-knot-tsig" = { format = "binary"; - sopsFile = ./knot-tsig.json.frag; + sopsFile = ./knot-tsig; }; services.nginx.virtualHosts."nfsroot.vidhar.yggdrasil" = { diff --git a/hosts/vidhar/network/dhcp/knot-tsig b/hosts/vidhar/network/dhcp/knot-tsig new file mode 100644 index 00000000..73a8f11d --- /dev/null +++ b/hosts/vidhar/network/dhcp/knot-tsig @@ -0,0 +1,22 @@ +{ + "data": "ENC[AES256_GCM,data:ZjPqKfUCRYD4iD7yC7qObZhBAMll0DXNzImZ43TM0D8SXRtANqG6YnfwQuJ7,iv:GXD5LutgEz6ktGEtpI9z41IJLLzIMj6OvPADQlZcvwk=,tag:v9ISQFDubtLWcb2mVHa4zA==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYk5tM1lPRXc0MGpHZENQ\ndDU2M2VKY2t2VGFrcTUvd0NrU3VMZGQ3NHlNClNTaWVjdDNTQXh6WDFmMDk3SWtn\ncjJjRzUxODFFL25Ic0dabyt1ZW5xRE0KLS0tIDJlT0NTVDlXNWphQ1B0VTQ1U0NH\nNktRNlIrQzdhRjZ0SjR0T3oyRkZiWXMKX28S4SySQguT1cgMZpDY4o/OKY6IvjT9\n1oUzwx/BzBbC2JbpGYvQQgp/qfiM2k0oXmQlfdTv8kD/MoOqPO8E1Q==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l" + } + ], + "lastmodified": "2026-07-29T06:39:18Z", + "mac": "ENC[AES256_GCM,data:hj/YR0N8NhGHQEcCOjt/r+rfM8plkaUZoee9sI25evvEvOlfX69YRxUv1vyd6Sqd9wPEgCsF5STnMXFQhq3zgGjoTFcdHU+olRVmRq9rkYQo/ButZ/NEIQ7uc5b4FRPdPwOGF14aSpgI67F35oRavv1vtk10zGme+X0I1VXTIqE=,iv:rMUL+CyTLhQBJrsQJQPhN75FjCf5uGFh1z6KAXKDeB8=,tag:bpeQZ3UPZ10tCrgveoDklg==,type:str]", + "pgp": [ + { + "created_at": "2023-01-30T11:00:34Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAW2hoabFaeKDrI2eHwiIS9/StK+WxwPR3S8GEZmuHBFsw\nIJY/tRUsM7RWc50pQAAGtnlx0NoJksVv8K4bqzPHZ3pfBUxkNmXneKLE5qhxxIGL\n0l4BNd566uIhDhpvI0mLOeLePKO8d9aARXdwkuG9bohAfx2NyWSWqo7tdvfgWQAu\n05KLdefzKH3eC9XARIJSAAM90QH+tyojxoFIBSNgY17f1T3TNz2KtzERKHOKvemB\n=7+SI\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.13.2" + } +} diff --git a/hosts/vidhar/network/dhcp/knot-tsig.json.frag b/hosts/vidhar/network/dhcp/knot-tsig.json.frag deleted file mode 100644 index c10115cf..00000000 --- a/hosts/vidhar/network/dhcp/knot-tsig.json.frag +++ /dev/null @@ -1,26 +0,0 @@ -{ - "data": "ENC[AES256_GCM,data:cGcoqYZ341xQOFukDm4J5KDfG6+NaNbk2U2k4YGneRsAoPJZe/8KDmVr8TBWFCXXbuzeCGbiuXRVBmtYSEIqbqTN4u00RdQgpeL72cB3ZFd2c7cideEQV5z802pqFfXSlmLBC01OPG3TwAgk6xhQYSn5IcBTIL6fRF235Y9Q8k/X96rhfwPRVq84,iv:UoweWBcVuQIXeWFFl/WNUHLXG8nEri1UuTskC2I26hU=,tag:TJldVr2LDTmKA3ozZoX+cQ==,type:str]", - "sops": { - "kms": null, - "gcp_kms": null, - "azure_kv": null, - "hc_vault": null, - "age": [ - { - "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYk5tM1lPRXc0MGpHZENQ\ndDU2M2VKY2t2VGFrcTUvd0NrU3VMZGQ3NHlNClNTaWVjdDNTQXh6WDFmMDk3SWtn\ncjJjRzUxODFFL25Ic0dabyt1ZW5xRE0KLS0tIDJlT0NTVDlXNWphQ1B0VTQ1U0NH\nNktRNlIrQzdhRjZ0SjR0T3oyRkZiWXMKX28S4SySQguT1cgMZpDY4o/OKY6IvjT9\n1oUzwx/BzBbC2JbpGYvQQgp/qfiM2k0oXmQlfdTv8kD/MoOqPO8E1Q==\n-----END AGE ENCRYPTED FILE-----\n" - } - ], - "lastmodified": "2022-03-15T13:52:17Z", - "mac": "ENC[AES256_GCM,data:rTelaGx5S2E2oYPNGfctFbgDKdyRX8tpVTqLtpcCAJ8MS5ppFTjnSwYi4yQHvTicfAPNz7hGJYAnTdyC2QDTciJgkS6KC3CCXWCimkTybBdVW4Azwz9iBZCpWu+rB1vcQhSLlLCaKmKskkqDZZ5+mfuaXc+TT2uwTA0SDtZWvnM=,iv:ANCZ1fHy6w/svEE53o7rWsp5qU15qoriqyVMzClH6J0=,tag:H92RM5GuLIl9/kslq4tzkQ==,type:str]", - "pgp": [ - { - "created_at": "2023-01-30T11:00:34Z", - "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAW2hoabFaeKDrI2eHwiIS9/StK+WxwPR3S8GEZmuHBFsw\nIJY/tRUsM7RWc50pQAAGtnlx0NoJksVv8K4bqzPHZ3pfBUxkNmXneKLE5qhxxIGL\n0l4BNd566uIhDhpvI0mLOeLePKO8d9aARXdwkuG9bohAfx2NyWSWqo7tdvfgWQAu\n05KLdefzKH3eC9XARIJSAAM90QH+tyojxoFIBSNgY17f1T3TNz2KtzERKHOKvemB\n=7+SI\n-----END PGP MESSAGE-----\n", - "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" - } - ], - "unencrypted_suffix": "_unencrypted", - "version": "3.7.1" - } -} \ No newline at end of file -- cgit v1.2.3