128 lines
4.1 KiB
Nix
128 lines
4.1 KiB
Nix
{ pkgs, ... }: {
|
|
|
|
services.secrets = {
|
|
enable = true;
|
|
|
|
extraPackages = with pkgs; [
|
|
# for music & mail passwd files
|
|
apacheHttpd
|
|
# for rclone obscure config file
|
|
rclone
|
|
];
|
|
|
|
extraFunctions = ''
|
|
simple_get_obscure() {
|
|
rclone obscure "$(simple_get "$@")"
|
|
}
|
|
|
|
simple_get_replace_b2() {
|
|
api_account=$(simple_get "$1" .keyID)
|
|
api_key=$(simple_get "$1" .applicationKey | sed "s#/#\\\/#")
|
|
|
|
replace_account=''${2}_ACCOUNT
|
|
replace_key=''${2}_KEY
|
|
|
|
sed -i "s/$replace_account/$api_account/" "$3"
|
|
sed -i "s/$replace_key/$api_key/" "$3"
|
|
}
|
|
'';
|
|
|
|
secrets = {
|
|
vault_password = { manual = true; };
|
|
|
|
restic_hetznervm_htpasswd = {
|
|
user = "storage";
|
|
group = "storage";
|
|
fetchScript = ''
|
|
username=$(simple_get "/api-keys/storage/restic/HetznerVM" .username)
|
|
password=$(simple_get "/api-keys/storage/restic/HetznerVM" .password)
|
|
htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
|
|
'';
|
|
};
|
|
restic_music_htpasswd = {
|
|
user = "storage";
|
|
group = "storage";
|
|
fetchScript = ''
|
|
username=$(simple_get "/api-keys/storage/restic/Music" .username)
|
|
password=$(simple_get "/api-keys/storage/restic/Music" .password)
|
|
htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
|
|
'';
|
|
};
|
|
restic_vault_htpasswd = {
|
|
user = "storage";
|
|
group = "storage";
|
|
fetchScript = ''
|
|
username=$(simple_get "/api-keys/storage/restic/Vault" .username)
|
|
password=$(simple_get "/api-keys/storage/restic/Vault" .password)
|
|
htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
|
|
'';
|
|
};
|
|
webdav_main_htpasswd = {
|
|
user = "storage";
|
|
group = "storage";
|
|
fetchScript = ''
|
|
username=$(simple_get "/api-keys/storage/webdav/main" .username)
|
|
password=$(simple_get "/api-keys/storage/webdav/main" .password)
|
|
htpasswd -bc "$secretFile" "$username" "$password" 2>&1
|
|
'';
|
|
};
|
|
|
|
rclone_config = {
|
|
user = "storage";
|
|
group = "storage";
|
|
fetchScript = ''
|
|
TMP_DIR="$(mktemp -d)"
|
|
|
|
cp ${./rclone_config.template} "$TMP_DIR/template"
|
|
|
|
pushd "$TMP_DIR"
|
|
|
|
STORAGEBOX_PASSWORD=$(simple_get_obscure /api-keys/hetzner/storagebox .password)
|
|
sed -i "s/STORAGEBOX_PASSWORD/$STORAGEBOX_PASSWORD/" ./template
|
|
|
|
simple_get_replace_b2 "/api-keys/backblaze/Chaos-Backups" "B2_CHAOS_BACKUPS" ./template
|
|
simple_get_replace_b2 "/api-keys/backblaze/Chaos-Photos" "B2_CHAOS_PHOTOS" ./template
|
|
simple_get_replace_b2 "/api-keys/backblaze/Chaos-Music" "B2_CHAOS_MUSIC" ./template
|
|
simple_get_replace_b2 "/api-keys/backblaze/Phoenix-Cryptidz-Storage" "B2_PHOENIX_CRYPTIDZ_STORAGE" ./template
|
|
|
|
cp ./template $secretFile
|
|
|
|
popd
|
|
|
|
rm -rf "$TMP_DIR"
|
|
'';
|
|
};
|
|
|
|
wg_privkey = {
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/storage" .private > $secretFile
|
|
'';
|
|
};
|
|
wg_preshared_hetzner-vm = {
|
|
path = "/secrets/wg_preshared_hetzner-vm";
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/storage" .preshared_keys.hetzner_vm > $secretFile
|
|
'';
|
|
};
|
|
wg_preshared_tablet = {
|
|
path = "/secrets/wg_preshared_tablet";
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/storage" .preshared_keys.tablet > $secretFile
|
|
'';
|
|
};
|
|
wg_preshared_vault = {
|
|
path = "/secrets/wg_preshared_vault";
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/storage" .preshared_keys.vault > $secretFile
|
|
'';
|
|
};
|
|
wg_preshared_iphone8 = {
|
|
path = "/secrets/wg_preshared_iphone8";
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/storage" .preshared_keys.iphone8 > $secretFile
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|