allow generating secrets init scripts outside of module, run deadnix&formatter, update state versions
This commit is contained in:
chaos
parent
9b75a69bd4
commit
b9b16c8509
|
|
@ -1,20 +1,5 @@
|
|||
{
|
||||
pkgs,
|
||||
nixosConfig,
|
||||
...
|
||||
}: let
|
||||
gnomeConfig = nixosConfig.services.xserver.desktopManager.gnome;
|
||||
gdmConfig = nixosConfig.services.xserver.displayManager.gdm;
|
||||
|
||||
isGnome = gnomeConfig.enable;
|
||||
isGDMWayland = gdmConfig.enable && gdmConfig.wayland;
|
||||
|
||||
isWayland = isGnome && isGDMWayland;
|
||||
|
||||
# rofi currently does not run on gnome
|
||||
rofiPackage = pkgs.rofi;
|
||||
in {
|
||||
home.packages = [rofiPackage];
|
||||
{pkgs, ...}: {
|
||||
home.packages = with pkgs; [rofi];
|
||||
|
||||
home.file.".local/share/rofi/themes/rofi-nord.rasi".source = ./rofi-nord.rasi;
|
||||
home.file.".config/rofi/config.rasi".source = ./config.rasi;
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{pkgs, ...}: {
|
||||
home.packages = with pkgs; [alejandra];
|
||||
home.packages = with pkgs; [alejandra deadnix];
|
||||
|
||||
programs.vscode-mod.extensions = with pkgs; [
|
||||
vscode-extensions.bbenoist.nix
|
||||
|
|
|
|||
|
|
@ -106,11 +106,11 @@ in {
|
|||
|
||||
home-manager.users.root = {
|
||||
imports = with tree; [home.base home.dev.small];
|
||||
home.stateVersion = "22.05";
|
||||
home.stateVersion = "23.05";
|
||||
};
|
||||
|
||||
networking.hostName = "buildbox";
|
||||
time.timeZone = "Europe/London";
|
||||
|
||||
system.stateVersion = "22.05";
|
||||
system.stateVersion = "23.05";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
user = "root";
|
||||
group = "root";
|
||||
fetchScript = ''
|
||||
simple_get "/api-keys/chaos_mail/system" .password > $secretFile
|
||||
simple_get "/api-keys/chaos_mail/system" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -3,7 +3,6 @@
|
|||
lib,
|
||||
inputs,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
ports = [
|
||||
|
|
@ -54,11 +53,7 @@ in {
|
|||
})))
|
||||
];
|
||||
|
||||
config = {
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
config = {config, ...}: {
|
||||
_module.args = {
|
||||
inherit inputs;
|
||||
inherit tree;
|
||||
|
|
|
|||
|
|
@ -69,7 +69,7 @@ in {
|
|||
];
|
||||
|
||||
services.roundcube = {
|
||||
package = pkgs.roundcube.withPlugins (plugins:
|
||||
package = pkgs.roundcube.withPlugins (_plugins:
|
||||
with pkgs.roundcubePlugins; [
|
||||
persistent_login
|
||||
]);
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
host_secrets,
|
||||
...
|
||||
}: let
|
||||
|
|
|
|||
|
|
@ -83,13 +83,13 @@ in {
|
|||
home-manager.users.root = {
|
||||
imports = with tree; [home.base home.dev.small];
|
||||
home.packages = with pkgs; [vault];
|
||||
home.stateVersion = "22.05";
|
||||
home.stateVersion = "23.05";
|
||||
};
|
||||
|
||||
# Manually configure nameserver. Using resolved inside the container seems to fail
|
||||
# currently
|
||||
environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
|
||||
system.stateVersion = "22.05";
|
||||
system.stateVersion = "23.05";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -3,7 +3,6 @@
|
|||
lib,
|
||||
inputs,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
container-addresses = import ../../data/container-addresses.nix {};
|
||||
|
|
@ -37,11 +36,7 @@ in {
|
|||
};
|
||||
}));
|
||||
|
||||
config = {
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
config = {config, ...}: {
|
||||
_module.args = {
|
||||
inherit inputs;
|
||||
inherit tree;
|
||||
|
|
|
|||
|
|
@ -1,7 +1,5 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
host_secrets,
|
||||
...
|
||||
}: let
|
||||
|
|
|
|||
|
|
@ -1,7 +1,5 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
host_secrets,
|
||||
...
|
||||
}: let
|
||||
|
|
|
|||
|
|
@ -36,11 +36,7 @@ in {
|
|||
};
|
||||
}));
|
||||
|
||||
config = {
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
config = {config, ...}: {
|
||||
_module.args = {
|
||||
inherit inputs;
|
||||
inherit tree;
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ in {
|
|||
services.gotosocial = {
|
||||
enable = true;
|
||||
setupPostgresqlDB = true;
|
||||
environmentFile = host_secrets.social_env_secrets.path;
|
||||
environmentFile = secrets.social_env_secrets.path;
|
||||
|
||||
settings = {
|
||||
application-name = "chaos-gts";
|
||||
|
|
|
|||
|
|
@ -73,13 +73,13 @@ in {
|
|||
home-manager.users.root = {
|
||||
imports = with tree; [home.base home.dev.small];
|
||||
home.packages = with pkgs; [vault];
|
||||
home.stateVersion = "22.05";
|
||||
home.stateVersion = "23.05";
|
||||
};
|
||||
|
||||
# Manually configure nameserver. Using resolved inside the container seems to fail
|
||||
# currently
|
||||
environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
|
||||
system.stateVersion = "22.05";
|
||||
system.stateVersion = "23.05";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,14 +1,26 @@
|
|||
{pkgs, ...}: {
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
services.secrets = {
|
||||
enable = true;
|
||||
|
||||
extraPackages = with pkgs; [
|
||||
packages = with pkgs; [
|
||||
# for music & mail passwd files
|
||||
apacheHttpd
|
||||
# for rclone obscure config file
|
||||
rclone
|
||||
];
|
||||
|
||||
uidMap = {
|
||||
"storage" = config.users.users."storage".uid;
|
||||
};
|
||||
|
||||
gidMap = {
|
||||
"storage" = config.users.groups."storage".gid;
|
||||
};
|
||||
|
||||
extraFunctions = ''
|
||||
replace_slash_for_sed() {
|
||||
sed "s#/#\\\/#"
|
||||
|
|
@ -108,7 +120,7 @@
|
|||
fetchScript = ''
|
||||
username=$(simple_get "/api-keys/storage/webdav/main" .username)
|
||||
password=$(simple_get "/api-keys/storage/webdav/main" .password)
|
||||
htpasswd -bc "$secretFile" "$username" "$password" 2>&1
|
||||
htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
|
||||
'';
|
||||
};
|
||||
webdav_media_htpasswd = {
|
||||
|
|
@ -117,7 +129,7 @@
|
|||
fetchScript = ''
|
||||
username=$(simple_get "/api-keys/storage/webdav/media" .username)
|
||||
password=$(simple_get "/api-keys/storage/webdav/media" .password)
|
||||
htpasswd -bc "$secretFile" "$username" "$password" 2>&1
|
||||
htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -129,7 +141,7 @@
|
|||
|
||||
cp ${./rclone_config.template} "$TMP_DIR/template"
|
||||
|
||||
pushd "$TMP_DIR" 2>/dev/null
|
||||
pushd "$TMP_DIR" >/dev/null
|
||||
|
||||
STORAGEBOX_PASSWORD=$(simple_get_obscure /api-keys/hetzner/storagebox .password)
|
||||
sed -i "s/STORAGEBOX_PASSWORD/$STORAGEBOX_PASSWORD/" ./template
|
||||
|
|
@ -148,9 +160,9 @@
|
|||
|
||||
simple_get_replace_crypt "/private-public-keys/rclone/Chaos-Media-Crypt" "STORAGE_MEDIA_CRYPT" ./template
|
||||
|
||||
cp ./template $secretFile
|
||||
cp ./template "$secretFile"
|
||||
|
||||
popd 2>/dev/null
|
||||
popd >/dev/null
|
||||
|
||||
rm -rf "$TMP_DIR"
|
||||
'';
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
{...}: {
|
||||
users.groups.storage = {};
|
||||
users.groups.storage = {
|
||||
gid = 1000;
|
||||
};
|
||||
users.users.storage = {
|
||||
uid = 1000;
|
||||
isNormalUser = true;
|
||||
extraGroups = ["storage"];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -59,7 +59,7 @@ in {
|
|||
home-manager.users.root = {
|
||||
imports = with tree; [home.base home.dev.small];
|
||||
home.packages = with pkgs; [vault];
|
||||
home.stateVersion = "22.05";
|
||||
home.stateVersion = "23.05";
