sops n stuff
This commit is contained in:
mjallen18
@@ -3,6 +3,7 @@ let
|
||||
configLimit = 5;
|
||||
# default = "@saved";
|
||||
kernel = pkgs.linuxPackages_cachyos;
|
||||
pkgsVersion = pkgs.unstable;
|
||||
in
|
||||
{
|
||||
# Configure bootloader with lanzaboot and secureboot
|
||||
@@ -47,7 +48,7 @@ in
|
||||
bootspec.enable = true;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
environment.systemPackages = with pkgsVersion; [
|
||||
edk2-uefi-shell
|
||||
];
|
||||
}
|
||||
|
||||
@@ -12,6 +12,7 @@
|
||||
let
|
||||
user = "matt";
|
||||
passwordFile = config.sops.secrets."desktop/matt_password".path;
|
||||
pkgsVersion = pkgs.unstable;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
@@ -31,12 +32,12 @@ in
|
||||
nix = {
|
||||
settings = {
|
||||
substituters = [
|
||||
"https://cache.mjallen.dev"
|
||||
# "https://cache.mjallen.dev"
|
||||
"https://nix-community.cachix.org"
|
||||
"https://cache.nixos.org/"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.mjallen.dev-1:IzFmKCd8/gggI6lcCXsW65qQwiCLGFFN9t9s2iw7Lvc="
|
||||
# "cache.mjallen.dev-1:IzFmKCd8/gggI6lcCXsW65qQwiCLGFFN9t9s2iw7Lvc="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
warn-dirty = lib.mkForce false;
|
||||
@@ -72,7 +73,7 @@ in
|
||||
environment = {
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
systemPackages = with pkgs; [
|
||||
systemPackages = with pkgsVersion; [
|
||||
aha
|
||||
aspell
|
||||
aspellDicts.en
|
||||
@@ -96,7 +97,7 @@ in
|
||||
nil
|
||||
papirus-icon-theme
|
||||
pciutils
|
||||
stable.qemu_full
|
||||
qemu_full
|
||||
rclone
|
||||
rclone-browser
|
||||
restic
|
||||
@@ -178,7 +179,7 @@ in
|
||||
"lp"
|
||||
]; # Enable ‘sudo’ for the user.
|
||||
hashedPasswordFile = passwordFile;
|
||||
shell = pkgs.zsh;
|
||||
shell = pkgsVersion.zsh;
|
||||
};
|
||||
|
||||
hardware = {
|
||||
@@ -190,7 +191,7 @@ in
|
||||
enable = true;
|
||||
brscan5.enable = true;
|
||||
dsseries.enable = false;
|
||||
extraBackends = [ pkgs.brscan5 ];
|
||||
extraBackends = [ pkgsVersion.brscan5 ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -75,6 +75,7 @@ let
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
'';
|
||||
pkgsVersion = pkgs.unstable;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
@@ -165,11 +166,11 @@ in
|
||||
services = {
|
||||
fix-wifi = {
|
||||
enable = lib.mkDefault true;
|
||||
path = [
|
||||
pkgs.bash
|
||||
pkgs.python3
|
||||
pkgs.networkmanager
|
||||
pkgs.kmod
|
||||
path = with pkgsVersion; [
|
||||
bash
|
||||
python3
|
||||
networkmanager
|
||||
kmod
|
||||
fixWifiScript
|
||||
];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
@@ -184,8 +185,8 @@ in
|
||||
user.services = {
|
||||
rclone-home-proton = {
|
||||
enable = lib.mkDefault false;
|
||||
path = [
|
||||
pkgs.bash
|
||||
path = with pkgsVersion; [
|
||||
bash
|
||||
pkgs.rclone
|
||||
];
|
||||
script = ''
|
||||
@@ -195,10 +196,10 @@ in
|
||||
|
||||
rsync-home = {
|
||||
enable = lib.mkDefault false;
|
||||
path = [
|
||||
pkgs.bash
|
||||
pkgs.rsync
|
||||
pkgs.openssh
|
||||
path = with pkgsVersion; [
|
||||
bash
|
||||
rsync
|
||||
openssh
|
||||
];
|
||||
script = ''
|
||||
rsync -rtpogvPlHzs --ignore-existing --exclude={'/home/matt/Games', '/home/matt/1TB', '/home/matt/Downloads/*', '/home/matt/.cache'} -e ssh /home/matt admin@10.0.1.18:/media/nas/main/backup/desktop-nix/home
|
||||
|
||||
@@ -1,73 +1,121 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
user = "matt";
|
||||
in
|
||||
{
|
||||
sops.defaultSopsFile = ../../secrets/secrets.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
# Permission modes are in octal representation (same as chmod),
|
||||
# the digits represent: user|group|others
|
||||
# 7 - full (rwx)
|
||||
# 6 - read and write (rw-)
|
||||
# 5 - read and execute (r-x)
|
||||
# 4 - read only (r--)
|
||||
