mjallen/nix-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fixes and docs

Browse Source
This commit is contained in:
mjallen18
2026-03-23 15:17:10 -05:00
parent 2c0b26ced0
commit 23f29b6ca1
25 changed files with 1590 additions and 795 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
modules/nixos/services/nebula/sops.nix
View File

@@ -7,39 +7,34 @@
with lib;
let
cfg = config.${namespace}.services.nebula;
sopsFile = cfg.secretsFile;
nebulaUser = "nebula-${cfg.networkName}";
nebulaUnit = "nebula@${cfg.networkName}.service";
mkSecret = _key: {
inherit sopsFile;
owner = nebulaUser;
group = nebulaUser;
restartUnits = [ nebulaUnit ];
};
in
{
config = mkIf cfg.enable {
sops = {
secrets = {
"jallen-nas/nebula/ca-cert" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = "nebula-jallen-nebula";
group = "nebula-jallen-nebula";
restartUnits = [ "nebula@jallen-nebula.service" ];
};
assertions = [
{
assertion = cfg.secretsPrefix != "";
message = "mjallen.services.nebula.secretsPrefix must be set (e.g. \"pi5/nebula\")";
}
{
assertion = cfg.secretsFile != "";
message = "mjallen.services.nebula.secretsFile must be set to the path of the SOPS secrets YAML";
}
];
"jallen-nas/nebula/ca-key" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = "nebula-jallen-nebula";
group = "nebula-jallen-nebula";
restartUnits = [ "nebula@jallen-nebula.service" ];
};
"jallen-nas/nebula/nas-cert" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = "nebula-jallen-nebula";
group = "nebula-jallen-nebula";
restartUnits = [ "nebula@jallen-nebula.service" ];
};
"jallen-nas/nebula/nas-key" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = "nebula-jallen-nebula";
group = "nebula-jallen-nebula";
restartUnits = [ "nebula@jallen-nebula.service" ];
};
};
sops.secrets = {
"${cfg.secretsPrefix}/ca-cert" = mkSecret "ca-cert";
"${cfg.secretsPrefix}/${cfg.hostSecretName}-cert" = mkSecret "host-cert";
"${cfg.secretsPrefix}/${cfg.hostSecretName}-key" = mkSecret "host-key";
};
};
}