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
|
|
@ -70,7 +70,7 @@ in {
|
|||
# Manually configure nameserver. Using resolved inside the container seems to fail
|
||||
# currently
|
||||
environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
|
||||
system.stateVersion = "22.05";
|
||||
system.stateVersion = "23.05";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -72,11 +72,11 @@
|
|||
|
||||
home-manager.users.root = {
|
||||
imports = with tree; [home.base home.dev.small];
|
||||
home.stateVersion = "22.05";
|
||||
home.stateVersion = "23.05";
|
||||
};
|
||||
|
||||
networking.hostName = "hetzner-vm";
|
||||
time.timeZone = "Europe/London";
|
||||
|
||||
system.stateVersion = "22.05";
|
||||
system.stateVersion = "23.05";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
{config, ...}: let
|
||||
secrets = config.services.secrets.secrets;
|
||||
in {
|
||||
users.users.gitlab_artifacts_sync.uid = 2001;
|
||||
users.groups.gitlab_artifacts_sync.gid = 2001;
|
||||
|
||||
services.gitlab_artifacts_sync = {
|
||||
enable = true;
|
||||
credentialsEnvironmentFile = "${secrets.gitlab_env.path}";
|
||||
|
|
|
|||
|
|
@ -1,12 +1,37 @@
|
|||
{pkgs, ...}: {
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
inherit (lib.lists) forEach;
|
||||
inherit (lib.modules) mkMerge;
|
||||
|
||||
users = ["root" "dovecot2" "gitlab_artifacts_sync" "mpd" "nginx"];
|
||||
groups = users;
|
||||
in {
|
||||
services.secrets = {
|
||||
enable = true;
|
||||
|
||||
extraPackages = with pkgs; [
|
||||
packages = with pkgs; [
|
||||
# for music & mail passwd files
|
||||
apacheHttpd
|
||||
];
|
||||
|
||||
uidMap = let
|
||||
getUID = name: config.users.users.${name}.uid;
|
||||
in
|
||||
mkMerge (forEach users (user: {
|
||||
"${user}" = getUID user;
|
||||
}));
|
||||
|
||||
gidMap = let
|
||||
getGID = name: config.users.groups.${name}.gid;
|
||||
in
|
||||
mkMerge (forEach groups (group: {
|
||||
"${group}" = getGID group;
|
||||
}));
|
||||
|
||||
secrets = {
|
||||
# Used directly by server
|
||||
# for fetching gitlab static sites
|
||||
|
|
@ -15,31 +40,31 @@
|
|||
group = "gitlab_artifacts_sync";
|
||||
fetchScript = ''
|
||||
token=$(simple_get "/api-keys/gitlab/gitlab_pages_serve" .token)
|
||||
echo "GITLAB_TOKEN=$token" > $secretFile
|
||||
echo "GITLAB_TOKEN=$token" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
# for wireguard
|
||||
wg_privkey = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .private > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .private > "$secretFile"
|
||||
'';
|
||||
};
|
||||
wg_preshared_vault = {
|
||||
path = "/secrets/wg_preshared_vault";
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.vault > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.vault > "$secretFile"
|
||||
'';
|
||||
};
|
||||
wg_preshared_iphone8 = {
|
||||
path = "/secrets/wg_preshared_iphone8";
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.iphone8 > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.iphone8 > "$secretFile"
|
||||
'';
|
||||
};
|
||||
wg_preshared_lappy-t495 = {
|
||||
path = "/secrets/wg_preshared_lappy-t495";
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" ".preshared_keys.lappy_t495" > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" ".preshared_keys.lappy_t495" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -48,7 +73,7 @@
|
|||
user = "mpd";
|
||||
group = "mpd";
|
||||
fetchScript = ''
|
||||
simple_get "/api-keys/mpd" .password > $secretFile
|
||||
simple_get "/api-keys/mpd" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
music_stream_passwd = {
|
||||
|
|
@ -57,37 +82,37 @@
|
|||
fetchScript = ''
|
||||
username=$(simple_get "/api-keys/music-stream" .username)
|
||||
password=$(simple_get "/api-keys/music-stream" .password)
|
||||
htpasswd -bc $secretFile "$username" "$password" 2>/dev/null
|
||||
htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
|
||||
'';
|
||||
};
|
||||
slskd_env = {
|
||||
fetchScript = ''
|
||||
soulseek_password=$(simple_get "/passwords/soulseek" .password)
|
||||
slskd_password=$(simple_get "/passwords/slskd" .password)
|
||||
echo > $secretFile
|
||||
echo "SLSKD_SLSK_PASSWORD=$soulseek_password" >> $secretFile
|
||||
echo "SLSKD_PASSWORD=$slskd_password" >> $secretFile
|
||||
echo > "$secretFile"
|
||||
echo "SLSKD_SLSK_PASSWORD=$soulseek_password" >> "$secretFile"
|
||||
echo "SLSKD_PASSWORD=$slskd_password" >> "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
# Container: mail
|
||||
mail_restic_password = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/restic/Mail" .password > $secretFile
|
||||
simple_get "/private-public-keys/restic/Mail" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
mail_restic_env = {
|
||||
fetchScript = ''
|
||||
RESTIC_USERNAME=$(simple_get "/api-keys/storage/restic/Mail" .username)
|
||||
RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/Mail" .password)
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Mail" > $secretFile
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Mail" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
private_mail_aliases = {
|
||||
user = "root";
|
||||
group = "root";
|
||||
fetchScript = ''
|
||||
kv_get "/infra/private-mail-aliases" | jq .data.data | jq -r 'to_entries|map("\(.key) \(.value.to)")[]' > $secretFile
|
||||
kv_get "/infra/private-mail-aliases" | jq .data.data | jq -r 'to_entries|map("\(.key) \(.value.to)")[]' > "$secretFile"
|
||||
'';
|
||||
};
|
||||
chaos_mail_passwd = {
|
||||
|
|
@ -95,7 +120,7 @@
|
|||
group = "dovecot2";
|
||||
fetchScript = ''
|
||||
password=$(simple_get "/passwords/mail" .password)
|
||||
htpasswd -nbB "" "$password" 2>/dev/null | cut -d: -f2 > $secretFile
|
||||
htpasswd -nbB "" "$password" 2>/dev/null | cut -d: -f2 > "$secretFile"
|
||||
'';
|
||||
};
|
||||
system_mail_passwd = {
|
||||
|
|
@ -103,7 +128,7 @@
|
|||
group = "dovecot2";
|
||||
fetchScript = ''
|
||||
password=$(simple_get "/api-keys/chaos_mail/system" .password)
|
||||
htpasswd -nbB "" "$password" 2>/dev/null | cut -d: -f2 > $secretFile
|
||||
htpasswd -nbB "" "$password" 2>/dev/null | cut -d: -f2 > "$secretFile"
|
||||
'';
|
||||
};
|
||||
gotosocial_mail_passwd = {
|
||||
|
|
@ -111,21 +136,21 @@
|
|||
group = "dovecot2";
|
||||
fetchScript = ''
|
||||
password=$(simple_get "/api-keys/chaos_mail/gotosocial" .password)
|
||||
htpasswd -nbB "" "$password" 2>/dev/null | cut -d: -f2 > $secretFile
|
||||
htpasswd -nbB "" "$password" 2>/dev/null | cut -d: -f2 > "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
# Container: social
|
||||
social_restic_password = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/restic/Social" .password > $secretFile
|
||||
simple_get "/private-public-keys/restic/Social" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
social_restic_env = {
|
||||
fetchScript = ''
|
||||
RESTIC_USERNAME=$(simple_get "/api-keys/storage/restic/Social" .username)
|
||||
RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/Social" .password)
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Social" > $secretFile
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Social" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
social_env_secrets = {
|
||||
|
|
@ -133,35 +158,35 @@
|
|||
group = "root";
|
||||
fetchScript = ''
|
||||
smtp_password=$(simple_get "/api-keys/chaos_mail/gotosocial" .password)
|
||||