# 3 - write and execute (-wx)
|
||||
# 2 - write only (-w-)
|
||||
# 1 - execute only (--x)
|
||||
# 0 - none (---)
|
||||
# Either a user id or group name representation of the secret owner
|
||||
# It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
|
||||
# Either the group id or group name representation of the secret group
|
||||
# It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
|
||||
sops = {
|
||||
defaultSopsFile = ../../secrets/secrets.yaml;
|
||||
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
|
||||
sops.secrets."desktop/matt_password" = { };
|
||||
sops.secrets."desktop/matt_password".neededForUsers = true;
|
||||
# ------------------------------
|
||||
# Secrets
|
||||
# ------------------------------
|
||||
secrets = {
|
||||
"desktop/hass_token" = {
|
||||
mode = "0777";
|
||||
};
|
||||
"desktop/matt_password" = {
|
||||
neededForUsers = true;
|
||||
mode = "0600";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
};
|
||||
"desktop/restic/user" = {
|
||||
mode = "0644";
|
||||
};
|
||||
"desktop/restic/password" = {
|
||||
mode = "0600";
|
||||
};
|
||||
"wifi" = { };
|
||||
|
||||
sops.secrets."desktop/hass_token" = { };
|
||||
sops.secrets."desktop/hass_token".mode = "0777";
|
||||
# ------------------------------
|
||||
# SSH keys
|
||||
# ------------------------------
|
||||
"ssh-keys-public/desktop-nixos" = {
|
||||
mode = "0644";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
"ssh-keys-private/desktop-nixos" = {
|
||||
mode = "0600";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
"ssh-keys-public/desktop-nixos-root" = {
|
||||
path = "/root/.ssh/id_ed25519.pub";
|
||||
mode = "0600";
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
"ssh-keys-private/desktop-nixos-root" = {
|
||||
path = "/root/.ssh/id_ed25519";
|
||||
mode = "0600";
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
|
||||
sops.secrets."desktop/restic/user" = { };
|
||||
sops.secrets."desktop/restic/password" = { };
|
||||
sops.templates."restic.env".content = ''
|
||||
RESTIC_REST_USER=${config.sops.placeholder."desktop/restic/user"}
|
||||
RESTIC_REST_PASSWORD=${config.sops.placeholder."desktop/restic/password"}
|
||||
'';
|
||||
# ------------------------------
|
||||
# Secureboot keys
|
||||
# ------------------------------
|
||||
"secureboot/GUID" = {
|
||||
path = "/etc/secureboot/GUID";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/db-key" = {
|
||||
path = "/etc/secureboot/keys/db/db.key";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/db-pem" = {
|
||||
path = "/etc/secureboot/keys/db/db.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/KEK-key" = {
|
||||
path = "/etc/secureboot/keys/KEK/KEK.key";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/KEK-pem" = {
|
||||
path = "/etc/secureboot/keys/KEK/KEK.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/PK-key" = {
|
||||
path = "/etc/secureboot/keys/PK/PK.key";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/PK-pem" = {
|
||||
path = "/etc/secureboot/keys/PK/PK.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets."wifi" = { };
|
||||
|
||||
sops.secrets."ssh-keys-public/desktop-nixos" = {
|
||||
mode = "0644";
|
||||
};
|
||||
|
||||
sops.secrets."ssh-keys-private/desktop-nixos" = {
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."ssh-keys-public/desktop-nixos-root" = {
|
||||
path = "/root/.ssh/id_ed25519.pub";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."ssh-keys-private/desktop-nixos-root" = {
|
||||
path = "/root/.ssh/id_ed25519";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/GUID" = {
|
||||
path = "/etc/secureboot/GUID";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/db-key" = {
|
||||
path = "/etc/secureboot/keys/db/db.key";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/db-pem" = {
|
