aboutsummaryrefslogtreecommitdiffstats
path: root/modules/security
diff options
context:
space:
mode:
Diffstat (limited to 'modules/security')
-rw-r--r--modules/security/gopass/default.nix78
-rw-r--r--modules/security/gopass/gopass-ssh-load.sh46
-rw-r--r--modules/security/gpg/default.nix61
-rw-r--r--modules/security/gpg/gpg-backup.sh149
-rw-r--r--modules/security/gpg/gpg-backup.zsh23
5 files changed, 315 insertions, 42 deletions
diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix
index d154226..4fefdd2 100644
--- a/modules/security/gopass/default.nix
+++ b/modules/security/gopass/default.nix
@@ -5,6 +5,32 @@
pkgs,
...
}:
+let
+ inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+
+ gopassKeys = config.security.ssh.gopassKeys;
+
+ gopassSshLoad = mkScriptModule {
+ scope = [
+ "security"
+ "gopass"
+ ];
+ name = "gopass-ssh-load";
+ path = ./gopass-ssh-load.sh;
+ description = "Load SSH keys from gopass password store";
+ env = {
+ GNUPGHOME = config.home.sessionVariables.GNUPGHOME;
+ GOPASS_SSH_KEYS = lib.concatStringsSep " " gopassKeys;
+ };
+ deps = with pkgs; [
+ config.security.gopass.package
+ gnupg
+ openssh
+ bash
+ ];
+ inherit config;
+ };
+in
{
options.security.gopass = {
enable = lib.mkEnableOption "Enables gopass.";
@@ -15,33 +41,37 @@
description = "The gopass package to use.";
};
ssh-agent.enable = lib.mkEnableOption "gopass-backed SSH keys for git";
- };
+ }
+ // gopassSshLoad.options.security.gopass;
- config = lib.mkIf config.security.gopass.enable {
- programs.password-store = {
- enable = true;
- package = pkgs.gopass.override { passAlias = true; };
- settings = {
- PASSWORD_STORE_DIR = "${config.home.homeDirectory}/.local/share/pass";
+ config = lib.mkMerge [
+ (lib.mkIf config.security.gopass.enable {
+ programs.password-store = {
+ enable = true;
+ package = pkgs.gopass.override { passAlias = true; };
+ settings = {
+ PASSWORD_STORE_DIR = "${config.home.homeDirectory}/.local/share/pass";
+ };
};
- };
- home.sessionVariables = {
- PASSWORD_STORE_DIR = config.programs.password-store.settings.PASSWORD_STORE_DIR;
- };
+ home.sessionVariables = {
+ PASSWORD_STORE_DIR = config.programs.password-store.settings.PASSWORD_STORE_DIR;
+ };
- home.file.".local/share/icons/hicolor/scalable/apps/gopass.svg" = {
- source = ../../../assets/icons/gopass.svg;
- };
+ home.file.".local/share/icons/hicolor/scalable/apps/gopass.svg" = {
+ source = ../../../assets/icons/gopass.svg;
+ };
- xdg.desktopEntries."gopass" = {
- name = "gopass";
- exec = "${lib.getExe config.terminal.kitty.package} --class gopass -e ${lib.getExe config.security.gopass.package}";
- icon = "gopass";
- comment = "Standard Unix password manager (Go implementation)";
- categories = [ "Utility" ];
- terminal = false;
- type = "Application";
- };
- };
+ xdg.desktopEntries."gopass" = {
+ name = "gopass";
+ exec = "${lib.getExe config.terminal.kitty.package} --class gopass -e ${lib.getExe config.security.gopass.package}";
+ icon = "gopass";
+ comment = "Standard Unix password manager (Go implementation)";
+ categories = [ "Utility" ];
+ terminal = false;
+ type = "Application";
+ };
+ })
+ gopassSshLoad.config
+ ];
}
diff --git a/modules/security/gopass/gopass-ssh-load.sh b/modules/security/gopass/gopass-ssh-load.sh
new file mode 100644
index 0000000..c6b9a29
--- /dev/null
+++ b/modules/security/gopass/gopass-ssh-load.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# Load SSH keys from gopass password store
+export GNUPGHOME="${GNUPGHOME:-$HOME/.local/share/gnupg}"
+
+SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
+export SSH_AUTH_SOCK
+if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then
+ echo "Error: SSH_AUTH_SOCK is not set or valid." >&2
+ exit 1
+fi
+
+if ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then
+ exit 0
+fi
+
+# GOPASS_SSH_KEYS holds a space-separated list of gopass entry names under ssh
+if [ -z "${GOPASS_SSH_KEYS:-}" ]; then
+ echo "Error: GOPASS_SSH_KEYS is not set. Example: GOPASS_SSH_KEYS=\"github gitlab\"" >&2
+ exit 1
+fi
+
+# shellcheck disable=SC2086
+read -r -a keys <<< "$GOPASS_SSH_KEYS"
+
+for key in "${keys[@]}"; do
+ if gopass cat "ssh/$key" > /dev/null 2>&1; then
+ tmpdir=$(mktemp -d)
+ keyfile="$tmpdir/key"
+ gopass cat "ssh/$key" > "$keyfile" 2>/dev/null
+ chmod 600 "$keyfile"
+
+ passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null || true)
+ if [ -n "$passphrase" ]; then
+ ssh-keygen -p -P "$passphrase" -N "" -f "$keyfile" 2>/dev/null
+ fi
+
+ ssh-add "$keyfile" 2>/dev/null
+ rm -rf "$tmpdir"
+ else
+ echo "Warning: no gopass entry ssh/$key" >&2
+ fi
+done
diff --git a/modules/security/gpg/default.nix b/modules/security/gpg/default.nix
index 472270b..07d9d4b 100644
--- a/modules/security/gpg/default.nix
+++ b/modules/security/gpg/default.nix
@@ -5,6 +5,27 @@
pkgs,
...
