magic_rb/dotfiles
1
0
Fork 0
mirror of https://git.sr.ht/~magic_rb/dotfiles synced 2024-11-29 11:36:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Disable ephemeral secrets on omen

Browse source 
Signed-off-by: main <magic_rb@redalder.org>
This commit is contained in:
main 2022-03-12 23:11:52 +01:00
parent 0c9a601320
commit 71207bcad6
No known key found for this signature in database
GPG key ID: 08D5287CC5DDCA0E
1 changed files with 3 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
nix/hardware/omen.nix
View file

@ -39,18 +39,10 @@ in
fsType = "zfs";
};
"/var/lib/secrets" = mkIf config.services.vault-agent.enable
"/var/lib/secrets" =
{
device = "tmpfs";
fsType = "tmpfs";
options = [
"mode=0640"
"uid=${toString config.users.users.vault-agent.uid}"
"gid=${toString config.users.groups.root.gid}"
"noexec"
"rw"
"size=64M"
];
device = "omen-ssd/local/secrets";
fsType = "zfs";
};
"/home" =