Skip to content

Set up a host's TPM identity

  1. On the host, as root, generate the identity:
install -d -m 700 /var/lib/sops-nix
nix shell nixpkgs#age-plugin-tpm -c age-plugin-tpm --generate -o /var/lib/sops-nix/key.txt
  1. From the repo, save the host's recipient:
mkdir -p keys/hosts/<host>
ssh root@<host>.lan.cmu.edu 'nix shell nixpkgs#age-plugin-tpm -c age-plugin-tpm -y /var/lib/sops-nix/key.txt' > keys/hosts/<host>/age.pub
  1. In the devenv shell, re-encrypt each existing secrets file to the new recipient list:
sops updatekeys secrets/<file>.yaml
  1. Commit and deploy the host.