palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions1

sops -> pass : cherry works (wip)

Browse source
This commit is contained in:
Ingolf Wagner 2024-05-31 21:02:22 +02:00
commit 529fa4ad6a
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
13 changed files with 60 additions and 151 deletions

2
nixos/components/gui/default.nix
View file

@ -13,7 +13,7 @@ with lib;
./fonts.nix
./home-manager
./kmonad.nix
./noti.nix
#./noti.nix
./pass.nix
./steam.nix
./suspend.nix

1
nixos/components/gui/noti.nix
View file

@ -1,4 +1,5 @@
# notify me when a command is finished
# todo : secret managment is shit
{ config, pkgs, lib, ... }:
with lib;
{

58
nixos/components/network/tinc/private.nix
View file

@ -58,12 +58,15 @@ in
{
networking.firewall.trustedInterfaces = [ "tinc.${network}" ];
sops.secrets.tinc_ed25519_key = { };
clanCore.facts.services.tinc_private = {
secret."tinc_private.ed25519_key" = { };
generator.script = "";
};
# nix-shell -p tinc_pre --run "tinc --config . generate-keys 4096"
services.tinc.networks = {
${network} = {
ed25519PrivateKeyFile = config.sops.secrets.tinc_ed25519_key.path;
ed25519PrivateKeyFile = config.clanCore.facts.services.tinc_private.secret."tinc_private.ed25519_key".path;
interfaceType = "tap";
extraConfig = ''
LocalDiscovery = yes
@ -127,55 +130,4 @@ in
networking.extraHosts = concatStringsSep "\n" (mapAttrsToList (name: ip: "${ip} ${name}.${network}") (hosts // subDomains));
services.openssh.knownHosts = {
"orbi" = {
hostNames = [
"orbi.${network}"
hosts.orbi
"orbi"
"95.216.66.212"
"git.ingolf-wagner.de"
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTqV5ch4BokqDniDgCquRwfTz6aXXMTdZovIvqShfLV";
};
"robi" = {
hostNames = [
"robi.${network}"
hosts.robi
"robi"
"144.76.13.147"
"taskd.ingolf-wagner.de"
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2PGX6cZuBUGX4VweMzi0aRh4uQ61yngCzZGcK3w5XV";
};
"sterni.${network}" = {
hostNames = [ "sterni.${network}" hosts.sterni ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQRH4gzT4vWSx3KN80ePPYhSPZRUae/qSyEym6pJTht";
};
"cream.${network}" = {
hostNames = [ "cream.${network}" hosts.cream ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIConHiCL7INgAhuN6Z9TqP0zP+xNpdV7+OHwUca4IRDD";
};
"cherry.${network}" = {
hostNames = [ "cherry.${network}" hosts.cream ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEUXkewyZ94A7CeCyVvN0KCqPn+8x1BZaGWMAojlfCXO";
};
"pepe.${network}" = {
hostNames = [ "pepe.${network}" hosts.pepe ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPlva+Vdj8WmQPlbQLN3qicMz5AAsyTzK53BincxtAz";
};
"chungus.${network}" = {
hostNames = [ "chungus.${network}" hosts.chungus ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP9jrbOJbgapreRjttyOKWv5vxGMThn7kAwlk8WnSyL9";
};
"bobi.${network}" = {
hostNames = [ "bobi.${network}" hosts.bobi ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0haepNVEaocfWh6kwVc4QsSg2iqO5k+hjarphBqMVk";
};
"mobi.${network}" = {
hostNames = [ "mobi.${network}" hosts.mobi ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE3G7TwCoxcVfwhGL0913RtacEeokqKtufhzzkCxpPxk";
};
};
}

1
nixos/homes/palo/default.nix
View file

@ -12,7 +12,6 @@
./stylix.nix
./taskwarrior.nix
./tmux.nix
./yubikey.nix
./zellij.nix
];

4
nixos/homes/palo/yubikey.nix
View file

@ -1,4 +0,0 @@
{ pkgs, osConfig, ... }:
{
pam.yubico.authorizedYubiKeys.path = toString osConfig.sops.secrets.yubikey_u2fAuthFile.path;
}

23
nixos/machines/cherry/configuration.nix
View file

@ -19,8 +19,25 @@
];
sops.secrets.pushover_user_key = { };
sops.secrets.pushover_api_key = { };
#clanCore.facts.services =
# let
# promptKey = key:
# {
# ${key} = {
# secret."${key}" = { };
# generator = {
# prompt = key;
# path = with pkgs; [ gnused ];
# script = ''
# echo "$prompt_value" | sed -n '1 p' > $secrets/${key}
# '';
# };
# };
# };
# in
# (promptKey "pushover.user_key") //
# (promptKey "pushover.api_key");
components.gui.enable = true;
components.mainUser.enable = true;
@ -36,8 +53,6 @@
#components.monitor.opentelemetry.exporter.debug = "logs";
sops.secrets.yubikey_u2fAuthFile = { };
home-manager.users.mainUser.home.sessionPath = [ "$HOME/.timewarrior/scripts" ];
home-manager.users.mainUser.bugwarrior.config = {
general = {

