277 lines
8.8 KiB
Nix
Executable File
277 lines
8.8 KiB
Nix
Executable File
{ config, ... }:
|
|
let
|
|
user = "nix-apps";
|
|
in
|
|
{
|
|
# Permission modes are in octal representation (same as chmod),
|
|
# the digits represent: user|group|others
|
|
# 7 - full (rwx)
|
|
# 6 - read and write (rw-)
|
|
# 5 - read and execute (r-x)
|
|
# 4 - read only (r--)
|
|
# 3 - write and execute (-wx)
|
|
# 2 - write only (-w-)
|
|
# 1 - execute only (--x)
|
|
# 0 - none (---)
|
|
# Either a user id or group name representation of the secret owner
|
|
# It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
|
|
# Either the group id or group name representation of the secret group
|
|
# It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
|
|
sops = {
|
|
defaultSopsFile = ../../secrets/nas-secrets.yaml;
|
|
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
# ------------------------------
|
|
# Secrets
|
|
# ------------------------------
|
|
secrets = {
|
|
"jallen-nas/admin_password" = {
|
|
neededForUsers = true;
|
|
mode = "0600";
|
|
owner = config.users.users."${user}".name;
|
|
group = config.users.users."${user}".group;
|
|
};
|
|
|
|
"wifi" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
};
|
|
|
|
# ------------------------------
|
|
# ups
|
|
# ------------------------------
|
|
|
|
"jallen-nas/ups_password" = {
|
|
mode = "0777";
|
|
restartUnits = [
|
|
"upsdrv.service"
|
|
"upsd.service"
|
|
"ups-killpower.service"
|
|
"upsmon.service"
|
|
];
|
|
};
|
|
|
|
# ------------------------------
|
|
# SSH keys
|
|
# ------------------------------
|
|
|
|
"ssh-keys-public/jallen-nas-root" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
path = "/root/.ssh/id_ed25519.pub";
|
|
mode = "0640";
|
|
};
|
|
"ssh-keys-private/jallen-nas-root" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
path = "/root/.ssh/id_ed25519";
|
|
mode = "0600";
|
|
};
|
|
|
|
# ------------------------------
|
|
# authentik
|
|
# ------------------------------
|
|
|
|
"jallen-nas/authentik-env" = {
|
|
restartUnits = [ "authentik.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# collabora # TODO
|
|
# ------------------------------
|
|
|
|
"jallen-nas/collabora" = {
|
|
restartUnits = [ "podman-collabora.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# mariadb # TODO
|
|
# ------------------------------
|
|
|
|
"jallen-nas/mariadb/db_pass" = {
|
|
restartUnits = [ "podman-mariadb.service" ];
|
|
};
|
|
"jallen-nas/mariadb/root_pass" = {
|
|
restartUnits = [ "podman-mariadb.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# nextcloud
|
|
# ------------------------------
|
|
|
|
"jallen-nas/nextcloud/dbpassword" = {
|
|
mode = "0650";
|
|
owner = config.users.users."${user}".name;
|
|
group = config.users.users."${user}".group;
|
|
restartUnits = [ "container@nextcloud.service" ];
|
|
};
|
|
"jallen-nas/nextcloud/adminpassword" = {
|
|
mode = "0650";
|
|
owner = config.users.users."${user}".name;
|
|
group = config.users.users."${user}".group;
|
|
restartUnits = [ "container@nextcloud.service" ];
|
|
};
|
|
"jallen-nas/nextcloud/smtp_settings" = {
|
|
mode = "0650";
|
|
owner = config.users.users."${user}".name;
|
|
group = config.users.users."${user}".group;
|
|
restartUnits = [ "container@nextcloud.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# onlyoffice
|
|
# ------------------------------
|
|
|
|
"jallen-nas/onlyoffice-key" = {
|
|
mode = "0650";
|
|
owner = config.users.users."${user}".name;
|
|
group = config.users.users."${user}".group;
|
|
restartUnits = [ "container@nextcloud.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# manyfold
|
|
# ------------------------------
|
|
|
|
"jallen-nas/manyfold/secretkeybase" = {
|
|
restartUnits = [ "podman-manyfold.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# immich
|
|
# ------------------------------
|
|
|
|
"jallen-nas/immich/db-password" = {
|
|
mode = "0440";
|
|
group = "keys";
|
|
restartUnits = [ "container@immich.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# open-webui
|
|
# ------------------------------
|
|
|
|
"jallen-nas/open-webui" = {
|
|
restartUnits = [ "open-webui.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# paperless