echo "GTS_SMTP_PASSWORD=$smtp_password" > $secretFile
|
||||
echo "GTS_SMTP_PASSWORD=$smtp_password" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
# Container: quassel
|
||||
quassel_restic_password = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/restic/Quassel" .password > $secretFile
|
||||
simple_get "/private-public-keys/restic/Quassel" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
quassel_restic_env = {
|
||||
fetchScript = ''
|
||||
RESTIC_USERNAME=$(simple_get "/api-keys/storage/restic/Quassel" .username)
|
||||
RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/Quassel" .password)
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Quassel" > $secretFile
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Quassel" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
# Container: piped
|
||||
piped_restic_password = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/restic/Piped" .password > $secretFile
|
||||
simple_get "/private-public-keys/restic/Piped" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
piped_restic_env = {
|
||||
fetchScript = ''
|
||||
RESTIC_USERNAME=$(simple_get "/api-keys/storage/restic/Piped" .username)
|
||||
RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/Piped" .password)
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Piped" > $secretFile
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Piped" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -5,10 +5,10 @@
|
|||
usb_encryption_passphrase = {manual = true;};
|
||||
|
||||
music_stream_password = {
|
||||
user = "chaos";
|
||||
user = 1000;
|
||||
group = "users";
|
||||
fetchScript = ''
|
||||
simple_get "/api-keys/music-stream" .password > $secretFile
|
||||
simple_get "/api-keys/music-stream" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -18,7 +18,7 @@
|
|||
group = "users";
|
||||
|
||||
fetchScript = ''
|
||||
simple_get "/api-keys/gitlab/gitlab_archiver" .token > $secretFile
|
||||
simple_get "/api-keys/gitlab/gitlab_archiver" .token > "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -32,26 +32,26 @@
|
|||
api_password=$(simple_get "/api-keys/storage/restic/Music" .password)
|
||||
restic_password=$(simple_get "/private-public-keys/restic/Music" .password)
|
||||
|
||||
echo > $secretFile
|
||||
echo "RESTIC_REPOSITORY=rest:https://''${api_username}:''${api_password}@storage-restic.owo.monster/Music" >> $secretFile
|
||||
echo "RESTIC_PASSWORD=''${restic_password}" >> $secretFile
|
||||
echo > "$secretFile"
|
||||
echo "RESTIC_REPOSITORY=rest:https://''${api_username}:''${api_password}@storage-restic.owo.monster/Music" >> "$secretFile"
|
||||
echo "RESTIC_PASSWORD=''${restic_password}" >> "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
# for internal wireguard VPN
|
||||
wg_priv = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/lappy-t495" .private > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/lappy-t495" .private > "$secretFile"
|
||||
'';
|
||||
};
|
||||
wg_preshared_hetzner-vm = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/lappy-t495" .preshared_keys.hetzner_vm > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/lappy-t495" .preshared_keys.hetzner_vm > "$secretFile"
|
||||
'';
|
||||
};
|
||||
wg_preshared_vault = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/lappy-t495" .preshared_keys.vault > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/lappy-t495" .preshared_keys.vault > "$secretFile"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,9 +1,7 @@
|
|||
{
|
||||
self,
|
||||
config,
|
||||
tree,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
|
|
@ -21,7 +19,7 @@
|
|||
|
||||
# disable zfs
|
||||
nixpkgs.overlays = [
|
||||
(final: super: {
|
||||
(_final: super: {
|
||||
zfs = super.zfs.overrideAttrs (_: {
|
||||
meta.platforms = [];
|
||||
});
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
user = "chaos";
|
||||
group = "users";
|
||||
fetchScript = ''
|
||||
simple_get "/api-keys/music-stream" .password > $secretFile
|
||||
simple_get "/api-keys/music-stream" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
# Required for home.apps.manual-backup-apps
|
||||
|
|
@ -16,7 +16,7 @@
|
|||
group = "users";
|
||||
|
||||
fetchScript = ''
|
||||
simple_get "/api-keys/gitlab/gitlab_archiver" .token > $secretFile
|
||||
simple_get "/api-keys/gitlab/gitlab_archiver" .token > "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -30,9 +30,9 @@
|
|||
api_password=$(simple_get "/api-keys/storage/restic/Music" .password)
|
||||
restic_password=$(simple_get "/private-public-keys/restic/Music" .password)
|
||||
|
||||
echo > $secretFile
|
||||
echo "RESTIC_REPOSITORY=rest:https://''${api_username}:''${api_password}@storage-restic.owo.monster/Music" >> $secretFile
|
||||
echo "RESTIC_PASSWORD=''${restic_password}" >> $secretFile
|
||||
echo > "$secretFile"
|
||||
echo "RESTIC_REPOSITORY=rest:https://''${api_username}:''${api_password}@storage-restic.owo.monster/Music" >> "$secretFile"
|
||||
echo "RESTIC_PASSWORD=''${restic_password}" >> "$secretFile"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
|
||||
home-manager.users.root = {
|
||||
imports = with tree; [home.base];
|
||||
home.stateVersion = "22.05";
|
||||
home.stateVersion = "23.05";
|
||||
};
|
||||
|
||||
home-manager.users.chaos = {
|
||||
|
|
@ -28,7 +28,7 @@
|
|||
home.programming.languages.rust
|
||||
home.programming.languages.nix
|
||||
];
|
||||
home.stateVersion = "22.05";
|
||||
home.stateVersion = "23.05";
|
||||
};
|
||||
|
||||
networking.firewall.enable = true;
|
||||
|
|
@ -39,5 +39,5 @@
|
|||
networking.hostName = "tablet";
|
||||
time.timeZone = "Europe/London";
|
||||
|
||||
system.stateVersion = "22.05";
|
||||
system.stateVersion = "23.05";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,34 +4,34 @@
|
|||
secrets = {
|
||||
restic_password = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/restic/Vault" .password > $secretFile
|
||||
simple_get "/private-public-keys/restic/Vault" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
restic_env = {
|
||||
fetchScript = ''
|
||||
RESTIC_USERNAME=$(simple_get "/api-keys/storage/restic/Vault" .username)
|
||||
RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/Vault" .password)
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Vault" > $secretFile
|
||||
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Vault" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
wg_priv = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/vault" .private > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/vault" .private > "$secretFile"
|
||||
'';
|
||||
};
|
||||
wg_preshared_hetzner-vm = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/vault" .preshared_keys.hetzner_vm > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/vault" .preshared_keys.hetzner_vm > "$secretFile"
|
||||
'';
|
||||
};
|
||||
wg_preshared_iphone8 = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/vault" .preshared_keys.iphone8 > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/vault" .preshared_keys.iphone8 > "$secretFile"
|
||||
'';
|
||||
};
|
||||
wg_preshared_lappy-t495 = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/vault" ".preshared_keys.lappy_t495" > $secretFile
|
||||
simple_get "/private-public-keys/wireguard/chaos-internal/vault" ".preshared_keys.lappy_t495" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -19,11 +19,11 @@
|
|||
|
||||
