sstent/vmimages
1
0
Fork 0
mirror of https://github.com/sstent/vmimages.git synced 2025-12-05 21:51:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

reorg + condiational secrets

Browse Source
This commit is contained in:
sstent
2023-03-09 05:00:20 +00:00
parent 24ef309194
commit dea10b0752
23 changed files with 190 additions and 273 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.sops.yaml
View File

@@ -2,7 +2,7 @@ keys:
- &adminkey age1jvqe2j70h97844nkz34z9k4epx3uahx50cx75ss8mty2dnxlrf7qqv9a0g
- &StuPC-WSL_UBUNTU_2204 age1jvf8rd8krchw3ph0w2let8clvyuzcdhq2ug6sm7tx86refc2z5vq4w6lxr
- &StuPC-WSL_NIXOS age1e0g0rrfdmp5f8f4xgkyp8zgxw2v5t3ldlm2t822xekdz0z6qj49q6aesuw
- &GO3_WSL_NIXOS age187fdx6pc2559tjh03jrcwp6yj8whd70h666g8a0ptyr0z49tfcsssdx6au
- &go3_WSL_NIXOS age187fdx6pc2559tjh03jrcwp6yj8whd70h666g8a0ptyr0z49tfcsssdx6au
- &STU_ID age1r86w07gy3nm2ltkqx7wcv94wzneeqmqvcm88nzw4g902kdgwgvdqvjumrj
creation_rules:
- path_regex: host-secrets.yaml$
@@ -11,7 +11,7 @@ creation_rules:
- *adminkey
- *StuPC-WSL_UBUNTU_2204
- *StuPC-WSL_NIXOS
- *GO3_WSL_NIXOS
- *go3_WSL_NIXOS
- path_regex: user-secrets.yaml$
key_groups:
- age:
@@ -29,9 +29,9 @@ creation_rules:
- *adminkey
- *StuPC-WSL_NIXOS
- path_regex: secrets/hosts/Go3/.*$
- path_regex: secrets/hosts/go3-wsl/.*$
key_groups:
- age:
- *adminkey
- *GO3_WSL_NIXOS
- *go3_WSL_NIXOS

4
configuration.nix
View File

@@ -94,10 +94,10 @@ in
# map.modules ./devices (name: build.device (import name));
nixosConfigurations = {
Go3 = nixpkgs.lib.nixosSystem {
go3-wsl = nixpkgs.lib.nixosSystem {
specialArgs = { inherit inputs outputs; };
modules = [
./hosts/WSL/Go3
./hosts/WSL/go3-wsl
];
};
StuPC-WSL = nixpkgs.lib.nixosSystem {

10
flake.nix
View File

@@ -111,10 +111,10 @@
# NixOS configuration entrypoint
# Available through 'nixos-rebuild --flake .#your-hostname'
nixosConfigurations = {
Go3 = nixpkgs.lib.nixosSystem {
specialArgs = { inherit inputs outputs lib;hostName = "Go3"; };
go3-wsl = nixpkgs.lib.nixosSystem {
specialArgs = { inherit inputs outputs lib;hostName = "go3-wsl"; };
modules = [
./hosts/Go3
./hosts/go3-wsl
];
};
StuPC-WSL = nixpkgs.lib.nixosSystem {
@@ -130,10 +130,10 @@
# Available through 'home-manager --flake .#your-username@your-hostname'
homeConfigurations = {
# FIXME replace with your username@hostname
"sstent@Go3" = home-manager.lib.homeManagerConfiguration {
"sstent@go3-wsl" = home-manager.lib.homeManagerConfiguration {
# pkgs = nixpkgs.legacyPackages.x86_64-linux; # Home-manager requires 'pkgs' instance
pkgs = pkgs;
extraSpecialArgs = { inherit inputs outputs lib; hostName = "Go3"; };
extraSpecialArgs = { inherit inputs outputs lib; hostName = "go3-wsl"; };
modules = [
# > Our main home-manager configuration file <
./home-manager/users/sstent

2
home-manager/global/default.nix → home-manager/global.nix
View File

@@ -3,7 +3,7 @@
imports = [
# ./beets.nix
./keybase.nix
# ./keybase.nix
"${inputs.vscode-server}/modules/vscode-server/home.nix"
] ++ (builtins.attrValues outputs.homeManagerModules);