|
|
# ------------------------------
|
|
|
|
"jallen-nas/paperless/secret" = {
|
|
restartUnits = [ "container@paperless.service" ];
|
|
};
|
|
"jallen-nas/paperless/authentik-client-id" = {
|
|
restartUnits = [ "container@paperless.service" ];
|
|
};
|
|
"jallen-nas/paperless/authentik-client-secret" = {
|
|
restartUnits = [ "container@paperless.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# Gitea
|
|
# ------------------------------
|
|
|
|
"jallen-nas/gitea/mail-key" = {
|
|
owner = "root";
|
|
group = "keys";
|
|
mode = "0440";
|
|
restartUnits = [ "container@gitea.service" ];
|
|
};
|
|
"jallen-nas/gitea/metrics-key" = {
|
|
owner = "root";
|
|
group = "keys";
|
|
mode = "0440";
|
|
restartUnits = [ "container@gitea.service" ];
|
|
};
|
|
|
|
# ------------------------------
|
|
# free-games-claimer
|
|
# ------------------------------
|
|
"jallen-nas/free-games/eg-email" = { };
|
|
"jallen-nas/free-games/eg-pass" = { };
|
|
"jallen-nas/free-games/eg-otp" = { };
|
|
"jallen-nas/free-games/pg-email" = { };
|
|
"jallen-nas/free-games/pg-pass" = { };
|
|
"jallen-nas/free-games/gog-email" = { };
|
|
"jallen-nas/free-games/gog-pass" = { };
|
|
|
|
# ------------------------------
|
|
# Secureboot keys
|
|
# ------------------------------
|
|
|
|
"secureboot/GUID" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
path = "/etc/secureboot/GUID";
|
|
mode = "0640";
|
|
};
|
|
"secureboot/keys/db-key" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
path = "/etc/secureboot/keys/db/db.key";
|
|
mode = "0640";
|
|
};
|
|
"secureboot/keys/db-pem" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
path = "/etc/secureboot/keys/db/db.pem";
|
|
mode = "0640";
|
|
};
|
|
"secureboot/keys/KEK-key" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
path = "/etc/secureboot/keys/KEK/KEK.key";
|
|
mode = "0640";
|
|
};
|
|
"secureboot/keys/KEK-pem" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
path = "/etc/secureboot/keys/KEK/KEK.pem";
|
|
mode = "0640";
|
|
};
|
|
"secureboot/keys/PK-key" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
path = "/etc/secureboot/keys/PK/PK.key";
|
|
mode = "0640";
|
|
};
|
|
"secureboot/keys/PK-pem" = {
|
|
sopsFile = ../../secrets/secrets.yaml;
|
|
path = "/etc/secureboot/keys/PK/PK.pem";
|
|
mode = "0640";
|
|
};
|
|
"jallen-nas/attic-key" = {
|
|
# owner = "atticd";
|
|
};
|
|
};
|
|
|
|
# ------------------------------
|
|
# Templates
|
|
# ------------------------------
|
|
templates = {
|
|
"fgc.env" = {
|
|
content = ''
|
|
EG_EMAIL = ${config.sops.placeholder."jallen-nas/free-games/eg-email"}
|
|
EG_PASSWORD = ${config.sops.placeholder."jallen-nas/free-games/eg-pass"}
|
|
EG_OTPKEY = ${config.sops.placeholder."jallen-nas/free-games/eg-otp"}
|
|
PG_EMAIL = ${config.sops.placeholder."jallen-nas/free-games/pg-email"}
|
|
PG_PASSWORD = ${config.sops.placeholder."jallen-nas/free-games/pg-pass"}
|
|
GOG_EMAIL = ${config.sops.placeholder."jallen-nas/free-games/gog-email"}
|
|
GOG_PASSWORD = ${config.sops.placeholder."jallen-nas/free-games/gog-pass"}
|
|
'';
|
|
mode = "0650";
|
|
owner = config.users.users."${user}".name;
|
|
group = config.users.users."${user}".group;
|
|
restartUnits = [ "podman-free-games-claimer.service" ];
|
|
};
|
|
|
|
"paperless.env" = {
|
|
content = ''
|
|
PAPERLESS_URL = "https://paperless.jallen.dev"
|
|
PAPERLESS_SECRET = ${config.sops.placeholder."jallen-nas/paperless/secret"}
|
|
PAPERLESS_ENABLE_ALLAUTH = true
|
|
PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect"
|
|
PAPERLESS_SOCIALACCOUNT_PROVIDERS = {"openid_connect":{"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"authentik","name":"authentik","client_id":"${config.sops.placeholder."jallen-nas/paperless/authentik-client-id"}","secret":"${config.sops.placeholder."jallen-nas/paperless/authentik-client-secret"}","settings":{"server_url":"https://authentik.mjallen.dev/application/o/paperless/.well-known/openid-configuration"}}]}}
|
|
'';
|
|
mode = "0650";
|
|
owner = config.users.users."${user}".name;
|
|
group = config.users.users."${user}".group;
|
|
restartUnits = [ "container@paperless.service" ];
|
|
};
|
|
};
|
|
};
|
|
}
|