||||
path = "/etc/secureboot/keys/db/db.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/KEK-key" = {
|
||||
path = "/etc/secureboot/keys/KEK/KEK.key";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/KEK-pem" = {
|
||||
path = "/etc/secureboot/keys/KEK/KEK.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/PK-key" = {
|
||||
path = "/etc/secureboot/keys/PK/PK.key";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/PK-pem" = {
|
||||
path = "/etc/secureboot/keys/PK/PK.pem";
|
||||
mode = "0600";
|
||||
# ------------------------------
|
||||
# Templates
|
||||
# ------------------------------
|
||||
templates = {
|
||||
"restic.env" = {
|
||||
mode = "0600";
|
||||
content = ''
|
||||
RESTIC_REST_USER=${config.sops.placeholder."desktop/restic/user"}
|
||||
RESTIC_REST_PASSWORD=${config.sops.placeholder."desktop/restic/password"}
|
||||
'';
|
||||
restartUnits = [
|
||||
"restic-backups-jallen-nas.service"
|
||||
"restic-backups-proton-drive.service"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,142 +1,8 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
user = "admin";
|
||||
in
|
||||
{
|
||||
sops.defaultSopsFile = ../../secrets/secrets.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
|
||||
sops.secrets."jallen-nas/admin_password" = { };
|
||||
sops.secrets."jallen-nas/admin_password".neededForUsers = true;
|
||||
|
||||
sops.secrets."wifi" = { };
|
||||
|
||||
sops.secrets."jallen-nas/ups_password" = {
|
||||
# restartUnits = [ "ups stuff lol" ];
|
||||
};
|
||||
sops.secrets."jallen-nas/ups_password".mode = "0777";
|
||||
|
||||
sops.secrets."jallen-nas/collabora" = {
|
||||
restartUnits = [ "podman-collabora.service" ];
|
||||
};
|
||||
|
||||
sops.secrets."jallen-nas/mariadb/db_pass" = {
|
||||
restartUnits = [ "podman-mariadb.service" ];
|
||||
};
|
||||
sops.secrets."jallen-nas/mariadb/root_pass" = {
|
||||
restartUnits = [ "podman-mariadb.service" ];
|
||||
};
|
||||
|
||||
sops.secrets."jallen-nas/nextcloud/dbpassword" = {
|
||||
restartUnits = [ "podman-nextcloud.service" ];
|
||||
};
|
||||
sops.secrets."jallen-nas/nextcloud/adminpassword" = {
|
||||
restartUnits = [ "podman-nextcloud.service" ];
|
||||
};
|
||||
sops.secrets."jallen-nas/nextcloud/smtppassword" = {
|
||||
restartUnits = [ "podman-nextcloud.service" ];
|
||||
};
|
||||
|
||||
sops.templates."nextcloud-smtp".content = ''
|
||||
${config.sops.secrets."jallen-nas/nextcloud/smtppassword".path}
|
||||
'';
|
||||
|
||||
sops.secrets."jallen-nas/manyfold/secretkeybase" = {
|
||||
restartUnits = [ "podman-manyfold.service" ];
|
||||
};
|
||||
|
||||
sops.secrets."jallen-nas/immich/db-password" = {
|
||||
restartUnits = [ "podman-immich-postgres.service" ];
|
||||
};
|
||||
sops.secrets."jallen-nas/immich/db-name" = {
|
||||
restartUnits = [ "podman-immich-postgres.service" ];
|
||||
};
|
||||
sops.secrets."jallen-nas/immich/db-user" = {
|
||||
restartUnits = [ "podman-immich-postgres.service" ];
|
||||
};
|
||||
sops.secrets."jallen-nas/immich/server-db-password" = {
|
||||
restartUnits = [ "podman-immich-server.service" ];
|
||||
};
|
||||
sops.secrets."jallen-nas/immich/server-db-name" = {
|
||||
restartUnits = [ "podman-immich-server.service" ];
|
||||
};
|
||||
sops.secrets."jallen-nas/immich/server-db-user" = {
|
||||
restartUnits = [ "podman-immich-server.service" ];
|
||||
};
|
||||
|
||||
sops.secrets."jallen-nas/open-webui" = {
|
||||
restartUnits = [ "open-webui.service" ];
|
||||
};
|
||||
|
||||
sops.secrets."jallen-nas/netdata-token" = {
|
||||
restartUnits = [ "netdata.service" ];
|
||||
};
|
||||
|
||||
sops.secrets."jallen-nas/onlyoffice-key" = {
|
||||
restartUnits = [ "podman-onlyoffice.service" ];
|
||||
};
|
||||
|
||||
sops.secrets."jallen-nas/paperless/secret" = {
|
||||
restartUnits = [ "container@paperless.service" ];
|
||||
};
