mjallen/nix-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

sops n stuff

Browse Source
This commit is contained in:
mjallen18
2025-03-19 16:11:48 -05:00
parent 172d4a37a8
commit d402c32813
11 changed files with 432 additions and 473 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
hosts/desktop/boot.nix
View File

@@ -3,6 +3,7 @@ let
configLimit = 5;
# default = "@saved";
kernel = pkgs.linuxPackages_cachyos;
pkgsVersion = pkgs.unstable;
in
{
# Configure bootloader with lanzaboot and secureboot
@@ -47,7 +48,7 @@ in
bootspec.enable = true;
};
environment.systemPackages = with pkgs; [
environment.systemPackages = with pkgsVersion; [
edk2-uefi-shell
];
}

13
hosts/desktop/configuration.nix
View File

@@ -12,6 +12,7 @@
let
user = "matt";
passwordFile = config.sops.secrets."desktop/matt_password".path;
pkgsVersion = pkgs.unstable;
in
{
imports = [
@@ -31,12 +32,12 @@ in
nix = {
settings = {
substituters = [
"https://cache.mjallen.dev"
# "https://cache.mjallen.dev"
"https://nix-community.cachix.org"
"https://cache.nixos.org/"
];
trusted-public-keys = [
"cache.mjallen.dev-1:IzFmKCd8/gggI6lcCXsW65qQwiCLGFFN9t9s2iw7Lvc="
# "cache.mjallen.dev-1:IzFmKCd8/gggI6lcCXsW65qQwiCLGFFN9t9s2iw7Lvc="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
warn-dirty = lib.mkForce false;
@@ -72,7 +73,7 @@ in
environment = {
# List packages installed in system profile. To search, run:
# $ nix search wget
systemPackages = with pkgs; [
systemPackages = with pkgsVersion; [
aha
aspell
aspellDicts.en
@@ -96,7 +97,7 @@ in
nil
papirus-icon-theme
pciutils
stable.qemu_full
qemu_full
rclone
rclone-browser
restic
@@ -178,7 +179,7 @@ in
"lp"
]; # Enable ‘sudo’ for the user.
hashedPasswordFile = passwordFile;
shell = pkgs.zsh;
shell = pkgsVersion.zsh;
};
hardware = {
@@ -190,7 +191,7 @@ in
enable = true;
brscan5.enable = true;
dsseries.enable = false;
extraBackends = [ pkgs.brscan5 ];
extraBackends = [ pkgsVersion.brscan5 ];
};
};
}

23
hosts/desktop/services.nix
View File

@@ -75,6 +75,7 @@ let
if __name__ == "__main__":
main()
'';
pkgsVersion = pkgs.unstable;
in
{
services = {
@@ -165,11 +166,11 @@ in
services = {
fix-wifi = {
enable = lib.mkDefault true;
path = [
pkgs.bash
pkgs.python3
pkgs.networkmanager
pkgs.kmod
path = with pkgsVersion; [
bash
python3
networkmanager
kmod
fixWifiScript
];
wantedBy = [ "multi-user.target" ];
@@ -184,8 +185,8 @@ in
user.services = {
rclone-home-proton = {
enable = lib.mkDefault false;
path = [
pkgs.bash
path = with pkgsVersion; [
bash
pkgs.rclone
];
script = ''
@@ -195,10 +196,10 @@ in
rsync-home = {
enable = lib.mkDefault false;
path = [
pkgs.bash
pkgs.rsync
pkgs.openssh
path = with pkgsVersion; [
bash
rsync
openssh
];
script = ''
rsync -rtpogvPlHzs --ignore-existing --exclude={'/home/matt/Games', '/home/matt/1TB', '/home/matt/Downloads/*', '/home/matt/.cache'} -e ssh /home/matt admin@10.0.1.18:/media/nas/main/backup/desktop-nix/home

