feat: add encrypted storagebox

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>

hosts/hosting-02/default.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 {
   imports = [
     ./disk-config.nix
@@ -87,11 +87,58 @@
     };
   };
 
+  environment.systemPackages = with pkgs; [
+    gocryptfs
+    sshfs
+  ];
+
+  programs.ssh.knownHosts.storageBox = {
+    hostNames = [ "u491729.your-storagebox.de" ];
+    publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
+  };
+
+  fileSystems."/mnt/box" = {
+    device = "u491729@u491729.your-storagebox.de:/home";
+    fsType = "fuse.sshfs";
+    options = [
+      "defaults"
+      "_netdev"
+      "allow_other"
+      "default_permissions"
+      "port=23"
+      "compression=no"
+      "reconnect"
+      "ServerAliveInterval=15"
+      "IdentityFile=${config.sops.secrets.storageboxKey.path}"
+    ];
+  };
+
+  fileSystems."/data" = {
+    depends = [
+      "/mnt/box"
+    ];
+    device = "/mnt/box/crypt";
+    fsType = "fuse.gocryptfs";
+    options = [
+      "rw"
+      "allow_other"
+      "passfile=${config.sops.secrets.storageboxCryptKey.path}"
+    ];
+  };
+
   sops.secrets = {
     wireguardKey = {
       owner = "root";
       sopsFile = ./secrets.yaml;
     };
+    storageboxKey = {
+      owner = "root";
+      sopsFile = ./secrets.yaml;
+    };
+    storageboxCryptKey = {
+      owner = "root";
+      sopsFile = ./secrets.yaml;
+    };
   };
 
   security.acme.defaults.email = "landervandenbulcke@gmail.com";

hosts/hosting-02/secrets.yaml

@@ -1,4 +1,6 @@
 wireguardKey: ENC[AES256_GCM,data:0xzdESyIvaMzDe1W7GOddxCmDeQf246m8mfcPVxNRX6jPu222GXSwSywPgU=,iv:5GvluPofwd4SkQWJo7KKen7x0ZkAu5idl6xcyVxdbvQ=,tag:HtzLtergC3wrYFXIeA37PQ==,type:str]
+storageboxKey: ENC[AES256_GCM,data:iPqksX0X1FrRgjNkgXiAJjsjEXdOxItHOxCBINsb2+d86INm/KOEyAulXudrnw8s9HF8wxrcLAqxQt1XHzoPYif9sM9jw5lo5f5qKx0QoYQNgxD935eww+WpBJ8HtcgwWYYAN2dbcbUFI6id7QNEaJr4bHjTZ03FkZ0nLRZokoln7nKV9+GeEUbfhlLYwicUY/V1pSLvBrX/htc9jtVJWpLS+mOlDY88oyqvSd4+UFgYT9FjXOU6g/5iIiS2p9FrbRFmrPs3lTlFbLwMb/l6qv4X3ApTjYUNV8C5wnBwQM1i2X8Hixe+raGTcwr+ivkYP5I3MBnvYDSmXtrc63/Lfd4zdBj50r1qus8Z50jXNJD3LkbFtkYuIFNcBZKl6dnnHi7L4u9rmLMhDeFV6dcuHsqethwx5x6kfUkXDNjfavTgGsYMFf6W4pt28EjepzP7vwA6BYMI4mseRO4uszwBJXmc2HDOs5tGRiGfcfzn6JsCe+ipDcsubBk7xWbi20sBF5Fsbje22s6Oss99SoEm,iv:toi832UgHmdoEUTowb/2oAxbioLVxNjBAyC1KcsBPI8=,tag:siNnRQyKeXBcC6Ln8P30Dg==,type:str]
+storageboxCryptKey: ENC[AES256_GCM,data:48M3TXFgBnR82K67xfmOk/3CierDXo4WNg==,iv:S+LRyixH/Uaurr51j3UnFPMWAwR2S5dI7Ei+NcmSOeI=,tag:Rv/shtQ9zsp7tCs6f4jBAg==,type:str]
 sops:
     age:
         - recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
@@ -10,8 +12,8 @@ sops:
             eFdmOHNGSlNFckg2emltYU5yWHB2UVkKs5B0CG13bfsJL1mVCUcm8JlFVw4pfqMT
             QGl5LOw06WBIOSrmYn5s98scIkiKvLsqQ+OjbyM0RwB0sGYaz3D0Rg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-09T22:57:11Z"
-    mac: ENC[AES256_GCM,data:ankF+V1K+2uG40TI78CphUES+5FCrRJN+7gZLWmLxvvI2xvcsmT30RvkuOOLFuQWzHM/5M8mClZhTpKXFuvxDTPesTwZ75lVbAoL0LCK940bChJX6/rQyow2OG6koDGRj9TUsj+phe5xUxvkb4ysKP7u4NgUbaXXCmj5T408pqI=,iv:Mm7DXuSn6RBI6xKV1qEc3f5wMDlrnT2epV8exGoCfa0=,tag:8LajuOiQHeUVaJx5UIOong==,type:str]
+    lastmodified: "2025-09-11T20:17:19Z"
+    mac: ENC[AES256_GCM,data:wY7twUe+K84BbGGdYf30Zt4lR9FHBjtwHVhebvpdjVw2qL0g3uEOv0ntfZ3oqiibcsBTJWa7MvIDYYTJq6OUhTNH2DiGOaOI2tC4wck0aaQiJJQ19ZmiPqMSLlY0UpFvHJfAcfgcZiZnBWg+QhWA+CeDeKSAb74GHthdqWFOOTg=,iv:WbkD7PqSqnkCawdoF85XzB82jsRv02QGHb+7AjUTBxI=,tag:eEOvjEPRR5nfzrL3+PsTAg==,type:str]
     pgp:
         - created_at: "2025-09-09T22:56:42Z"
           enc: |-