secrets: add sso

secrets/default.nix

@@ -58,6 +58,8 @@ throwOnCanary {
 
     podgrab.password = fileContents ./podgrab/password.txt;
 
+    sso = import ./sso { inherit lib; };
+
     transmission.password = fileContents ./transmission/password.txt;
 
     users = {

secrets/sso/.gitattributes

@@ -0,0 +1 @@
+/default.nix filter diff

secrets/sso/default.nix

@@ -0,0 +1,21 @@
+{ lib }:
+let
+  inherit (lib) fileContents;
+  importUser = (user: {
+    # bcrypt hashed: `htpasswd -BnC 10 ""`
+    passwordHash = fileContents (./. + "/${user}/password-hash.txt");
+    # base32 encoded: `printf '<secret>' | base32  | tr -d =`
+    totpSecret = fileContents (./. + "/${user}/totp-secret.txt");
+  });
+in
+{
+  auth_key = fileContents ./auth-key.txt;
+
+  users = lib.flip lib.genAttrs importUser [
+    "ambroisie"
+  ];
+
+  groups = {
+    root = [ "ambroisie" ];
+  };
+}