home-manager.users.root = {
|
||||
imports = with tree; [home.base home.dev.small];
|
||||
home.stateVersion = "22.05";
|
||||
home.stateVersion = "23.05";
|
||||
};
|
||||
|
||||
networking.hostName = "vault";
|
||||
time.timeZone = "Europe/London";
|
||||
|
||||
system.stateVersion = "22.05";
|
||||
system.stateVersion = "23.05";
|
||||
}
|
||||
|
|
|
|||
392
ic";
392
ic";
|
|
@ -1,392 +0,0 @@
|
|||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/modules/mailserver/default.nix b/hosts/hetzner-vm/containers/mail/modules/mailserver/default.nix[m
|
||||
[1mindex 0e9f1da..73979dd 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/modules/mailserver/default.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/modules/mailserver/default.nix[m
|
||||
[36m@@ -4,9 +4,9 @@[m
|
||||
...[m
|
||||
}:[m
|
||||
with lib; let[m
|
||||
[31m- cfg = config.mailserver;[m
|
||||
[32m+[m[32m cfg = config.services.mailserver;[m
|
||||
in {[m
|
||||
[31m- options.mailserver = {[m
|
||||
[32m+[m[32m options.services.mailserver = {[m
|
||||
enable = mkEnableOption "mailserver";[m
|
||||
[m
|
||||
fqdn = mkOption {type = types.str;};[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/modules/mailserver/dovecot.nix b/hosts/hetzner-vm/containers/mail/modules/mailserver/dovecot.nix[m
|
||||
[1mindex ef5f01d..d306611 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/modules/mailserver/dovecot.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/modules/mailserver/dovecot.nix[m
|
||||
[36m@@ -4,7 +4,7 @@[m
|
||||
lib,[m
|
||||
...[m
|
||||
}: let[m
|
||||
[31m- mail_config = config.mailserver;[m
|
||||
[32m+[m[32m mail_config = config.services.mailserver;[m
|
||||
[m
|
||||
vmail_config = mail_config.vmail_config;[m
|
||||
[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/modules/mailserver/firewall.nix b/hosts/hetzner-vm/containers/mail/modules/mailserver/firewall.nix[m
|
||||
[1mindex 6c69bb3..0602a9a 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/modules/mailserver/firewall.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/modules/mailserver/firewall.nix[m
|
||||
[36m@@ -3,7 +3,7 @@[m
|
||||
config,[m
|
||||
...[m
|
||||
}: let[m
|
||||
[31m- mail_config = config.mailserver;[m
|
||||
[32m+[m[32m mail_config = config.services.mailserver;[m
|
||||
in {[m
|
||||
config = lib.mkIf mail_config.enable {[m
|
||||
networking.firewall = {[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/modules/mailserver/opendkim.nix b/hosts/hetzner-vm/containers/mail/modules/mailserver/opendkim.nix[m
|
||||
[1mindex 3297ee5..32e2481 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/modules/mailserver/opendkim.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/modules/mailserver/opendkim.nix[m
|
||||
[36m@@ -5,7 +5,7 @@[m
|
||||
...[m
|
||||
}:[m
|
||||
with lib; let[m
|
||||
[31m- mail_config = config.mailserver;[m
|
||||
[32m+[m[32m mail_config = config.services.mailserver;[m
|
||||
dkimUser = config.services.opendkim.user;[m
|
||||
dkimGroup = config.services.opendkim.group;[m
|
||||
[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/modules/mailserver/postfix.nix b/hosts/hetzner-vm/containers/mail/modules/mailserver/postfix.nix[m
|
||||
[1mindex 8599bbf..b795a26 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/modules/mailserver/postfix.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/modules/mailserver/postfix.nix[m
|
||||
[36m@@ -4,7 +4,7 @@[m
|
||||
lib,[m
|
||||
...[m
|
||||
}: let[m
|
||||
[31m- mail_config = config.mailserver;[m
|
||||
[32m+[m[32m mail_config = config.services.mailserver;[m
|
||||
submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''[m
|
||||
/^Received:/ IGNORE[m
|
||||
/^X-Originating-IP:/ IGNORE[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/modules/mailserver/rspamd.nix b/hosts/hetzner-vm/containers/mail/modules/mailserver/rspamd.nix[m
|
||||
[1mindex 5df6349..be9ae1e 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/modules/mailserver/rspamd.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/modules/mailserver/rspamd.nix[m
|
||||
[36m@@ -3,7 +3,7 @@[m
|
||||
lib,[m
|
||||
...[m
|
||||
}: let[m
|
||||
[31m- mail_config = config.mailserver;[m
|
||||
[32m+[m[32m mail_config = config.services.mailserver;[m
|
||||
[m
|
||||
postfixCfg = config.services.postfix;[m
|
||||
rspamdCfg = config.services.rspamd;[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/modules/mailserver/ssl.nix b/hosts/hetzner-vm/containers/mail/modules/mailserver/ssl.nix[m
|
||||
[1mindex f0f26bd..c7d7a61 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/modules/mailserver/ssl.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/modules/mailserver/ssl.nix[m
|
||||
[36m@@ -3,7 +3,7 @@[m
|
||||
lib,[m
|
||||
...[m
|
||||
}: let[m
|
||||
[31m- mail_config = config.mailserver;[m
|
||||
[32m+[m[32m mail_config = config.services.mailserver;[m
|
||||
acmeRoot = "/var/lib/acme/acme-challenge";[m
|
||||
in {[m
|
||||
config = lib.mkIf (mail_config.enable && mail_config.ssl_config.useACME) {[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/modules/mailserver/vmail.nix b/hosts/hetzner-vm/containers/mail/modules/mailserver/vmail.nix[m
|
||||
[1mindex 90ee44f..44a4e42 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/modules/mailserver/vmail.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/modules/mailserver/vmail.nix[m
|
||||
[36m@@ -4,7 +4,7 @@[m
|
||||
lib,[m
|
||||
...[m
|
||||
}: let[m
|
||||
[31m- mail_config = config.mailserver;[m
|
||||
[32m+[m[32m mail_config = config.services.mailserver;[m
|
||||
[m
|
||||
vmail_config = mail_config.vmail_config;[m
|
||||
vmail_user = vmail_config.user;[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/modules/mailserver/webmail.nix b/hosts/hetzner-vm/containers/mail/modules/mailserver/webmail.nix[m
|
||||
[1mindex 8230c64..e38e194 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/modules/mailserver/webmail.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/modules/mailserver/webmail.nix[m
|
||||
[36m@@ -3,7 +3,7 @@[m
|
||||
lib,[m
|
||||
...[m
|
||||
}: let[m
|
||||
[31m- mail_config = config.mailserver;[m
|
||||
[32m+[m[32m mail_config = config.services.mailserver;[m
|
||||
in {[m
|
||||
config = lib.mkIf (mail_config.enable && mail_config.enable_roundcube) {[m
|
||||
services.roundcube = {[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/profiles/mailserver.nix b/hosts/hetzner-vm/containers/mail/profiles/mailserver.nix[m
|
||||
[1mindex bed2716..3fd9bbf 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/profiles/mailserver.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/profiles/mailserver.nix[m
|
||||
[36m@@ -1,7 +1,11 @@[m
|
||||
[31m-{host_secrets, ...}: let[m
|
||||
[32m+[m[32m{[m
|
||||
[32m+[m[32m pkgs,[m
|
||||
[32m+[m[32m host_secrets,[m
|
||||
[32m+[m[32m ...[m
|
||||
[32m+[m[32m}: let[m
|
||||
secrets = host_secrets;[m
|
||||
in {[m
|
||||
[31m- config.mailserver = {[m
|
||||
[32m+[m[32m services.mailserver = {[m
|
||||
enable = true;[m
|
||||
fqdn = "mail.owo.monster";[m
|
||||
domains = ["owo.monster"];[m
|
||||
[36m@@ -56,15 +60,23 @@[m [min {[m
|
||||
};[m
|
||||
};[m
|
||||
[m
|
||||
[31m- config.systemd.tmpfiles.rules = [[m
|
||||
[32m+[m[32m systemd.tmpfiles.rules = [[m
|
||||
"d /var/sockets - nginx nginx"[m
|
||||
];[m
|
||||
[m
|
||||
[31m- config.systemd.services.nginx.serviceConfig.ReadWritePaths = [[m
|
||||