4
home-manager/users/sstent/default.nix
View File

@@ -8,7 +8,7 @@
# in
{
imports = [
../../global
../../global.nix
];
home.username = "sstent";
home.homeDirectory = "/home/sstent";
@@ -98,6 +98,8 @@ programs = {
enable = true;
userName = "sstent";
userEmail = "stuart.stent@gmail.com";
extraConfig = { pull.rebase = true; };
};
ssh = {
enable = true;

43
hosts/StuPC-WSL/default.nix
View File

@@ -2,7 +2,6 @@
imports = [
../common.nix
../mnt-public.nix
../user-sstent.nix
inputs.nixos-wsl.nixosModules.wsl
];
@@ -10,42 +9,12 @@
# system.stateVersion = "22.11";
nixpkgs.hostPlatform.system = "x86_64-linux";
networking.hostName = "StuPC-WSL";
custom.mullvad.enable = true;
wsl = {
enable = true;
wslConf.automount.root = "/mnt";
defaultUser = "sstent";
startMenuLaunchers = true;
interop.preserveArgvZero = true;
nativeSystemd = true;
# Enable native Docker support
docker-native.enable = true;
# Enable integration with Docker Desktop (needs to be installed)
# docker-desktop.enable = true;
};
systemd.services.nixs-wsl-systemd-fix = {
description = "Fix the /dev/shm symlink to be a mount";
unitConfig = {
DefaultDependencies = "no";
Before = [
"sysinit.target"
"systemd-tmpfiles-setup-dev.service"
"systemd-tmpfiles-setup.service"
"systemd-sysctl.service"
];
ConditionPathExists = "/dev/shm";
ConditionPathIsSymbolicLink = "/dev/shm";
ConditionPathIsMountPoint = "/run/shm";
};
serviceConfig = {
Type = "oneshot";
ExecStart = [
"${pkgs.coreutils-full}/bin/rm /dev/shm"
"/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
];
};
wantedBy = [ "sysinit.target" ];
custom = {
mullvad.enable = true;
mnt_public.enable = true;
syncthing.enable = true;
wsl.enable = true;
};
}

13
hosts/common.nix
View File

@@ -1,10 +1,9 @@
# This file (and the global directory) holds config that i use on all hosts
{ lib, inputs, outputs, pkgs, ... }:
{ lib, inputs, outputs, pkgs, config, ... }:
{
imports = [
inputs.home-manager.nixosModules.home-manager
./sops.nix
./syncthing.nix
inputs.sops-nix.nixosModules.sops
]++ (builtins.attrValues outputs.nixosModules);
###dotfiles path variable
@@ -32,6 +31,14 @@
config = {
system.stateVersion = "22.11";
sops = {
# defaultSopsFile = ./secrets.yaml;
defaultSopsFile = "${config._secretstore}/host-secrets.yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
home-manager = {
useUserPackages = true;
extraSpecialArgs = { inherit inputs outputs; };

20
hosts/go3-wsl/default.nix Normal file
View File

@@ -0,0 +1,20 @@
{ lib, pkgs, config, inputs, ... }: {
imports = [
../common.nix
../user-sstent.nix
inputs.nixos-wsl.nixosModules.wsl
];
# system.stateVersion = "22.11";
nixpkgs.hostPlatform.system = "x86_64-linux";
networking.hostName = "go3-wsl";
custom = {
mullvad.enable = true;
mnt_public.enable = true;
syncthing.enable = true;
wsl.enable = true;
};
}

31
hosts/mnt-public.nix
View File

@@ -1,31 +0,0 @@
{ lib, inputs, outputs, ... }:
{
fileSystems."/mnt/Public" = {
device = "//192.168.1.109/Public";
fsType = "cifs";
# options = ["uid=0,gid=1000"];
options = ["guest" "uid=1000"];
};
}
# { lib, pkgs, config, ... }:
# with lib;
# let cfg = config.services.ssh-proxy;
# in {
# options.services.ssh-proxy = {
# enable = mkOption {
# type = types.bool;
# default = false;
# description = ''
# Enable Mnt Public for WSL
# '';
# };
# };
# config = mkIf cfg.enable {
# }