|
||||
sops.templates."paperless-secret".content = ''
|
||||
${config.sops.secrets."jallen-nas/paperless/secret".path}
|
||||
'';
|
||||
sops.secrets."jallen-nas/paperless/authentik-client-id" = {
|
||||
restartUnits = [ "container@paperless.service" ];
|
||||
};
|
||||
sops.templates."paperless-client-id".content = ''
|
||||
${config.sops.secrets."jallen-nas/paperless/authentik-client-id".path}
|
||||
'';
|
||||
sops.secrets."jallen-nas/paperless/authentik-client-secret" = {
|
||||
restartUnits = [ "container@paperless.service" ];
|
||||
};
|
||||
sops.templates."paperless-client-secret".content = ''
|
||||
${config.sops.secrets."jallen-nas/paperless/authentik-client-secret".path}
|
||||
'';
|
||||
|
||||
sops.secrets."ssh-keys-public/jallen-nas-root" = {
|
||||
path = "/root/.ssh/id_ed25519.pub";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."ssh-keys-private/jallen-nas-root" = {
|
||||
path = "/root/.ssh/id_ed25519";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/GUID" = {
|
||||
path = "/etc/secureboot/GUID";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/db-key" = {
|
||||
path = "/etc/secureboot/keys/db/db.key";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/db-pem" = {
|
||||
path = "/etc/secureboot/keys/db/db.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/KEK-key" = {
|
||||
path = "/etc/secureboot/keys/KEK/KEK.key";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/KEK-pem" = {
|
||||
path = "/etc/secureboot/keys/KEK/KEK.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/PK-key" = {
|
||||
path = "/etc/secureboot/keys/PK/PK.key";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
sops.secrets."secureboot/keys/PK-pem" = {
|
||||
path = "/etc/secureboot/keys/PK/PK.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
# Permission modes are in octal representation (same as chmod),
|
||||
# the digits represent: user|group|others
|
||||
# 7 - full (rwx)
|
||||
@@ -147,19 +13,142 @@
|
||||
# 2 - write only (-w-)
|
||||
# 1 - execute only (--x)
|
||||
# 0 - none (---)
|
||||
sops.secrets."jallen-nas/nextcloud/dbpassword".mode = "0777";
|
||||
# Either a user id or group name representation of the secret owner
|
||||
# It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
|
||||
# sops.secrets."jallen-nas/nextcloud/dbpassword".owner = config.users.users.nix-apps.name;
|
||||
# # Either the group id or group name representation of the secret group
|
||||
# # It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
|
||||
# sops.secrets."jallen-nas/nextcloud/dbpassword".group = config.users.users.jallen-nas.group;
|
||||
# Either the group id or group name representation of the secret group
|
||||
# It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
|
||||
sops = {
|
||||
defaultSopsFile = ../../secrets/secrets.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
|
||||
sops.secrets."jallen-nas/nextcloud/adminpassword".mode = "0777";
|
||||
# sops.secrets."jallen-nas/nextcloud/adminpassword".owner = config.users.users.nix-apps.name;
|
||||
# sops.secrets."jallen-nas/nextcloud/adminpassword".group = config.users.users.jallen-nas.group;
|
||||
|
||||
sops.secrets."jallen-nas/nextcloud/smtppassword".mode = "0777";
|
||||
# sops.secrets."jallen-nas/nextcloud/smtppassword".owner = config.users.users.nix-apps.name;
|
||||
# sops.secrets."jallen-nas/nextcloud/smtppassword".group = config.users.users.jallen-nas.group;
|
||||
# ------------------------------
|
||||
# Secrets
|
||||
# ------------------------------
|
||||
secrets = {
|
||||
"jallen-nas/admin_password" = {
|
||||
neededForUsers = true;
|
||||
mode = "0600";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
};
|
||||
"wifi" = { };
|
||||
"jallen-nas/ups_password" = {
|
||||
mode = "0777";
|
||||
# restartUnits = [ "ups stuff lol" ];
|
||||
};
|