[32m+[m[32m systemd.services.nginx.serviceConfig.ReadWritePaths = [[m
|
||||
"/var/sockets"[m
|
||||
];[m
|
||||
[m
|
||||
[31m- config.services.nginx.virtualHosts."mail.owo.monster" = {[m
|
||||
[32m+[m[32m services.roundcube = {[m
|
||||
[32m+[m[32m package = pkgs.roundcube.withPlugins (plugins:[m
|
||||
[32m+[m[32m with pkgs.roundcubePlugins; [[m
|
||||
[32m+[m[32m persistent_login[m
|
||||
[32m+[m[32m ]);[m
|
||||
[32m+[m[32m plugins = ["persistent_login"];[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m
|
||||
[32m+[m[32m services.nginx.virtualHosts."mail.owo.monster" = {[m
|
||||
listen = [[m
|
||||
{[m
|
||||
addr = "127.0.0.1";[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/mail/profiles/restic.nix b/hosts/hetzner-vm/containers/mail/profiles/restic.nix[m
|
||||
[1mindex 18ac0ef..d66cb66 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/mail/profiles/restic.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/mail/profiles/restic.nix[m
|
||||
[36m@@ -6,7 +6,7 @@[m
|
||||
...[m
|
||||
}: let[m
|
||||
secrets = host_secrets;[m
|
||||
[31m- mail_config = config.mailserver;[m
|
||||
[32m+[m[32m mail_config = config.services.mailserver;[m
|
||||
backupPrepareCommand = "${[m
|
||||
(pkgs.writeShellScriptBin "backupPrepareCommand" ''[m
|
||||
systemctl start postgresqlBackup-roundcube --wait[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/music/data/ports.nix b/hosts/hetzner-vm/containers/music/data/ports.nix[m
|
||||
[1mindex 4fdaed1..4209c4b 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/music/data/ports.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/music/data/ports.nix[m
|
||||
[36m@@ -4,4 +4,5 @@[m
|
||||
mpd-opus-medium = 4243;[m
|
||||
mpd-opus-high = 4244;[m
|
||||
mpd-flac = 4245;[m
|
||||
[32m+[m[32m skskd = 5000;[m
|
||||
}[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/music/music.nix b/hosts/hetzner-vm/containers/music/music.nix[m
|
||||
[1mindex b199191..44e403d 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/music/music.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/music/music.nix[m
|
||||
[36m@@ -11,13 +11,22 @@[m
|
||||
[m
|
||||
# Using secrets from Host[m
|
||||
secrets = config.services.secrets.secrets;[m
|
||||
[32m+[m[32m containerName = "music";[m
|
||||
[32m+[m
|
||||
[32m+[m[32m socketPathFor = ([m
|
||||
[32m+[m[32m name: "/var/lib/nixos-containers/${containerName}/var/sockets/${name}.sock"[m
|
||||
[32m+[m[32m );[m
|
||||
[m
|
||||
ports = import ./data/ports.nix {};[m
|
||||
in {[m
|
||||
networking.nat.forwardPorts = [[m
|
||||
{[m
|
||||
[31m- sourcePort = 6600;[m
|
||||
[31m- destination = "${containerIP}\:6600";[m
|
||||
[32m+[m[32m sourcePort = ports.mpd;[m
|
||||
[32m+[m[32m destination = "${containerIP}\:${toString ports.mpd}";[m
|
||||
[32m+[m[32m }[m
|
||||
[32m+[m[32m {[m
|
||||
[32m+[m[32m sourcePort = ports.slskd;[m
|
||||
[32m+[m[32m destination = "${containerIP}\:${toString ports.slskd}";[m
|
||||
}[m
|
||||
];[m
|
||||
[m
|
||||
[36m@@ -26,13 +35,16 @@[m [min {[m
|
||||
privateNetwork = true;[m
|
||||
hostAddress = hostIP;[m
|
||||
localAddress = containerIP;[m
|
||||
[31m- bindMounts = lib.mkMerge (lib.forEach ["mpd_control_password"] (secret_name: let[m
|
||||
[31m- path = "${secrets.${secret_name}.path}";[m
|
||||
[31m- in {[m
|
||||
[31m- "${path}" = {[m
|
||||
[31m- hostPath = "${path}";[m
|
||||
[31m- };[m
|
||||
[31m- }));[m
|
||||
[32m+[m[32m bindMounts = lib.mkMerge (lib.forEach [[m
|
||||
[32m+[m[32m "mpd_control_password"[m
|
||||
[32m+[m[32m "slskd_env"[m
|
||||
[32m+[m[32m ] (secret_name: let[m
|
||||
[32m+[m[32m path = "${secrets.${secret_name}.path}";[m
|
||||
[32m+[m[32m in {[m
|
||||
[32m+[m[32m "${path}" = {[m
|
||||
[32m+[m[32m hostPath = "${path}";[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m[32m }));[m
|
||||
[m
|
||||
config = {[m
|
||||
config,[m
|
||||
[36m@@ -51,6 +63,7 @@[m [min {[m
|
||||
inputs.home-manager-unstable.nixosModules.home-manager[m
|
||||
[m
|
||||
profiles.sshd[m
|
||||
[32m+[m[32m profiles.nginx[m
|
||||
[m
|
||||
modules.nixos.secrets[m
|
||||
[m
|
||||
[36m@@ -59,6 +72,7 @@[m [min {[m
|
||||
++ (with hosts.hetzner-vm.containers.music; [[m
|
||||
profiles.music-sync[m
|
||||
profiles.mpd[m
|
||||
[32m+[m[32m profiles.soulseek[m
|
||||
]);[m
|
||||
[m
|
||||
# For Shared Secrets[m
|
||||
[36m@@ -84,6 +98,14 @@[m [min {[m
|
||||
};[m
|
||||
};[m
|
||||
[m
|
||||
[32m+[m[32m services.nginx.virtualHosts."soulseek.owo.monster" = {[m
|
||||
[32m+[m[32m forceSSL = true;[m
|
||||
[32m+[m[32m enableACME = true;[m
|
||||
[32m+[m[32m locations."/" = {[m
|
||||
[32m+[m[32m proxyPass = "http://${containerIP}:80";[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m
|
||||
services.nginx.virtualHosts."stream.owo.monster" = let[m
|
||||
extraConfig = ''[m
|
||||
auth_basic "Music Password";[m
|
||||
[36m@@ -117,5 +139,8 @@[m [min {[m
|
||||
gid = config.ids.gids.mpd;[m
|
||||
};[m
|
||||
[m
|
||||
[31m- networking.firewall.allowedTCPPorts = [6600];[m
|
||||
[32m+[m[32m networking.firewall.allowedTCPPorts = with ports; [[m
|
||||
[32m+[m[32m mpd[m
|
||||
[32m+[m[32m slskd[m
|
||||
[32m+[m[32m ];[m
|
||||
}[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/music/profiles/soulseek.nix b/hosts/hetzner-vm/containers/music/profiles/soulseek.nix[m
|
||||
[1mnew file mode 100644[m
|
||||
[1mindex 0000000..d7906eb[m
|
||||
[1m--- /dev/null[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/music/profiles/soulseek.nix[m
|
||||
[36m@@ -0,0 +1,40 @@[m
|
||||
[32m+[m[32m{[m
|
||||
[32m+[m[32m lib,[m
|
||||
[32m+[m[32m host_secrets,[m
|
||||
[32m+[m[32m ...[m
|
||||
[32m+[m[32m}: let[m
|
||||
[32m+[m[32m ports = import ../data/ports.nix {};[m
|
||||
[32m+[m[32m secrets = host_secrets;[m
|
||||
[32m+[m
|
||||
[32m+[m[32m inherit (lib.modules) mkForce;[m
|
||||
[32m+[m[32min {[m
|
||||
[32m+[m[32m services.slskd = {[m
|
||||
[32m+[m[32m enable = true;[m
|
||||
[32m+[m[32m openFirewall = true;[m
|
||||
[32m+[m[32m environmentFile = secrets.slskd_env.path;[m
|
||||
[32m+[m[32m settings = {[m
|
||||
[32m+[m[32m remote_configuration = false;[m
|
||||
[32m+[m[32m remote_file_management = true;[m
|
||||
[32m+[m[32m soulseek = {[m
|
||||
[32m+[m[32m username = "chaoticryptidz";[m
|
||||
[32m+[m[32m description = "chaos's soulseek";[m
|
||||
[32m+[m[32m listen_port = ports.slskd;[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m[32m web.authentication = {[m
|
||||
[32m+[m[32m username = "chaos";[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m[32m shares.directories = [[m
|
||||
[32m+[m[32m "/Music"[m
|
||||
[32m+[m[32m ];[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m[32m nginx = {[m
|
||||
[32m+[m[32m enable = true; # I don't think this is even cheked[m
|
||||
[32m+[m[32m domainName = "soulseek.owo.monster";[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m
|
||||
[32m+[m[32m services.nginx.virtualHosts."soulseek.owo.monster" = {[m
|
||||
[32m+[m[32m forceSSL = mkForce false;[m
|
||||
[32m+[m[32m enableACME = mkForce false;[m
|
||||
[32m+[m[32m };[m
|
||||
[32m+[m[32m}[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/containers/social/profiles/backups.nix b/hosts/hetzner-vm/containers/social/profiles/backups.nix[m
|
||||
[1mindex 4d5346b..5e70ca1 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/containers/social/profiles/backups.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/containers/social/profiles/backups.nix[m
|
||||