178
hosts/desktop/sops.nix
View File

@@ -1,73 +1,121 @@
{ config, ... }:
let
user = "matt";
in
{
sops.defaultSopsFile = ../../secrets/secrets.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# Permission modes are in octal representation (same as chmod),
# the digits represent: user|group|others
# 7 - full (rwx)
# 6 - read and write (rw-)
# 5 - read and execute (r-x)
# 4 - read only (r--)
# 3 - write and execute (-wx)
# 2 - write only (-w-)
# 1 - execute only (--x)
# 0 - none (---)
# Either a user id or group name representation of the secret owner
# It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
# Either the group id or group name representation of the secret group
# It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
sops = {
defaultSopsFile = ../../secrets/secrets.yaml;
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets."desktop/matt_password" = { };
sops.secrets."desktop/matt_password".neededForUsers = true;
# ------------------------------
# Secrets
# ------------------------------
secrets = {
"desktop/hass_token" = {
mode = "0777";
};
"desktop/matt_password" = {
neededForUsers = true;
mode = "0600";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
};
"desktop/restic/user" = {
mode = "0644";
};
"desktop/restic/password" = {
mode = "0600";
};
"wifi" = { };
sops.secrets."desktop/hass_token" = { };
sops.secrets."desktop/hass_token".mode = "0777";
# ------------------------------
# SSH keys
# ------------------------------
"ssh-keys-public/desktop-nixos" = {
mode = "0644";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
restartUnits = [ "sshd.service" ];
};
"ssh-keys-private/desktop-nixos" = {
mode = "0600";
owner = config.users.users."${user}".name;
group = config.users.users."${user}".group;
restartUnits = [ "sshd.service" ];
};
"ssh-keys-public/desktop-nixos-root" = {
path = "/root/.ssh/id_ed25519.pub";
mode = "0600";
restartUnits = [ "sshd.service" ];
};
"ssh-keys-private/desktop-nixos-root" = {
path = "/root/.ssh/id_ed25519";
mode = "0600";
restartUnits = [ "sshd.service" ];
};
sops.secrets."desktop/restic/user" = { };
sops.secrets."desktop/restic/password" = { };
sops.templates."restic.env".content = ''
RESTIC_REST_USER=${config.sops.placeholder."desktop/restic/user"}
RESTIC_REST_PASSWORD=${config.sops.placeholder."desktop/restic/password"}
'';
# ------------------------------
# Secureboot keys
# ------------------------------
"secureboot/GUID" = {
path = "/etc/secureboot/GUID";
mode = "0600";
};
"secureboot/keys/db-key" = {
path = "/etc/secureboot/keys/db/db.key";
mode = "0600";
};
"secureboot/keys/db-pem" = {
path = "/etc/secureboot/keys/db/db.pem";
mode = "0600";
};
"secureboot/keys/KEK-key" = {
path = "/etc/secureboot/keys/KEK/KEK.key";
mode = "0600";
};
"secureboot/keys/KEK-pem" = {
path = "/etc/secureboot/keys/KEK/KEK.pem";
mode = "0600";
};
"secureboot/keys/PK-key" = {
path = "/etc/secureboot/keys/PK/PK.key";
mode = "0600";
};
"secureboot/keys/PK-pem" = {
path = "/etc/secureboot/keys/PK/PK.pem";
mode = "0600";
};
};
sops.secrets."wifi" = { };
sops.secrets."ssh-keys-public/desktop-nixos" = {
mode = "0644";
};
sops.secrets."ssh-keys-private/desktop-nixos" = {
mode = "0600";
};
sops.secrets."ssh-keys-public/desktop-nixos-root" = {
path = "/root/.ssh/id_ed25519.pub";
mode = "0600";
};
sops.secrets."ssh-keys-private/desktop-nixos-root" = {
path = "/root/.ssh/id_ed25519";
mode = "0600";
};
sops.secrets."secureboot/GUID" = {
path = "/etc/secureboot/GUID";
mode = "0600";
};
sops.secrets."secureboot/keys/db-key" = {
path = "/etc/secureboot/keys/db/db.key";
mode = "0600";
};
sops.secrets."secureboot/keys/db-pem" = {
path = "/etc/secureboot/keys/db/db.pem";
mode = "0600";
};
sops.secrets."secureboot/keys/KEK-key" = {
path = "/etc/secureboot/keys/KEK/KEK.key";
mode = "0600";
};
sops.secrets."secureboot/keys/KEK-pem" = {
path = "/etc/secureboot/keys/KEK/KEK.pem";
mode = "0600";
};
sops.secrets."secureboot/keys/PK-key" = {
path = "/etc/secureboot/keys/PK/PK.key";
mode = "0600";
};
sops.secrets."secureboot/keys/PK-pem" = {
path = "/etc/secureboot/keys/PK/PK.pem";
mode = "0600";
# ------------------------------
# Templates
# ------------------------------
templates = {
"restic.env" = {
mode = "0600";
content = ''
RESTIC_REST_USER=${config.sops.placeholder."desktop/restic/user"}
RESTIC_REST_PASSWORD=${config.sops.placeholder."desktop/restic/password"}
'';
restartUnits = [
"restic-backups-jallen-nas.service"
"restic-backups-proton-drive.service"
];
};
};
};
}