18
hosts/sops.nix
View File

@@ -1,18 +0,0 @@
{ inputs, lib, config, ... }:
{
imports = [
inputs.sops-nix.nixosModules.sops
];
sops = {
# defaultSopsFile = ./secrets.yaml;
defaultSopsFile = "${config._secretstore}/host-secrets.yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# secrets.discogs_json = {
# mode = "0440";
# owner = config.users.users.sstent.name;
# group = config.users.users.sstent.group;
# };
};
}

61
hosts/syncthing.nix
View File

@@ -1,61 +0,0 @@
{ inputs, lib, config, pkgs, ... }:
let
# cfg = config.modules.services.syncthing;
host = config.networking.hostName;
# Device IDs don't really need to be secret, but according to syncthing docs
# one can get the device IP if they know the device ID.
# devices = import ../../secrets/syncthing-devices.nix;
# FFS!! path concatenation in nix is a pain in the ass! see
# https://gist.github.com/CMCDragonkai/de84aece83f8521d087416fa21e34df4
# cert-text = builtins.readFile ("${config._secretstore}/hosts/" + "/${host}" + /syncthing/cert.pem);
# key-text = builtins.readFile ("${config._secretstore}/hosts/" + "/${host}" + /syncthing/key.pem);
in {
services.syncthing = {
enable = true;
dataDir = "/home/sstent";
# cert = "${pkgs.writeText "syncthing-cert.pem" cert-text}";
# key = "${pkgs.writeText "syncthing-key.pem" key-text}";
openDefaultPorts = true;
configDir = "/home/sstent/.config/syncthing";
user = "sstent";
group = "users";
guiAddress = "0.0.0.0:8385";
declarative = {
overrideDevices = true;
overrideFolders = true;
devices = {
"StuPC" = { id = "Z43MPGF-OKG6K34-WTTFUDO-UG6E3TE-YCLSOAT-5LN5KMW-QHL2VSK-EZCGCAP"; };
"Go3" = { id = "YDOL433-AHAL33M-NWLLDDQ-2D36ZIE-YNZVTKE-25TRBZ2-JXRSN7Y-Z5EOVQN"; };
};
folders = {
"default" = {
path = "/home/sstent/sync";
devices = [ "StuPC" "Go3" ];
};
};
};
};
}
# { lib, pkgs, config, ... }:
# with lib;
# let cfg = config.services.ssh-proxy;
# in {
# options.services.ssh-proxy = {
# enable = mkOption {
# type = types.bool;
# default = false;
# description = ''
# Enable Mnt Public for WSL
# '';
# };
# };
# config = mkIf cfg.enable {
# }

12
modules/home-manager/beets/default.nix
View File

@@ -13,17 +13,9 @@ in {
config = mkIf cfg.enable {
# xdg.configFile."beets/config.old".source = config.lib.file.mkOutOfStoreSymlink /run/user/1000/secrets/test;
# secrets.discogs_json = {
# mode = "0440";
# owner = config.users.users.sstent.name;
# group = config.users.users.sstent.group;
# };
sops = {
sops = {
secrets.discogs_json = {
path = "${config.xdg.configHome}/discogs_token.json";
# path = "${config.home.homeDirectory}/${getEnv_name}";
path = "${config.xdg.configHome}/beets/discogs_token.json";
};
};
programs.beets = {

5
home-manager/global/keybase.nix → modules/home-manager/keybase/default.nix
View File

@@ -5,13 +5,8 @@ let
cfg = config.custom.keybase;
username = config.home.username;
secretstore = config._secretstore;
# host = config.networking.hostName;
in {
# imports = [
# "${inputs.self}/lib/hm_secrets.nix"
# ];
options.custom.keybase = {
enable = mkOption {
type = types.bool;

19
modules/nixos/mnt_public/default.nix Normal file
View File

@@ -0,0 +1,19 @@
{ lib, inputs, outputs, config, ... }:
with lib;
let cfg = config.custom.mnt_public;
in {
options.custom.mnt_public.enable = mkEnableOption "Enable mnt/Public";
config = mkIf cfg.enable {
fileSystems."/mnt/Public" = {
device = "//192.168.1.109/Public";
fsType = "cifs";
# options = ["uid=0,gid=1000"];
options = ["guest" "uid=1000"];
};
};
}