4
nixos/machines/cherry/syncthing.nix
View file

@ -1,7 +1,5 @@
{ config, pkgs, lib, ... }: {
#sops.secrets.syncthing_cert = { };
#sops.secrets.syncthing_key = { };
services.syncthing = {
enable = true;
@ -9,8 +7,6 @@
user = "palo";
dataDir = "/home/palo/.syncthing";
configDir = "/home/palo/.syncthing";
#cert = toString config.sops.secrets.syncthing_cert.path;
#key = toString config.sops.secrets.syncthing_key.path;
overrideFolders = true;
settings.folders = {

4
nixos/machines/cherry/tinc.nix
View file

@ -4,7 +4,7 @@
tinc.private.enable = true;
tinc.private.ipv4 = "10.23.42.29";
tinc.secret.enable = true;
tinc.secret.ipv4 = "10.123.42.29";
#tinc.secret.enable = true;
#tinc.secret.ipv4 = "10.123.42.29";
}

12
nixos/machines/cherry/wireguard.nix
View file

@ -1,7 +1,11 @@
{ config, ... }:
{
#networking.firewall.allowedUDPPorts = [ 51820 ];
sops.secrets.wireguard_private = { };
# todo generator here
clanCore.facts.services.wireguard = {
secret."wireguard.private" = { };
generator.script = "";
};
# Enable WireGuard
networking.wg-quick.interfaces = {
@ -10,12 +14,14 @@
wg0 = {
address = [ "10.100.0.7/32" ];
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
privateKeyFile = config.sops.secrets.wireguard_private.path;
privateKeyFile = config.clanCore.facts.services.wireguard.secret."wireguard.private".path;
mtu = 1280;
peers = [
{
# robi
# todo : use public facts here
publicKey = "uWR93xJe5oEbX3DsAYpOS9CuSg1VmXEQxJzdlJpe3DU=";
allowedIPs = [ "10.100.0.1/24" ];
#endpoint = "ingolf-wagner.de:51820";

17
nixos/machines/chungus/sync-syncoid.nix
View file

@ -1,9 +1,14 @@
{ config, ... }:
{
sops.secrets.syncoid_private_key = {
key = "rsync_private_key";
owner = config.services.syncoid.user;
clanCore.facts.services.syncoid = {
secret."syncoid.ssh.id_ed25519" = { };
public."syncoid.ssh.id_ed25519.pub" = { };
generator.path = with pkgs; [ coreutils openssh ];
generator.script = ''
ssh-keygen -t ed25519 -N "" -f $secrets/syncoid.ssh.id_ed25519
mv $secrets/ssh.id_ed25519.pub $facts/syncoid.ssh.id_ed25519.pub
'';
};
services.syncoid = {
@ -25,17 +30,17 @@
# remote
commands.matrix-terranix = {
sshKey = config.sops.secrets.syncoid_private_key.path;
sshKey = config.clanCore.facts.services.syncoid.secret."syncoid.ssh.id_ed25519".path;
source = "root@orbi:zroot/matrix-terranix";
target = "zraid/mirror/matrix-terranix"; # should not be created up front!
};
commands.nextcloud = {
sshKey = config.sops.secrets.syncoid_private_key.path;
sshKey = config.clanCore.facts.services.syncoid.secret."syncoid.ssh.id_ed25519".path;
source = "root@orbi:zroot/nextcloud";
target = "zraid/mirror/nextcloud"; # should not be created up front!
};
commands.photoprism = {
sshKey = config.sops.secrets.syncoid_private_key.path;
sshKey = config.clanCore.facts.services.syncoid.secret."syncoid.ssh.id_ed25519".path;
source = "root@orbi:zmedia/photoprism";
target = "zraid/mirror/photoprism"; # should not be created up front!
};

4
nixos/machines/cream/configuration.nix
View file

@ -43,10 +43,6 @@
components.monitor.opentelemetry.exporter.endpoint = "10.100.0.1:4317"; # orbi
components.monitor.exporters.zfs.enable = false;
sops.secrets.yubikey_u2fAuthFile = { };
home-manager.users.mainUser.home.sessionPath = [ "$HOME/.timewarrior/scripts" ];
home-manager.users.mainUser.bugwarrior.config = {
general = {