[36m@@ -38,7 +38,7 @@[m
|
||||
}/bin/backupPrepareCommand";[m
|
||||
[m
|
||||
backupCleanupCommand = "${(pkgs.writeShellScriptBin "backupCleanupCommand" ''[m
|
||||
[31m- rm /var/lib/gotosocial/gts-export.json[m
|
||||
[32m+[m[32m rm /var/lib/gotosocial/gts-export.json || true[m
|
||||
'')}/bin/backupCleanupCommand";[m
|
||||
in {[m
|
||||
environment.systemPackages = with pkgs; [[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/hetzner-vm.nix b/hosts/hetzner-vm/hetzner-vm.nix[m
|
||||
[1mindex 7924a9b..a45dc1f 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/hetzner-vm.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/hetzner-vm.nix[m
|
||||
[36m@@ -42,7 +42,7 @@[m
|
||||
echo "Host: "[m
|
||||
systemctl --failed[m
|
||||
${lib.concatStringsSep "\n" (lib.forEach (lib.attrNames config.containers) (name: ''[m
|
||||
[31m- echo "Container: "[m
|
||||
[32m+[m[32m echo "Container: ${name}"[m
|
||||
systemctl -M ${name} --failed[m
|
||||
''))}[m
|
||||
'')[m
|
||||
[1mdiff --git a/hosts/hetzner-vm/secrets.nix b/hosts/hetzner-vm/secrets.nix[m
|
||||
[1mindex 30e3f97..98a1ab4 100644[m
|
||||
[1m--- a/hosts/hetzner-vm/secrets.nix[m
|
||||
[1m+++ b/hosts/hetzner-vm/secrets.nix[m
|
||||
[36m@@ -60,6 +60,15 @@[m
|
||||
htpasswd -bc $secretFile "$username" "$password" 2>/dev/null[m
|
||||
'';[m
|
||||
};[m
|
||||
[32m+[m[32m slskd_env = {[m
|
||||
[32m+[m[32m fetchScript = ''[m
|
||||
[32m+[m[32m soulseek_password=$(simple_get "/passwords/soulseek" .password)[m
|
||||
[32m+[m[32m slskd_password=$(simple_get "/passwords/slskd" .password)[m
|
||||
[32m+[m[32m echo > $secretFile[m
|
||||
[32m+[m[32m echo "SLSKD_SLSK_PASSWORD=$soulseek_password" >> $secretFile[m
|
||||
[32m+[m[32m echo "SLSKD_PASSWORD=$slskd_password" >> $secretFile[m
|
||||
[32m+[m[32m '';[m
|
||||
[32m+[m[32m };[m
|
||||
[m
|
||||
# Container: mail[m
|
||||
mail_restic_password = {[m
|
||||
[1mdiff --git a/profiles/gui/base/default.nix b/profiles/gui/base/default.nix[m
|
||||
[1mindex 5563f5b..0786b5b 100644[m
|
||||
[1m--- a/profiles/gui/base/default.nix[m
|
||||
[1m+++ b/profiles/gui/base/default.nix[m
|
||||
[36m@@ -1,6 +1,11 @@[m
|
||||
[31m-{pkgs, lib, config, ...}: let [m
|
||||
[32m+[m[32m{[m
|
||||
[32m+[m[32m pkgs,[m
|
||||
[32m+[m[32m lib,[m
|
||||
[32m+[m[32m config,[m
|
||||
[32m+[m[32m ...[m
|
||||
[32m+[m[32m}: let[m
|
||||
inherit (lib.modules) mkIf;[m
|
||||
[31m- [m
|
||||
[32m+[m
|
||||
networkManagerEnabled = config.networking.networkmanager.enable;[m
|
||||
in {[m
|
||||
environment.systemPackages = with pkgs; [[m
|
||||
291
modules/nixos/secrets-lib/lib.nix
Normal file
291
modules/nixos/secrets-lib/lib.nix
Normal file
|
|
@ -0,0 +1,291 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
inherit (builtins) attrNames hasAttr isString;
|
||||
inherit (lib.lists) forEach unique flatten;
|
||||
inherit (lib.strings) concatStringsSep optionalString;
|
||||
inherit (lib.attrsets) mapAttrsToList filterAttrs;
|
||||
inherit (pkgs) writeShellApplication;
|
||||
|
||||
genScripts = cfg: let
|
||||
scriptBase = ''
|
||||
set -e -o pipefail
|
||||
${optionalString cfg.debug "set -x"}
|
||||
|
||||
set +u
|
||||
# If sysroot is set then make sure it has trailing /
|
||||
if [ -n "$SYSROOT" ]; then
|
||||
if ! (echo "$SYSROOT" | grep -q "/$"); then
|
||||
SYSROOT="$SYSROOT/"
|
||||
fi
|
||||
fi
|
||||
# If sysroot is empty then make sure it is empty so it doesn't error
|
||||
[ -z "$SYSROOT" ] && SYSROOT=
|
||||
set -u
|
||||
|
||||
if [ -n "$SYSROOT" ]; then
|
||||
echo "Using sysroot: $SYSROOT"
|
||||
fi
|
||||
|
||||
${optionalString cfg.createSecretsDir ''
|
||||
if [ ! -d "$SYSROOT${cfg.secretsDir}" ]; then
|
||||
mkdir -p "$SYSROOT${cfg.secretsDir}"
|
||||
chown "${userOrMappedID cfg.secretsDirUser}:${groupOrMappedID cfg.secretsDirGroup}" "$SYSROOT${cfg.secretsDir}"
|
||||
fi
|
||||
|
||||
userLookupFailed=false
|
||||
${concatStringsSep "\n" (forEach allUsersNotMappedToUID (user: ''
|
||||
if ! getent passwd ${user} >/dev/null; then
|
||||
echo "User ${user} could not be found on the host system"
|
||||
userLookupFailed=true
|
||||
fi
|
||||
''))}
|
||||
|
||||
groupLookupFailed=false
|
||||
${concatStringsSep "\n" (forEach allGroupsNotMappedToGID (group: ''
|
||||
if ! getent group ${group} >/dev/null; then
|
||||
echo "Group ${group} could not be found on the host system"
|
||||
groupLookupFailed=true
|
||||
fi
|
||||
''))}
|
||||
|
||||
if $userLookupFailed; then
|
||||
echo "Please add mappings in uidMap in order for this script to work"
|
||||
fi
|
||||
if $groupLookupFailed; then
|
||||
echo "Please add mappings in gidMap in order for this script to work"
|
||||
fi
|
||||
|
||||
if $userLookupFailed ̣ || $groupLookupFailed; then
|
||||
exit 1
|
||||
fi
|
||||
''}
|
||||
'';
|
||||
|
||||
allUsers = unique ([cfg.secretsDirUser]
|
||||
++ flatten (
|
||||
forEach (attrNames cfg.secrets) (name: cfg.secrets.${name}.user)
|
||||
));
|
||||
|
||||
allGroups = unique ([cfg.secretsDirGroup]
|
||||
++ flatten (
|
||||
forEach (attrNames cfg.secrets) (name: cfg.secrets.${name}.group)
|
||||
));
|
||||
|
||||
allUsersByName = lib.filter isString allUsers;
|
||||
allGroupsByName = lib.filter isString allGroups;
|
||||
|
||||
allUsersNotMappedToUID = lib.filter (name: !(hasAttr name cfg.uidMap)) allUsersByName;
|
||||
allGroupsNotMappedToGID = lib.filter (name: !(hasAttr name cfg.gidMap)) allGroupsByName;
|
||||
|
||||
isUserMapped = name: (hasAttr name cfg.uidMap);
|
||||
isGroupMapped = name: (hasAttr name cfg.gidMap);
|
||||
|
||||
userOrMappedID = user:
|
||||
if (isString user && (hasAttr user cfg.uidMap))
|
||||
then (toString cfg.uidMap.${user})
|
||||
else toString user;
|
||||
groupOrMappedID = group:
|
||||
if (isString group && (hasAttr group cfg.gidMap))
|
||||
then (toString cfg.gidMap.${group})
|
||||
else toString group;
|
||||
|
||||
manualSecrets = filterAttrs (_: secret: secret.manual) cfg.secrets;
|
||||
nonManualSecrets = filterAttrs (_: secret: !secret.manual) cfg.secrets;
|
||||
in {
|
||||
initScript =
|
||||
''
|
||||
${scriptBase}
|
||||
|
||||
VAULT_ADDR_DEFAULT="${cfg.vaultURL}"
|
||||
set +u
|
||||
[ -z "$VAULT_ADDR" ] && export VAULT_ADDR="$VAULT_ADDR_DEFAULT"
|
||||
set -u
|
||||
|
||||
kv_get() {
|
||||
vault kv get -format json "$1"
|
||||
}
|
||||
|
||||
simple_get() {
|
||||
kv_get "$1" | jq ".data.data$2" -r
|
||||
}
|
||||
|
||||
${cfg.extraFunctions}
|
||||
''
|
||||
+ (concatStringsSep "\n" (mapAttrsToList (_name: secret: let
|
||||
secretPath = secret.path;
|
||||
secretUser = userOrMappedID secret.user;
|
||||
secretGroup = groupOrMappedID secret.group;
|
||||
secretPermissions = secret.permissions;
|
||||
in ''
|
||||
if [[ ! -f "$SYSROOT${secretPath}" ]]; then
|
||||
echo "Initializing Secret ${secretPath}"
|
||||
else
|
||||
echo "Updating Secret ${secretPath}"
|
||||
fi
|
||||
|
||||
secretFile="$SYSROOT${secretPath}"
|
||||
${secret.fetchScript}
|
||||
|
||||
chown ${secretUser}:${secretGroup} "$SYSROOT${secretPath}"
|
||||
chmod ${secretPermissions} "$SYSROOT${secretPath}"
|
||||
'')
|
||||
nonManualSecrets))
|
||||
+ (concatStringsSep "\n" (mapAttrsToList
|
||||
(_name: secret: let
|
||||
secretPath = secret.path;
|
||||
secretUser = userOrMappedID secret.user;
|
||||
secretGroup = groupOrMappedID secret.group;
|
||||
secretPermissions = secret.permissions;
|
||||
in ''
|
||||
if [[ ! -f "$SYSROOT${secretPath}" ]]; then
|
||||