}:
+let
+ inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+ gpgBackup = mkScriptModule {
+ scope = [
+ "security"
+ "gpg"
+ ];
+ name = "gpg-backup";
+ path = ./gpg-backup.sh;
+ description = "Export/import all GPG keys as a single passphrase-protected file with maximum S2K iteration count\nUsage: gpg-backup export filename.gpg | gpg-backup import filename.gpg";
+ deps = [
+ pkgs.bash
+ pkgs.gnupg
+ pkgs.gnutar
+ pkgs.coreutils
+ pkgs.findutils
+ ];
+ completion.zsh = builtins.readFile ./gpg-backup.zsh;
+ inherit config;
+ };
+in
{
options.security.gpg = {
enable = lib.mkEnableOption "Enables gpg.";
@@ -16,25 +37,29 @@
defaultText = lib.literalExpression "config.programs.gpg.package";
description = "The gpg package to use.";
};
- };
+ }
+ // gpgBackup.options.security.gpg;
- config = lib.mkIf config.security.gpg.enable {
- programs.gpg = {
- enable = true;
- homedir = "${config.xdg.dataHome}/gnupg";
- };
+ config = lib.mkMerge [
+ (lib.mkIf config.security.gpg.enable {
+ programs.gpg = {
+ enable = true;
+ homedir = "${config.xdg.dataHome}/gnupg";
+ };
- home.sessionVariables = {
- GNUPGHOME = config.programs.gpg.homedir;
- };
+ home.sessionVariables = {
+ GNUPGHOME = config.programs.gpg.homedir;
+ };
- services.gpg-agent = {
- enable = true;
- enableZshIntegration = true;
- defaultCacheTtl = 3600;
- maxCacheTtl = 86400;
- enableSshSupport = config.security.ssh.enable;
- pinentry.package = pkgs.pinentry-rofi;
- };
- };
+ services.gpg-agent = {
+ enable = true;
+ enableZshIntegration = true;
+ defaultCacheTtl = 3600;
+ maxCacheTtl = 86400;
+ enableSshSupport = config.security.ssh.enable;
+ pinentry.package = pkgs.pinentry-rofi;
+ };
+ })
+ gpgBackup.config
+ ];
}
diff --git a/modules/security/gpg/gpg-backup.sh b/modules/security/gpg/gpg-backup.sh
new file mode 100644
index 0000000..57c216b
--- /dev/null
+++ b/modules/security/gpg/gpg-backup.sh
@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+WORKDIR="$(mktemp -d)"
+
+cleanup() {
+ if [[ -d "$WORKDIR" ]]; then
+ find "$WORKDIR" -type f -exec shred -u -z {} \; 2>/dev/null || true
+ rm -rf "$WORKDIR"
+ fi
+}
+trap cleanup EXIT
+
+usage() {
+ echo "Usage:"
+ echo " $0 export <filename> Export all GPG keys to an encrypted file"
+ echo " $0 import <filename> Decrypt and import keys from a backup file"
+ exit 1
+}
+
+do_export() {
+ local outfile="$1"
+
+ if [[ -e "$outfile" ]]; then
+ echo "!! Refusing to overwrite existing file: $outfile" >&2
+ exit 1
+ fi
+
+ echo "==> Exporting public keys..."
+ gpg --export --armor > "$WORKDIR/public-keys.asc"
+
+ echo "==> Exporting secret keys..."
+ gpg --export-secret-keys --armor > "$WORKDIR/secret-keys.asc"
+
+ echo "==> Exporting secret subkeys (if any)..."
+ gpg --export-secret-subkeys --armor > "$WORKDIR/secret-subkeys.asc" || true
+
+ echo "==> Exporting owner trust database..."
+ gpg --export-ownertrust > "$WORKDIR/ownertrust.txt"
+
+ echo "==> Exporting revocation certificates..."