33
modules/nixos/syncthing/default.nix Normal file
View File

@@ -0,0 +1,33 @@
{ lib, inputs, outputs, config, ... }:
with lib;
let cfg = config.custom.syncthing;
in {
options.custom.syncthing.enable = mkEnableOption "Enable mnt/Public";
config = mkIf cfg.enable {
services.syncthing = {
enable = true;
dataDir = "/home/sstent";
openDefaultPorts = true;
configDir = "/home/sstent/.config/syncthing";
user = "sstent";
group = "users";
guiAddress = "0.0.0.0:8385";
overrideDevices = true;
overrideFolders = true;
devices = {
"StuPC" = { id = "Z43MPGF-OKG6K34-WTTFUDO-UG6E3TE-YCLSOAT-5LN5KMW-QHL2VSK-EZCGCAP"; };
"go3" = { id = "YDOL433-AHAL33M-NWLLDDQ-2D36ZIE-YNZVTKE-25TRBZ2-JXRSN7Y-Z5EOVQN"; };
};
folders = {
"default" = {
path = "/home/sstent/sync";
devices = [ "StuPC" "go3" ];
};
};
};
};
}

55
modules/nixos/vpn/default.nix
View File

@@ -2,28 +2,28 @@
with lib;
let
cfg = config.custom.mullvad;
secretstore = config._secretstore;
host = config.networking.hostName;
cfg = config.custom.mullvad;
secret = if builtins.pathExists "${secretstore}/hosts/${host}/mullvad/device.json" then
./secrets.nix
else
{ };
in {
#define option to enable this
options.custom.mullvad.enable = mkEnableOption "Enable SSH";
# imports = [ secret ];
config = mkIf cfg.enable {
networking.wireguard.enable = true;
services.mullvad-vpn.enable = true;
sops.secrets.device_json = {
sopsFile = "${secretstore}/hosts/${host}/mullvad/device.json";
format = "binary";
};
environment.etc."mullvad-vpn/device.conf".source = config.sops.secrets.device_json.path;
# set some options after every daemon start
# set some options after every daemon start
# to avoid accidentally leaving unsafe settings
systemd.services."mullvad-daemon" = {
postStart = ''
@@ -33,42 +33,9 @@ in {
${pkgs.mullvad}/bin/mullvad relay set location ca mtr
'';
};
};
}
# secrets = hm_secrets "${secretstore}/user_dotfiles/${username}@${hostName}/keybase/" "${config.xdg.configHome}/keybase/";
#
# { config, pkgs, ... }:
# {
# age.secrets.mullvad.file = ../secrets/mullvad.age;
# networking.wireguard.enable = true;
# services.mullvad-vpn.enable = true;
# # set some options after every daemon start
# # to avoid accidentally leaving unsafe settings
# systemd.services."mullvad-daemon" = {
# serviceConfig.LoadCredential =
# [ "account:${config.age.secrets.mullvad.path}" ];
# postStart = ''
# while ! ${pkgs.mullvad}/bin/mullvad status >/dev/null; do sleep 1; done
# account="$(<"$CREDENTIALS_DIRECTORY/account")"
# current_account="$(${pkgs.mullvad}/bin/mullvad account get | grep "account:" | sed 's/.* //')"
# if [[ "$current_account" != "$account" ]]; then
# ${pkgs.mullvad}/bin/mullvad account login "$account"
# fi
# ${pkgs.mullvad}/bin/mullvad always-require-vpn set on
# ${pkgs.mullvad}/bin/mullvad dns set default \
# --block-ads --block-trackers --block-malware
# ${pkgs.mullvad}/bin/mullvad lan set allow
# ${pkgs.mullvad}/bin/mullvad tunnel ipv6 set on
# ${pkgs.mullvad}/bin/mullvad relay set tunnel-protocol wireguard
# ${pkgs.mullvad}/bin/mullvad relay set location de dus
# '';
# };
# }
}