echo "Manual Secret ${secretPath} Doesn't Exist"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Updating Permissions on Manual Secret ${secretPath}"
|
||||
|
||||
chown ${secretUser}:${secretGroup} "$SYSROOT${secretPath}"
|
||||
chmod ${secretPermissions} "$SYSROOT${secretPath}"
|
||||
'')
|
||||
manualSecrets))
|
||||
+ ''
|
||||
echo "Secrets Deployed"
|
||||
'';
|
||||
|
||||
checkScript =
|
||||
''
|
||||
${scriptBase}
|
||||
|
||||
getUser() {
|
||||
stat --format "%U" "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
getUserID() {
|
||||
stat --format "%u" "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
getGroup() {
|
||||
stat --format "%G" "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
getGroupID() {
|
||||
stat --format "%G" "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
userNameMatches() {
|
||||
[[ "$(getUser "$1")" == "$2" ]]
|
||||
}
|
||||
|
||||
userIDMatches() {
|
||||
[[ "$(getUserID "$1")" == "$2" ]]
|
||||
}
|
||||
|
||||
groupNameMatches() {
|
||||
[[ "$(getGroup "$1")" == "$2" ]]
|
||||
}
|
||||
|
||||
groupIDMatches() {
|
||||
[[ "$(getGroupID "$1")" == "$2" ]]
|
||||
}
|
||||
|
||||
getPermissions() {
|
||||
stat --format "%a" "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
GLOBAL_FAIL=false
|
||||
''
|
||||
+ (concatStringsSep "\n" (mapAttrsToList (_name: secret: let
|
||||
secretPath = secret.path;
|
||||
|
||||
secretUser = secret.user;
|
||||
secretUserMaybeMapped = userOrMappedID secretUser;
|
||||
|
||||
secretGroup = secret.group;
|
||||
secretGroupMaybeMapped = groupOrMappedID secretGroup;
|
||||
|
||||
secretPermissions = secret.permissions;
|
||||
|
||||
userCheck =
|
||||
if (isString secretUser && !isUserMapped secretUser)
|
||||
then "userNameMatches \"${secretPath}\" ${secretUser}"
|
||||
else "userIDMatches \"${secretPath}\" ${secretUserMaybeMapped}";
|
||||
groupCheck =
|
||||
if (isString secretGroup && !isGroupMapped secretGroup)
|
||||
then "groupNameMatches \"${secretPath}\" ${secretGroup}"
|
||||
else "groupIDMatches \"${secretPath}\" ${secretGroupMaybeMapped}";
|
||||
in ''
|
||||
LOCAL_FAIL=false
|
||||
|
||||
echo "Checking ${secretPath}"
|
||||
|
||||
# some variables which can be used by checkScript
|
||||
# shellcheck disable=SC2034
|
||||
secretFile="$SYSROOT${secretPath}"
|
||||
|
||||
if [[ -f "$SYSROOT${secretPath}" ]]; then
|
||||
echo "✅ File Exists"
|
||||
else
|
||||
echo "❌ File Does Not Exist"
|
||||
LOCAL_FAIL=true
|
||||
fi
|
||||
|
||||
if getUserID "$SYSROOT${secretPath}" >/dev/null && ${userCheck}; then
|
||||
echo "✅ File Is Owned By Correct User"
|
||||
else
|
||||
echo "❌ File Is Not Owned By Correct User (${toString secretUser})"
|
||||
LOCAL_FAIL=true
|
||||
fi
|
||||
|
||||
if getGroupID "$SYSROOT${secretPath}" >/dev/null && ${groupCheck}; then
|
||||
echo "✅ File Is Owned By Correct Group"
|
||||
else
|
||||
echo "❌ File Is Not Owned By Correct Group (${toString secretGroup})"
|
||||
LOCAL_FAIL=true
|
||||
fi
|
||||
|
||||
if getPermissions "$SYSROOT${secretPath}" >/dev/null && [[ "$(getPermissions "$SYSROOT${secretPath}")" -eq "${secretPermissions}" ]]; then
|
||||
echo "✅ File Has Correct Permissions"
|
||||
else
|
||||
echo "❌ File Does Not Have Correct Permissions (${secretPermissions})"
|
||||
LOCAL_FAIL=true
|
||||
fi
|
||||
|
||||
${optionalString (secret.checkScript != null) secret.checkScript}
|
||||
|
||||
if [[ "$LOCAL_FAIL" == "true" ]]; then
|
||||
echo "❌ File Did Not Pass The Vibe Check"
|
||||
GLOBAL_FAIL=true
|
||||
else
|
||||
echo "✅ File Passed The Vibe Check"
|
||||
fi
|
||||
|
||||
echo
|
||||
'')
|
||||
cfg.secrets))
|
||||
+ ''
|
||||
if [[ "$GLOBAL_FAIL" == "true" ]]; then
|
||||
echo "❌ One Or More Secrets Did Not Pass The Vibe Check"
|
||||
exit 1
|
||||
else
|
||||
echo "✅ All Secrets Passed The Vibe Check"
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
defaultPackages = with pkgs; [vault jq];
|
||||
in {
|
||||
inherit genScripts;
|
||||
|
||||
mkSecretsInitScript = (
|
||||
cfg: name: let
|
||||
scripts = genScripts cfg;
|
||||
in (writeShellApplication {
|
||||
name = "secrets-init-${name}";
|
||||
runtimeInputs = defaultPackages ++ cfg.packages;
|
||||
text = scripts.initScript;
|
||||
})
|
||||
);
|
||||
}
|
||||
|
|
@ -3,10 +3,17 @@
|
|||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
}: let
|
||||
inherit (lib.modules) mkIf mkMerge;
|
||||
inherit (lib.options) mkOption;
|
||||
inherit (lib) types;
|
||||
inherit (pkgs) writeShellApplication;
|
||||
|
||||
cfg = config.services.secrets;
|
||||
defaultPackages = with pkgs; [pkgs.vault pkgs.jq];
|
||||
|
||||
secretsLib = import ./secrets-lib/lib.nix {
|
||||
inherit lib pkgs;
|
||||
};
|
||||
in {
|
||||
options = {
|
||||
services.secrets = {
|
||||
|
|
@ -26,12 +33,12 @@ in {
|
|||
};
|
||||
|
||||
secretsDirUser = mkOption {
|
||||
type = types.str;
|
||||
type = types.either types.str types.int;
|
||||
default = "root";
|
||||
};
|
||||
|
||||
secretsDirGroup = mkOption {
|
||||
type = types.str;
|
||||
type = types.either types.str types.int;
|
||||
default = "root";
|
||||
};
|
||||
|
||||
|
|
@ -52,21 +59,33 @@ in {
|
|||
description = "extra bash functions to add to top of script";
|
||||
};
|
||||
|
||||
extraPackages = mkOption {
|
||||
uidMap = mkOption {
|
||||
type = types.attrsOf types.int;
|
||||
default = {};
|
||||
description = "optional mapping of users to user IDs; required for SYSROOT when user isn't available on host";
|
||||
};
|
||||
|
||||
gidMap = mkOption {
|
||||
type = types.attrsOf types.int;
|
||||
default = {};
|
||||
description = "optional mapping of groups to group IDs; required for SYSROOT when group isn't available on host";
|
||||
};
|
||||
|
||||
packages = mkOption {
|
||||
type = types.listOf types.package;
|
||||
default = [];
|
||||
description = "extra packages for script";
|
||||
default = with pkgs; [];
|
||||
description = "packages for script";
|
||||
};
|
||||
|
||||
secrets = mkOption {
|
||||
type = types.attrsOf (types.submodule ({name, ...}: {
|
||||
options = {
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
type = types.either types.str types.int;
|
||||
default = "root";
|
||||
};
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
type = types.either types.str types.int;
|
||||
default = "root";
|
||||
};
|
||||
permissions = mkOption {
|
||||
|
|
@ -79,9 +98,10 @@ in {
|
|||
};
|
||||
|
||||
fetchScript = mkOption {
|
||||
type = types.lines;
|
||||
type = types.nullOr types.lines;
|
||||
default = null;
|
||||
description = ''
|
||||
script used to fetch secrets, $file is secret.path
|
||||
script used to fetch secrets, $secretFile is secret.path
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -106,166 +126,26 @@ in {
|
|||
|
||||
config = mkMerge [
|
||||
(mkIf (cfg.enable) (let
|
||||
scriptBase = ''
|
||||
set -e -o pipefail
|
||||
${
|
||||
if cfg.debug
|
||||
then "set -x"
|
||||
else ""
|
||||
}
|
||||
'';
|
||||
|
||||
manualSecrets = filterAttrs (_: secret: secret.manual) cfg.secrets;
|
||||
nonManualSecrets = filterAttrs (_: secret: !secret.manual) cfg.secrets;
|
||||
|
||||
initScript =
|
||||
''
|
||||
${scriptBase}
|
||||
|
||||
VAULT_ADDR_DEFAULT="${cfg.vaultURL}"
|
||||
set +u
|
||||
[ -z "$VAULT_ADDR" ] && export VAULT_ADDR="$VAULT_ADDR_DEFAULT"
|
||||
set -u
|
||||
|
||||
kv_get() {
|
||||
vault kv get -format json "$1"
|
||||
}
|
||||
|
||||
simple_get() {
|
||||
kv_get "$1" | jq ".data.data$2" -r