||||
"jallen-nas/collabora" = {
|
||||
restartUnits = [ "podman-collabora.service" ];
|
||||
};
|
||||
"jallen-nas/mariadb/db_pass" = {
|
||||
restartUnits = [ "podman-mariadb.service" ];
|
||||
};
|
||||
"jallen-nas/mariadb/root_pass" = {
|
||||
restartUnits = [ "podman-mariadb.service" ];
|
||||
};
|
||||
"jallen-nas/nextcloud/dbpassword" = {
|
||||
restartUnits = [ "podman-nextcloud.service" ];
|
||||
};
|
||||
"jallen-nas/nextcloud/adminpassword" = {
|
||||
restartUnits = [ "podman-nextcloud.service" ];
|
||||
};
|
||||
"jallen-nas/nextcloud/smtppassword" = {
|
||||
restartUnits = [ "podman-nextcloud.service" ];
|
||||
};
|
||||
"jallen-nas/manyfold/secretkeybase" = {
|
||||
restartUnits = [ "podman-manyfold.service" ];
|
||||
};
|
||||
"jallen-nas/immich/db-password" = {
|
||||
restartUnits = [ "podman-immich-postgres.service" ];
|
||||
};
|
||||
"jallen-nas/immich/db-name" = {
|
||||
restartUnits = [ "podman-immich-postgres.service" ];
|
||||
};
|
||||
"jallen-nas/immich/db-user" = {
|
||||
restartUnits = [ "podman-immich-postgres.service" ];
|
||||
};
|
||||
"jallen-nas/immich/server-db-password" = {
|
||||
restartUnits = [ "podman-immich-server.service" ];
|
||||
};
|
||||
"jallen-nas/immich/server-db-name" = {
|
||||
restartUnits = [ "podman-immich-server.service" ];
|
||||
};
|
||||
"jallen-nas/immich/server-db-user" = {
|
||||
restartUnits = [ "podman-immich-server.service" ];
|
||||
};
|
||||
"jallen-nas/open-webui" = {
|
||||
restartUnits = [ "open-webui.service" ];
|
||||
};
|
||||
"jallen-nas/netdata-token" = {
|
||||
restartUnits = [ "netdata.service" ];
|
||||
};
|
||||
"jallen-nas/onlyoffice-key" = {
|
||||
restartUnits = [ "podman-onlyoffice.service" ];
|
||||
};
|
||||
"jallen-nas/paperless/secret" = {
|
||||
restartUnits = [ "container@paperless.service" ];
|
||||
};
|
||||
secrets."jallen-nas/paperless/authentik-client-id" = {
|
||||
restartUnits = [ "container@paperless.service" ];
|
||||
};
|
||||
"jallen-nas/paperless/authentik-client-secret" = {
|
||||
restartUnits = [ "container@paperless.service" ];
|
||||
};
|
||||
"jallen-nas/nextcloud/dbpassword" = {
|
||||
mode = "0777";
|
||||
};
|
||||
"jallen-nas/nextcloud/adminpassword" = {
|
||||
mode = "0777";
|
||||
};
|
||||
"ssh-keys-public/jallen-nas-root" = {
|
||||
path = "/root/.ssh/id_ed25519.pub";
|
||||
mode = "0600";
|
||||
};
|
||||
"ssh-keys-private/jallen-nas-root" = {
|
||||
path = "/root/.ssh/id_ed25519";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/GUID" = {
|
||||
path = "/etc/secureboot/GUID";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/db-key" = {
|
||||
path = "/etc/secureboot/keys/db/db.key";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/db-pem" = {
|
||||
path = "/etc/secureboot/keys/db/db.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/KEK-key" = {
|
||||
path = "/etc/secureboot/keys/KEK/KEK.key";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/KEK-pem" = {
|
||||
path = "/etc/secureboot/keys/KEK/KEK.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/PK-key" = {
|
||||
path = "/etc/secureboot/keys/PK/PK.key";
|
||||
mode = "0600";
|
||||
};
|
||||
"secureboot/keys/PK-pem" = {
|
||||
path = "/etc/secureboot/keys/PK/PK.pem";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
templates = {
|
||||
"nextcloud-smtp".content = ''
|
||||
${config.sops.secrets."jallen-nas/nextcloud/smtppassword"}
|
||||
'';
|
||||
"paperless-secret".content = ''
|
||||
${config.sops.secrets."jallen-nas/paperless/secret".path}
|
||||
'';
|
||||
"paperless-client-id".content = ''
|
||||
${config.sops.secrets."jallen-nas/paperless/authentik-client-id".path}
|
||||
'';
|
||||
"paperless-client-secret".content = ''
|
||||
${config.sops.secrets."jallen-nas/paperless/authentik-client-secret".path}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user