mjallen/nix-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

nas sops

Browse Source
This commit is contained in:
mjallen18
2025-08-25 19:32:59 -05:00
parent 5749de77a9
commit 81e78a6809
2 changed files with 46 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
modules/nixos/traefik/default.nix
View File

@@ -68,14 +68,23 @@ in
sops = {
secrets = {
"jallen-nas/traefik/crowdsec-lapi-key" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
};
"jallen-nas/traefik/cloudflare-dns-api-token" = { };
"jallen-nas/traefik/cloudflare-zone-api-token" = { };
"jallen-nas/traefik/cloudflare-api-key" = { };
"jallen-nas/traefik/cloudflare-email" = { };
"jallen-nas/traefik/cloudflare-dns-api-token" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
};
"jallen-nas/traefik/cloudflare-zone-api-token" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
};
"jallen-nas/traefik/cloudflare-api-key" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
};
"jallen-nas/traefik/cloudflare-email" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
};
};
templates = {
"traefik.env" = {

84
systems/x86_64-linux/nas/sops.nix
View File

@@ -2,7 +2,6 @@
let
user = "nix-apps";
defaultSops = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
sharedSops = (lib.snowfall.fs.get-file "secrets/secrets.yaml");
in
{
# Permission modes are in octal representation (same as chmod),
@@ -20,7 +19,6 @@ in
# Either the group id or group name representation of the secret group
# It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
sops = {
defaultSopsFile = lib.mkForce defaultSops;
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# ------------------------------
@@ -28,6 +26,7 @@ in
# ------------------------------
secrets = {
"jallen-nas/admin_password" = {
sopsFile = defaultSops;
neededForUsers = true;
mode = "0600";
owner = config.users.users."${user}".name;
@@ -35,20 +34,18 @@ in
};
"jallen-nas/nas_pool" = {
sopsFile = defaultSops;
mode = "0600";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
};
"wifi" = {
sopsFile = sharedSops;
};
# ------------------------------
# ups
# ------------------------------
"jallen-nas/ups_password" = {
sopsFile = defaultSops;
mode = "0777";
restartUnits = [
"upsdrv.service"
@@ -63,12 +60,10 @@ in
# ------------------------------
"ssh-keys-public/jallen-nas-root" = {
sopsFile = sharedSops;
path = "/root/.ssh/id_ed25519.pub";
mode = "0640";
};
"ssh-keys-private/jallen-nas-root" = {
sopsFile = sharedSops;
path = "/root/.ssh/id_ed25519";
mode = "0600";
};
@@ -78,6 +73,7 @@ in
# ------------------------------
"jallen-nas/authentik-env" = {
sopsFile = defaultSops;
restartUnits = [ "authentik.service" ];
};
@@ -86,6 +82,7 @@ in
# ------------------------------
"jallen-nas/collabora" = {
sopsFile = defaultSops;
restartUnits = [ "podman-collabora.service" ];
};
@@ -94,9 +91,11 @@ in
# ------------------------------
"jallen-nas/mariadb/db_pass" = {
sopsFile = defaultSops;
restartUnits = [ "podman-mariadb.service" ];
};
"jallen-nas/mariadb/root_pass" = {
sopsFile = defaultSops;
restartUnits = [ "podman-mariadb.service" ];
};
@@ -105,18 +104,21 @@ in
# ------------------------------
"jallen-nas/nextcloud/dbpassword" = {
sopsFile = defaultSops;
mode = "0650";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
restartUnits = [ "container@nextcloud.service" ];
};
"jallen-nas/nextcloud/adminpassword" = {
sopsFile = defaultSops;