|
||||
}
|
||||
|
||||
${cfg.extraFunctions}
|
||||
''
|
||||
+ (lib.concatStringsSep "\n" (lib.mapAttrsToList (_name: secret: ''
|
||||
if [[ ! -f "${secret.path}" ]]; then
|
||||
echo "Initializing Secret ${secret.path}"
|
||||
else
|
||||
echo "Updating Secret ${secret.path}"
|
||||
fi
|
||||
|
||||
secretFile="${secret.path}"
|
||||
${secret.fetchScript}
|
||||
|
||||
chown ${secret.user}:${secret.group} "${secret.path}"
|
||||
chmod ${secret.permissions} "${secret.path}"
|
||||
'')
|
||||
nonManualSecrets))
|
||||
+ (lib.concatStringsSep "\n" (lib.mapAttrsToList
|
||||
(_name: secret: ''
|
||||
if [[ ! -f "${secret.path}" ]]; then
|
||||
echo "Manual Secret ${secret.path} Doesn't Exist"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Updating Permissions on Manual Secret ${secret.path}"
|
||||
|
||||
chown ${secret.user}:${secret.group} "${secret.path}"
|
||||
chmod ${secret.permissions} "${secret.path}"
|
||||
'')
|
||||
manualSecrets))
|
||||
+ ''
|
||||
echo "Secrets Deployed"
|
||||
'';
|
||||
|
||||
checkScript =
|
||||
''
|
||||
${scriptBase}
|
||||
|
||||
getUser() {
|
||||
stat --format "%U" "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
getGroup() {
|
||||
stat --format "%G" "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
getPermissions() {
|
||||
stat --format "%a" "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
GLOBAL_FAIL=false
|
||||
''
|
||||
+ (lib.concatStringsSep "\n" (lib.mapAttrsToList (name: secret: ''
|
||||
LOCAL_FAIL=false
|
||||
|
||||
echo "Secret: ${name}"
|
||||
echo "Checking ${secret.path}"
|
||||
|
||||
# some variables which can be used by checkScript
|
||||
# shellcheck disable=SC2034
|
||||
secretFile="${secret.path}"
|
||||
|
||||
if [[ -f "${secret.path}" ]]; then
|
||||
echo "✅ File Exists"
|
||||
else
|
||||
echo "❌ File Does Not Exist"
|
||||
LOCAL_FAIL=true
|
||||
fi
|
||||
|
||||
if getUser "${secret.path}" >/dev/null && [[ "$(getUser "${secret.path}")" == "${secret.user}" ]]; then
|
||||
echo "✅ File Is Owned By Correct User"
|
||||
else
|
||||
echo "❌ File Is Not Owned By Correct User (${secret.user})"
|
||||
LOCAL_FAIL=true
|
||||
fi
|
||||
|
||||
if getGroup "${secret.path}" >/dev/null && [[ "$(getGroup "${secret.path}")" == "${secret.group}" ]]; then
|
||||
echo "✅ File Is Owned By Correct Group"
|
||||
else
|
||||
echo "❌ File Is Not Owned By Correct Group (${secret.user})"
|
||||
LOCAL_FAIL=true
|
||||
fi
|
||||
|
||||
if getPermissions "${secret.path}" >/dev/null && [[ "$(getPermissions "${secret.path}")" -eq "${secret.permissions}" ]]; then
|
||||
echo "✅ File Has Correct Permissions"
|
||||
else
|
||||
echo "❌ File Does Not Have Correct Permissions (${secret.permissions})"
|
||||
LOCAL_FAIL=true
|
||||
fi
|
||||
|
||||
${
|
||||
if secret.checkScript != null
|
||||
then secret.checkScript
|
||||
else ""
|
||||
}
|
||||
|
||||
if [[ "$LOCAL_FAIL" == "true" ]]; then
|
||||
echo "❌ File Did Not Pass The Vibe Check"
|
||||
GLOBAL_FAIL=true
|
||||
else
|
||||
echo "✅ File Passed The Vibe Check"
|
||||
fi
|
||||
|
||||
echo
|
||||
'')
|
||||
cfg.secrets))
|
||||
+ ''
|
||||
if [[ "$GLOBAL_FAIL" == "true" ]]; then
|
||||
echo "❌ One Or More Secrets Did Not Pass The Vibe Check"
|
||||
exit 1
|
||||
else
|
||||
echo "✅ All Secrets Passed The Vibe Check"
|
||||
fi
|
||||
'';
|
||||
scripts = secretsLib.genScripts cfg;
|
||||
defaultPackages = with pkgs; [vault jq];
|
||||
in {
|
||||
environment.systemPackages = [
|
||||
(pkgs.writeShellApplication {
|
||||
name = "secrets-check";
|
||||
runtimeInputs = defaultPackages ++ cfg.extraPackages;
|
||||
text = checkScript;
|
||||
})
|
||||
(pkgs.writeShellApplication {
|
||||
(writeShellApplication {
|
||||
name = "secrets-init";
|
||||
runtimeInputs = defaultPackages ++ cfg.extraPackages;
|
||||
text = initScript;
|
||||
runtimeInputs = defaultPackages ++ cfg.packages;
|
||||
text = scripts.initScript;
|
||||
})
|
||||
(writeShellApplication {
|
||||
name = "secrets-check";
|
||||
runtimeInputs = defaultPackages ++ cfg.packages;
|
||||
text = scripts.checkScript;
|
||||
})
|
||||
];
|
||||
}))
|
||||
|
||||
(mkIf (cfg.enable && cfg.createSecretsDir) {
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${cfg.secretsDir} - ${cfg.secretsDirUser} ${cfg.secretsDirGroup}"
|
||||
"d ${cfg.secretsDir} - ${toString cfg.secretsDirUser} ${toString cfg.secretsDirGroup}"
|
||||
];
|
||||
})
|
||||
];
|
||||
|
|
|
|||
43
outputs.nix
43
outputs.nix
|
|
@ -20,6 +20,40 @@ in
|
|||
(import ./overlay)
|
||||
];
|
||||
};
|
||||
|
||||
secretsLib = import ./modules/nixos/secrets-lib/lib.nix {
|
||||
inherit (nixpkgs) lib;
|
||||
inherit pkgs;
|
||||
};
|
||||
|
||||
secretsInitScriptForSystem = system_name: let
|
||||
systemConfig = self.nixosConfigurations.${system_name}.config;
|
||||
systemSecretsConfig = systemConfig.services.secrets;
|
||||
in
|
||||
secretsLib.mkSecretsInitScript systemSecretsConfig "${system_name}";
|
||||
|
||||
secretsInitScriptForSystemContainer = system_name: container_name: let
|
||||
systemConfig = self.nixosConfigurations.${system_name}.config;
|
||||
containerConfig = systemConfig.containers.${container_name}.config;
|
||||
containerSecretsConfig = containerConfig.services.secrets;
|
||||
in
|
||||
secretsLib.mkSecretsInitScript containerSecretsConfig "${system_name}-${container_name}";
|
||||
|
||||
secretsInitAppForSystem = system_name: packages: let
|
||||
name = "secrets-init-${system_name}";
|
||||
package = packages."${name}";
|
||||
in {
|
||||
type = "app";
|
||||
program = "${package}/bin/${name}";
|
||||
};
|
||||
|
||||
secretsInitAppForSystemContainer = system_name: container_name: packages: let
|
||||
name = "secrets-init-${system_name}-${container_name}";
|
||||
package = packages."${name}";
|
||||
in {
|
||||
type = "app";
|
||||
program = "${package}/bin/${name}";
|
||||
};
|
||||
in {
|
||||
devShell = pkgs.mkShell {
|
||||
VAULT_API_ADDR = "https://vault.owo.monster";
|
||||
|
|
@ -52,11 +86,20 @@ in
|
|||
type = "app";
|
||||
program = "${packages.mk-dual-enc-ssd}/bin/mk-dual-enc-ssd";
|
||||
};
|
||||
secrets-init-lappy-t495 = secretsInitAppForSystem "lappy-t495" packages;
|
||||
secrets-init-vault = secretsInitAppForSystem "vault" packages;
|
||||
secrets-init-hetzner-vm = secretsInitAppForSystem "hetzner-vm" packages;
|
||||
secrets-init-hetzner-vm-storage = secretsInitAppForSystemContainer "hetzner-vm" "storage" packages;
|
||||
};
|
||||
|
||||
packages = {
|
||||
inherit (pkgs) comic-code comic-sans;
|
||||
inherit (pkgs) mk-enc-usb mk-normal-enc-ssd mk-dual-enc-ssd;
|
||||
inherit (pkgs) gotosocial;
|
||||
secrets-init-lappy-t495 = secretsInitScriptForSystem "lappy-t495";
|
||||
|
||||
secrets-init-vault = secretsInitScriptForSystem "vault";
|
||||
secrets-init-hetzner-vm = secretsInitScriptForSystem "hetzner-vm";
|
||||
secrets-init-hetzner-vm-storage = secretsInitScriptForSystemContainer "hetzner-vm" "storage";
|
||||
};
|
||||
}))
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ final: prev: {
|
|||
mk-normal-enc-ssd = final.callPackage ../extras/mk-normal-enc-ssd.nix {};
|
||||
mk-dual-enc-ssd = final.callPackage ../extras/mk-dual-enc-ssd.nix {};
|
||||
|
||||
gotosocial = prev.gotosocial.overrideAttrs (old: let
|
||||
gotosocial = prev.gotosocial.overrideAttrs (_old: let
|
||||
owner = "superseriousbusiness";
|
||||
repo = "gotosocial";
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue