document sops deployment

README.md

@@ -279,16 +279,58 @@ Example host configuration:
 
 ```nix
 {
-  inputs.rabbi-gerzi.url = "git+ssh://git@example.com/rabbi-gerzi.git";
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    rabbi-gerzi.url = "git+ssh://git@example.com/rabbi-gerzi.git";
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs =
-    { nixpkgs, rabbi-gerzi, ... }:
+    {
+      nixpkgs,
+      rabbi-gerzi,
+      sops-nix,
+      ...
+    }:
     {
       nixosConfigurations.rabbigerzi = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [
           rabbi-gerzi.nixosModules.default
+          sops-nix.nixosModules.sops
+          (
+            { config, ... }:
+            let
+              appKey = config.sops.placeholder."app-key";
+              initialAdminEmail =
+                config.sops.placeholder."admin-email";
+              initialAdminPassword =
+                config.sops.placeholder."admin-password";
+            in
             {
+              sops = {
+                defaultSopsFile = ./secrets/rabbi-gerzi.yaml;
+                age.sshKeyPaths = [
+                  "/etc/ssh/ssh_host_ed25519_key"
+                ];
+
+                secrets = {
+                  "app-key" = { };
+                  "admin-email" = { };
+                  "admin-password" = { };
+                };
+
+                templates."rabbi-gerzi.env".content = ''
+                  APP_KEY=${appKey}
+                  RABBI_GERZI_INITIAL_ADMIN_EMAIL=${initialAdminEmail}
+                  RABBI_GERZI_INITIAL_ADMIN_PASSWORD=${initialAdminPassword}
+                '';
+              };
+
               services.rabbi-gerzi = {
                 enable = true;
 
@@ -296,10 +338,12 @@ Example host configuration:
 
                 backend = {
                   hostName = "api.rabbigerzi.com";
-                environmentFile = "/run/secrets/rabbi-gerzi.env";
+                  environmentFile =
+                    config.sops.templates."rabbi-gerzi.env".path;
                 };
               };
             }
+          )
         ];
       };
     };
@@ -313,14 +357,25 @@ services.rabbi-gerzi.frontend.apiBaseUrl =
   "https://api.rabbigerzi.com";
 ```
 
-Create the production environment file on the server:
+Configure `.sops.yaml` with age recipients for each administrator and the
+server's SSH Ed25519 host key. Then create the encrypted secrets file:
 
-```dotenv
-APP_KEY=base64:replace-with-laravel-app-key
-RABBI_GERZI_INITIAL_ADMIN_EMAIL=admin@example.com
-RABBI_GERZI_INITIAL_ADMIN_PASSWORD=replace-with-a-long-random-password
+```sh
+sops secrets/rabbi-gerzi.yaml
 ```
 
+Add these values in the editor opened by `sops`:
+
+```yaml
+app-key: base64:replace-with-laravel-app-key
+admin-email: admin@example.com
+admin-password: replace-with-a-long-random-password
+```
+
+Commit only the encrypted file written by `sops`. At activation time,
+`sops-nix` decrypts these values and renders the runtime environment file
+outside the Nix store.
+
 Then rebuild the host with the deployment method used by the server, for
 example: