nixos-config/servers/hetzner/secrets

Secrets

This directory contains encrypted secrets managed with sops-nix.

Setup

1. Generate an age key on the target machine:

   mkdir -p /etc/age
   age-keygen -o /etc/age/keys.txt
   

2. Add the public key to .sops.yaml

3. Create/edit secrets:

   sops secrets/mail-accounts.yaml
   sops secrets/env.yaml
   

Files

• env.yaml - Environment variables (WG_HOST, PASSWORD_HASH, etc.)
• mail-accounts.yaml - Mail server account credentials
• wireguard-keys.yaml - WireGuard private keys
• ssh-keys.yaml - SSH private keys (mail.private, etc.)