palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

migrate some secrets from sops to clan facts

Browse source
This commit is contained in:
Ingolf Wagner 2024-06-03 10:36:52 +02:00
parent 80723667ce
commit e4bb865b3d
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
5 changed files with 14 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
nixos/homes/tina/stylix.nix
View file

@ -5,7 +5,6 @@
stylix.base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-light-medium.yaml"; stylix.base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-light-medium.yaml";
stylix.fonts = { stylix.fonts = {
serif = { serif = {
package = pkgs.ubuntu_font_family; package = pkgs.ubuntu_font_family;

7
nixos/machines/chungus/network-wireguard.nix
View file

@ -1,9 +1,8 @@
{ pkgs, config, ... }: { pkgs, config, ... }:
{ {
# networking.firewall.trustedInterfaces = [ "wg0" ];
networking.firewall.allowedUDPPorts = [ 51820 ]; networking.firewall.allowedUDPPorts = [ 51820 ];
sops.secrets.wireguard_private = { };
#boot.kernel.sysctl."net.ipv4.ip_forward" = true; clanCore.facts.services.wireguard = factsGenerator.wireguard { name = "wg0"; };
# Enable WireGuard # Enable WireGuard
networking.wg-quick.interfaces = { networking.wg-quick.interfaces = {
@ -12,7 +11,7 @@
wg0 = { wg0 = {
address = [ "10.100.0.2/32" ]; address = [ "10.100.0.2/32" ];
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers) listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
privateKeyFile = config.sops.secrets.wireguard_private.path; privateKeyFile = config.clanCore.facts.services.wireguard.secret."wireguard.wg0.key".path;
mtu = 1280; mtu = 1280;
# server # server

4
nixos/machines/cream/wireguard.nix
View file

@ -1,7 +1,7 @@
{ config, ... }: { config, ... }:
{ {
networking.firewall.allowedUDPPorts = [ 51820 ]; networking.firewall.allowedUDPPorts = [ 51820 ];
sops.secrets.wireguard_private = { }; clanCore.facts.services.wireguard = factsGenerator.wireguard { name = "wg0"; };
# Enable WireGuard # Enable WireGuard
networking.wg-quick.interfaces = { networking.wg-quick.interfaces = {
@ -10,7 +10,7 @@
wg0 = { wg0 = {
address = [ "10.100.0.6/32" ]; address = [ "10.100.0.6/32" ];
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers) listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
privateKeyFile = config.sops.secrets.wireguard_private.path; privateKeyFile = config.clanCore.facts.services.wireguard.secret."wireguard.wg0.key".path;
mtu = 1280; mtu = 1280;
peers = [ peers = [

4
nixos/machines/orbi/network-wireguard.nix
View file

@ -1,7 +1,7 @@
{ pkgs, config, ... }: { pkgs, config, ... }:
{ {
networking.firewall.allowedUDPPorts = [ 51820 ]; networking.firewall.allowedUDPPorts = [ 51820 ];
sops.secrets.wireguard_private = { }; clanCore.facts.services.wireguard = factsGenerator.wireguard { name = "wg0"; };
boot.kernel.sysctl."net.ipv4.ip_forward" = true; boot.kernel.sysctl."net.ipv4.ip_forward" = true;
# Enable WireGuard # Enable WireGuard
@ -11,7 +11,7 @@
wg0 = { wg0 = {
address = [ "10.100.0.1/32" ]; address = [ "10.100.0.1/32" ];
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers) listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
privateKeyFile = config.sops.secrets.wireguard_private.path; privateKeyFile = config.clanCore.facts.services.wireguard.secret."wireguard.wg0.key".path;
mtu = 1280; mtu = 1280;
postUp = '' postUp = ''

10
nixos/machines/orbi/social-matrix-terranix.nix
View file

@ -11,13 +11,16 @@ let
synapse_port = 8008; synapse_port = 8008;
federation_port = 8448; federation_port = 8448;
shared_secret = config.clanCore.facts.services.matrix_terranix.secret."matrix-synapse.terranix.registration_shared_secret.yml";
matrix_create_user = pkgs.writers.writeBashBin "matrix-create-user-${name}" '' matrix_create_user = pkgs.writers.writeBashBin "matrix-create-user-${name}" ''
${pkgs.matrix-synapse}/bin/register_new_matrix_user \ ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
-k $( ${pkgs.gojq}/bin/gojq \ -k $( ${pkgs.gojq}/bin/gojq \
--yaml-input \ --yaml-input \
--raw-output \ --raw-output \
'.registration_shared_secret' \ '.registration_shared_secret' \
${config.sops.secrets.matrix_shared_secret.path} ) \ ${shared_secret.path} ) \
http://localhost:${toString synapse_port} http://localhost:${toString synapse_port}
''; '';
@ -46,9 +49,10 @@ in
networking.firewall.allowedTCPPorts = [ 80 443 federation_port ]; networking.firewall.allowedTCPPorts = [ 80 443 federation_port ];
networking.firewall.allowedUDPPorts = [ 80 443 federation_port ]; networking.firewall.allowedUDPPorts = [ 80 443 federation_port ];
clanCore.facts.services.matrix_terranix = factsGenerator.matrix-synapse { name = "terranix"; };
environment.systemPackages = [ matrix_create_user ]; environment.systemPackages = [ matrix_create_user ];
sops.secrets.matrix_shared_secret.owner = "matrix-synapse";
users.users.matrix-synapse = { users.users.matrix-synapse = {
isSystemUser = true; isSystemUser = true;
uid = config.ids.uids.matrix-synapse; uid = config.ids.uids.matrix-synapse;
@ -62,7 +66,7 @@ in
bindMounts = { bindMounts = {
rootpassword = { rootpassword = {
hostPath = config.sops.secrets.matrix_shared_secret.path; hostPath = shared_secret.path;
mountPoint = "/run/secrets/matrix-shared-secret"; mountPoint = "/run/secrets/matrix-shared-secret";
isReadOnly = true; isReadOnly = true;
}; };