23
modules/nixos/vpn/secrets.nix Normal file
View File

@@ -0,0 +1,23 @@
{ lib, pkgs, config, ... }:
with lib;
let
secretstore = config._secretstore;
host = config.networking.hostName;
secretpath = "${secretstore}/hosts/${host}/mullvad/device.json";
in {
sops.secrets.device_json= {
sopsFile = "${secretstore}/hosts/${host}/mullvad/device.json";
device_json.format = "binary";
};
environment.etc."mullvad-vpn/device.conf".source = config.sops.secrets.device_json.path;
}

102
hosts/Go3/default.nix → modules/nixos/wsl2/default.nix
View File

@@ -1,51 +1,51 @@
{ lib, pkgs, config, inputs, ... }: {
imports = [
../common.nix
../mnt-public.nix
../user-sstent.nix
inputs.nixos-wsl.nixosModules.wsl
];
# system.stateVersion = "22.11";
nixpkgs.hostPlatform.system = "x86_64-linux";
networking.hostName = "Go3";
wsl = {
enable = true;
wslConf.automount.root = "/mnt";
defaultUser = "sstent";
startMenuLaunchers = true;
interop.preserveArgvZero = true;
nativeSystemd = true;
# Enable native Docker support
docker-native.enable = true;
# Enable integration with Docker Desktop (needs to be installed)
# docker-desktop.enable = true;
};
systemd.services.nixs-wsl-systemd-fix = {
description = "Fix the /dev/shm symlink to be a mount";
unitConfig = {
DefaultDependencies = "no";
Before = [
"sysinit.target"
"systemd-tmpfiles-setup-dev.service"
"systemd-tmpfiles-setup.service"
"systemd-sysctl.service"
];
ConditionPathExists = "/dev/shm";
ConditionPathIsSymbolicLink = "/dev/shm";
ConditionPathIsMountPoint = "/run/shm";
};
serviceConfig = {
Type = "oneshot";
ExecStart = [
"${pkgs.coreutils-full}/bin/rm /dev/shm"
"/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
];
};
wantedBy = [ "sysinit.target" ];
};
}
{ lib, inputs, outputs, config, pkgs, ... }:
with lib;
let cfg = config.custom.wsl;
in {
options.custom.wsl.enable = mkEnableOption "Enable WSL2 settings";
config = mkIf cfg.enable {
wsl = {
enable = true;
wslConf.automount.root = "/mnt";
defaultUser = "sstent";
startMenuLaunchers = true;
interop.preserveArgvZero = true;
nativeSystemd = true;
# Enable native Docker support
docker-native.enable = true;
# Enable integration with Docker Desktop (needs to be installed)
# docker-desktop.enable = true;
};
systemd.services.nixs-wsl-systemd-fix = {
description = "Fix the /dev/shm symlink to be a mount";
unitConfig = {
DefaultDependencies = "no";
Before = [
"sysinit.target"
"systemd-tmpfiles-setup-dev.service"
"systemd-tmpfiles-setup.service"
"systemd-sysctl.service"
];
ConditionPathExists = "/dev/shm";
ConditionPathIsSymbolicLink = "/dev/shm";
ConditionPathIsMountPoint = "/run/shm";
};
serviceConfig = {
Type = "oneshot";
ExecStart = [
"${pkgs.coreutils-full}/bin/rm /dev/shm"
"/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
];
};
wantedBy = [ "sysinit.target" ];
};
};
}

0
secrets/user_dotfiles/sstent@Go3/keybase/autostart_created → secrets/user_dotfiles/sstent@go3-wsl/keybase/autostart_created
View File

0
secrets/user_dotfiles/sstent@Go3/keybase/config.json → secrets/user_dotfiles/sstent@go3-wsl/keybase/config.json
View File

0
secrets/user_dotfiles/sstent@Go3/keybase/device_clone.json → secrets/user_dotfiles/sstent@go3-wsl/keybase/device_clone.json
View File

0
secrets/user_dotfiles/sstent@Go3/keybase/gui_config.json → secrets/user_dotfiles/sstent@go3-wsl/keybase/gui_config.json
View File

0
secrets/user_dotfiles/sstent@Go3/keybase/secretkeys.sstent.mpack → secrets/user_dotfiles/sstent@go3-wsl/keybase/secretkeys.sstent.mpack
View File