EH22/nox
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update documentation regarding ccchh-pass age key

Browse source
This commit is contained in:
lilly 2025-02-23 11:42:19 +01:00
parent 17d6a03bd5
commit 05fbd7183c
Signed by: lilly
SSH key fingerprint: SHA256:y9T5GFw2A20WVklhetIxG1+kcg/Ce0shnQmbu1LQ37g
1 changed files with 16 additions and 2 deletions

18
README.md
View file

@ -24,11 +24,23 @@ Please also keep our [Service & Responsibility Page](https://eh22.easterhegg.eu/
This repository contains a sops configuration that is used for password encryption as well as secret management for our nix machines. This repository contains a sops configuration that is used for password encryption as well as secret management for our nix machines.
### Using CCCHH Password-Store Key
For convenience, a sops key has been added to the [CCCHH Password-Store](https://git.hamburg.ccc.de/CCCHH/password-store) which is able to encrypt all secrets of this repository.
Sops can be told to use it like this:
```bash
export SOPS_AGE_KEY=$(pass noc/events/eh22/nox-sops-key)
```
If you don't have access to that, ask someone (@lilly for example) to authorize your personal key.
### Passwords ### Passwords
All relevant passwords should be stored in `secrets/passwords.yaml` which is a plain yaml document with no strict schema but which is sops encrypted. All relevant passwords should be stored in `secrets/passwords.yaml` which is a plain yaml document with no strict schema but which is sops encrypted.
It should contain all relevant passwords, a NOC admin needs. It should contain all relevant passwords, a NOC admin needs.
#### Accessing Passwords #### Accessing Passwords
```bash ```bash
@ -48,10 +60,12 @@ I (Lilly) personally prefer age since it skips all the openpgp cli weirdness and
Adding a new age key works like this: Adding a new age key works like this:
1. `vim .sops.yaml` and enter the new key (preferably as a yaml anchor) under `keys` as well as the `creation_rule` for the passwords file. 1. Run `age-keygen -o ~/.config/sops/age/keys.txt` and copy the public key from the generated file.
2. Edit [.sops.yaml](./.sops.yaml) and enter the new key (preferably as a yaml anchor) under `keys` as well as the `creation_rule` for the passwords file.
Look at the existing file content and you'll figure it out. Look at the existing file content and you'll figure it out.
2. `sops updatekeys secrets/passwords.yaml` to reencrypt the password file with the newly added key.
3. Commit and push changes. 3. Commit and push changes.
4. Ask someone with existing access to run `sops updatekeys secrets/passwords.yaml` to reencrypt the password file with the newly added key.
They should, of course, also commit and push the changes.
### Machine-Secrets ### Machine-Secrets