mode = "0650";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
restartUnits = [ "container@nextcloud.service" ];
};
"jallen-nas/nextcloud/smtp_settings" = {
sopsFile = defaultSops;
mode = "0650";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
@@ -128,6 +130,7 @@ in
# ------------------------------
"jallen-nas/onlyoffice-key" = {
sopsFile = defaultSops;
mode = "0650";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
@@ -139,6 +142,7 @@ in
# ------------------------------
"jallen-nas/manyfold/secretkeybase" = {
sopsFile = defaultSops;
restartUnits = [ "podman-manyfold.service" ];
};
@@ -147,6 +151,7 @@ in
# ------------------------------
"jallen-nas/immich/db-password" = {
sopsFile = defaultSops;
mode = "0440";
group = "keys";
restartUnits = [ "container@immich.service" ];
@@ -157,6 +162,7 @@ in
# ------------------------------
"jallen-nas/open-webui" = {
sopsFile = defaultSops;
restartUnits = [ "open-webui.service" ];
};
@@ -165,12 +171,15 @@ in
# ------------------------------
"jallen-nas/paperless/secret" = {
sopsFile = defaultSops;
restartUnits = [ "container@paperless.service" ];
};
"jallen-nas/paperless/authentik-client-id" = {
sopsFile = defaultSops;
restartUnits = [ "container@paperless.service" ];
};
"jallen-nas/paperless/authentik-client-secret" = {
sopsFile = defaultSops;
restartUnits = [ "container@paperless.service" ];
};
@@ -179,12 +188,14 @@ in
# ------------------------------
"jallen-nas/gitea/mail-key" = {
sopsFile = defaultSops;
owner = "root";
group = "keys";
mode = "0440";
restartUnits = [ "container@gitea.service" ];
};
"jallen-nas/gitea/metrics-key" = {
sopsFile = defaultSops;
owner = "root";
group = "keys";
mode = "0440";
@@ -194,55 +205,26 @@ in
# ------------------------------
# free-games-claimer
# ------------------------------
"jallen-nas/free-games/eg-email" = { };
"jallen-nas/free-games/eg-pass" = { };
"jallen-nas/free-games/eg-otp" = { };
"jallen-nas/free-games/pg-email" = { };
"jallen-nas/free-games/pg-pass" = { };
"jallen-nas/free-games/gog-email" = { };
"jallen-nas/free-games/gog-pass" = { };
# ------------------------------
# Secureboot keys
# ------------------------------
"secureboot/GUID" = {
sopsFile = sharedSops;
path = "/etc/secureboot/GUID";
mode = "0640";
"jallen-nas/free-games/eg-email" = {
sopsFile = defaultSops;
};
"secureboot/keys/db-key" = {
sopsFile = sharedSops;
path = "/etc/secureboot/keys/db/db.key";
mode = "0640";
"jallen-nas/free-games/eg-pass" = {
sopsFile = defaultSops;
};
"secureboot/keys/db-pem" = {
sopsFile = sharedSops;
path = "/etc/secureboot/keys/db/db.pem";
mode = "0640";
"jallen-nas/free-games/eg-otp" = {
sopsFile = defaultSops;
};
"secureboot/keys/KEK-key" = {
sopsFile = sharedSops;
path = "/etc/secureboot/keys/KEK/KEK.key";
mode = "0640";
"jallen-nas/free-games/pg-email" = {
sopsFile = defaultSops;
};
"secureboot/keys/KEK-pem" = {
sopsFile = sharedSops;
path = "/etc/secureboot/keys/KEK/KEK.pem";
mode = "0640";
"jallen-nas/free-games/pg-pass" = {
sopsFile = defaultSops;
};
"secureboot/keys/PK-key" = {
sopsFile = sharedSops;
path = "/etc/secureboot/keys/PK/PK.key";
mode = "0640";
"jallen-nas/free-games/gog-email" = {
sopsFile = defaultSops;
};
"secureboot/keys/PK-pem" = {
sopsFile = sharedSops;
path = "/etc/secureboot/keys/PK/PK.pem";
mode = "0640";
};
"jallen-nas/attic-key" = {
# owner = "atticd";
"jallen-nas/free-games/gog-pass" = {
sopsFile = defaultSops;
};
};