nix-config/hosts/nas/sops.nix

{ config, ... }:
let
  user = "nix-apps";
in
{
  # Permission modes are in octal representation (same as chmod),
  # the digits represent: user|group|others
  # 7 - full (rwx)
  # 6 - read and write (rw-)
  # 5 - read and execute (r-x)
  # 4 - read only (r--)
  # 3 - write and execute (-wx)
  # 2 - write only (-w-)
  # 1 - execute only (--x)
  # 0 - none (---)
  # Either a user id or group name representation of the secret owner
  # It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
  # Either the group id or group name representation of the secret group
  # It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
  sops = {
    defaultSopsFile = ../../secrets/secrets.yaml;
    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

    # ------------------------------
    # Secrets
    # ------------------------------
    secrets = {
      "jallen-nas/admin_password" = {
        neededForUsers = true;
        mode = "0600";
        owner = config.users.users."${user}".name;
        group = config.users.users."${user}".group;
      };
      "wifi" = { };
      "jallen-nas/ups_password" = {
        mode = "0777";
        restartUnits = [
          "upsdrv.service"
          "upsd.service"
          "ups-killpower.service"
          "upsmon.service"
        ];
      };
      "jallen-nas/collabora" = {
        restartUnits = [ "podman-collabora.service" ];
      };
      "jallen-nas/mariadb/db_pass" = {
        restartUnits = [ "podman-mariadb.service" ];
      };
      "jallen-nas/mariadb/root_pass" = {
        restartUnits = [ "podman-mariadb.service" ];
      };
      "jallen-nas/nextcloud/dbpassword" = {
        mode = "0650";
        owner = config.users.users."${user}".name;
        group = config.users.users."${user}".group;
        restartUnits = [ "container@nextcloud.service" ];
      };
      "jallen-nas/nextcloud/adminpassword" = {
        mode = "0650";
        owner = config.users.users."${user}".name;
        group = config.users.users."${user}".group;
        restartUnits = [ "container@nextcloud.service" ];
      };
      "jallen-nas/nextcloud/smtp_settings" = {
        mode = "0650";
        owner = config.users.users."${user}".name;
        group = config.users.users."${user}".group;
        restartUnits = [ "container@nextcloud.service" ];
      };
      "jallen-nas/manyfold/secretkeybase" = {
        restartUnits = [ "podman-manyfold.service" ];
      };
      "jallen-nas/immich/db-password" = {
        restartUnits = [ "podman-immich-postgres.service" ];
      };
      "jallen-nas/immich/db-name" = {
        restartUnits = [ "podman-immich-postgres.service" ];
      };
      "jallen-nas/immich/db-user" = {
        restartUnits = [ "podman-immich-postgres.service" ];
      };
      "jallen-nas/immich/server-db-password" = {
        restartUnits = [ "podman-immich-server.service" ];
      };
      "jallen-nas/immich/server-db-name" = {
        restartUnits = [ "podman-immich-server.service" ];
      };
      "jallen-nas/immich/server-db-user" = {
        restartUnits = [ "podman-immich-server.service" ];
      };
      "jallen-nas/open-webui" = {
        restartUnits = [ "open-webui.service" ];
      };
      "jallen-nas/netdata-token" = {
        restartUnits = [ "netdata.service" ];
      };
      "jallen-nas/onlyoffice-key" = {
        restartUnits = [ "podman-onlyoffice.service" ];
      };
      "jallen-nas/paperless/secret" = {
        restartUnits = [ "container@paperless.service" ];
      };
      "jallen-nas/paperless/authentik-client-id" = {
        restartUnits = [ "container@paperless.service" ];
      };
      "jallen-nas/paperless/authentik-client-secret" = {
        restartUnits = [ "container@paperless.service" ];
      };
      "ssh-keys-public/jallen-nas-root" = {
        path = "/root/.ssh/id_ed25519.pub";
        mode = "0600";
      };
      "ssh-keys-private/jallen-nas-root" = {
        path = "/root/.ssh/id_ed25519";
        mode = "0600";
      };
      "secureboot/GUID" = {
        path = "/etc/secureboot/GUID";
        mode = "0600";
      };
      "secureboot/keys/db-key" = {
        path = "/etc/secureboot/keys/db/db.key";
        mode = "0600";
      };
      "secureboot/keys/db-pem" = {
        path = "/etc/secureboot/keys/db/db.pem";
        mode = "0600";
      };
      "secureboot/keys/KEK-key" = {
        path = "/etc/secureboot/keys/KEK/KEK.key";
        mode = "0600";
      };
      "secureboot/keys/KEK-pem" = {
        path = "/etc/secureboot/keys/KEK/KEK.pem";
        mode = "0600";
      };
      "secureboot/keys/PK-key" = {
        path = "/etc/secureboot/keys/PK/PK.key";
        mode = "0600";
      };
      "secureboot/keys/PK-pem" = {
        path = "/etc/secureboot/keys/PK/PK.pem";
        mode = "0600";
      };
    };

    templates = {
      "paperless.env" = {
        content = ''
          PAPERLESS_URL = "https://paperless.jallen.dev"
          PAPERLESS_SECRET = ${config.sops.placeholder."jallen-nas/paperless/secret"}
          PAPERLESS_ENABLE_ALLAUTH = true
          PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect"
          PAPERLESS_SOCIALACCOUNT_PROVIDERS = {"openid_connect":{"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"authentik","name":"authentik","client_id":"${config.sops.placeholder."jallen-nas/paperless/authentik-client-id"}","secret":"${config.sops.placeholder."jallen-nas/paperless/authentik-client-secret"}","settings":{"server_url":"https://authentik.mjallen.dev/application/o/paperless/.well-known/openid-configuration"}}]}}
        '';
        mode = "0650";
        owner = config.users.users."${user}".name;
        group = config.users.users."${user}".group;
        restartUnits = [ "container@paperless.service" ];
      };
    };
  };
}