+ mkdir -p "$WORKDIR/revocation-certs"
+ if [[ -d "$HOME/.gnupg/openpgp-revocs.d" ]]; then
+ cp "$HOME"/.gnupg/openpgp-revocs.d/*.rev "$WORKDIR/revocation-certs/" 2>/dev/null || true
+ fi
+
+ echo "==> Bundling everything into a single archive..."
+ tar -C "$WORKDIR" -cf "$WORKDIR/gpg-full-backup.tar" \
+ public-keys.asc \
+ secret-keys.asc \
+ secret-subkeys.asc \
+ ownertrust.txt \
+ revocation-certs
+
+ echo "==> Encrypting with GPG (AES256, SHA512, max S2K iteration count)..."
+ echo " You will be prompted for a passphrase — use a strong one."
+ gpg --symmetric \
+ --cipher-algo AES256 \
+ --digest-algo SHA512 \
+ --s2k-mode 3 \
+ --s2k-digest-algo SHA512 \
+ --s2k-count 65011712 \
+ --output "$outfile" \
+ "$WORKDIR/gpg-full-backup.tar"
+
+ echo "==> Verifying: attempting decryption to confirm it works..."
+ if gpg --decrypt "$outfile" > "$WORKDIR/verify.tar" 2>/dev/null; then
+ if cmp -s "$WORKDIR/gpg-full-backup.tar" "$WORKDIR/verify.tar"; then
+ echo "==> Verification succeeded: backup decrypts correctly."
+ else
+ echo "!! WARNING: decrypted content does not match original. Investigate before trusting this backup." >&2
+ exit 1
+ fi
+ else
+ echo "!! WARNING: decryption test failed." >&2
+ exit 1
+ fi
+
+ echo
+ echo "==> Done."
+ echo " Encrypted backup: $outfile"
+ echo " Store this file somewhere safe (offline media, encrypted drive)."
+ echo " The S2K iteration count only helps if your passphrase itself"
+ echo " has real entropy (e.g. a long diceware passphrase)."
+}
+
+do_import() {
+ local infile="$1"
+
+ if [[ ! -f "$infile" ]]; then
+ echo "!! File not found: $infile" >&2
+ exit 1
+ fi
+
+ echo "==> Decrypting $infile ..."
+ echo " You will be prompted for the backup's passphrase."
+ echo " Note: this may take a while due to the high S2K iteration count."
+ gpg --decrypt "$infile" > "$WORKDIR/gpg-full-backup.tar"
+
+ echo "==> Extracting archive..."
+ tar -C "$WORKDIR" -xf "$WORKDIR/gpg-full-backup.tar"
+
+ echo "==> Importing public keys..."
+ gpg --import "$WORKDIR/public-keys.asc"
+
+ echo "==> Importing secret keys..."
+ gpg --import "$WORKDIR/secret-keys.asc"
+
+ if [[ -s "$WORKDIR/secret-subkeys.asc" ]]; then
+ echo "==> Importing secret subkeys..."
+ gpg --import "$WORKDIR/secret-subkeys.asc" || true
+ fi
+
+ if [[ -f "$WORKDIR/ownertrust.txt" ]]; then
+ echo "==> Importing owner trust database..."
+ gpg --import-ownertrust "$WORKDIR/ownertrust.txt"
+ fi
+
+ if [[ -d "$WORKDIR/revocation-certs" ]] && [[ -n "$(ls -A "$WORKDIR/revocation-certs" 2>/dev/null)" ]]; then
+ echo "==> Restoring revocation certificates..."
+ mkdir -p "$HOME/.gnupg/openpgp-revocs.d"
+ cp "$WORKDIR"/revocation-certs/*.rev "$HOME/.gnupg/openpgp-revocs.d/" 2>/dev/null || true
+ fi
+
+ echo
+ echo "==> Done. Keys imported into your GPG keyring."
+ echo " Run 'gpg --list-secret-keys' to confirm."
+}
+
+# Main
+
+if [[ $# -ne 2 ]]; then
+ usage
+fi
+
+command="$1"
+filename="$2"
+
+case "$command" in
+ export)
+ do_export "$filename"
+ ;;
+ import)
+ do_import "$filename"
+ ;;
+ *)
+ usage
+ ;;
+esac
diff --git a/modules/security/gpg/gpg-backup.zsh b/modules/security/gpg/gpg-backup.zsh
new file mode 100644
index 0000000..f47bbe8
--- /dev/null
+++ b/modules/security/gpg/gpg-backup.zsh
@@ -0,0 +1,23 @@
+#compdef gpg-backup
+
+_arguments \
+ '1: :->cmds' \
+ '*::arg:->args'
+
+case $state in
+ cmds)
+ local -a commands
+ commands=(
+ 'export:Export all GPG keys to a passphrase-protected file'
+ 'import:Import GPG keys from a backup file'
+ )
+ _describe 'command' commands
+ ;;
+ args)
+ case $words[1] in
+ export|import)
+ _files
+ ;;
+ esac
+ ;;
+esac
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-11 01:42:40 +0000