sstent/vmimages
1
0
Fork 0
mirror of https://github.com/sstent/vmimages.git synced 2026-04-03 10:45:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

reorg + condiational secrets

Browse Source
This commit is contained in:
sstent
2023-03-09 05:00:20 +00:00
parent 24ef309194
commit dea10b0752
23 changed files with 190 additions and 273 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
hosts/Go3/default.nix
View File

@@ -1,51 +0,0 @@
{ lib, pkgs, config, inputs, ... }: {
imports = [
../common.nix
../mnt-public.nix
../user-sstent.nix
inputs.nixos-wsl.nixosModules.wsl
];
# system.stateVersion = "22.11";
nixpkgs.hostPlatform.system = "x86_64-linux";
networking.hostName = "Go3";
wsl = {
enable = true;
wslConf.automount.root = "/mnt";
defaultUser = "sstent";
startMenuLaunchers = true;
interop.preserveArgvZero = true;
nativeSystemd = true;
# Enable native Docker support
docker-native.enable = true;
# Enable integration with Docker Desktop (needs to be installed)
# docker-desktop.enable = true;
};
systemd.services.nixs-wsl-systemd-fix = {
description = "Fix the /dev/shm symlink to be a mount";
unitConfig = {
DefaultDependencies = "no";
Before = [
"sysinit.target"
"systemd-tmpfiles-setup-dev.service"
"systemd-tmpfiles-setup.service"
"systemd-sysctl.service"
];
ConditionPathExists = "/dev/shm";
ConditionPathIsSymbolicLink = "/dev/shm";
ConditionPathIsMountPoint = "/run/shm";
};
serviceConfig = {
Type = "oneshot";
ExecStart = [
"${pkgs.coreutils-full}/bin/rm /dev/shm"
"/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
];
};
wantedBy = [ "sysinit.target" ];
};
}

43
hosts/StuPC-WSL/default.nix
View File

@@ -2,7 +2,6 @@
imports = [
../common.nix
../mnt-public.nix
../user-sstent.nix
inputs.nixos-wsl.nixosModules.wsl
];
@@ -10,42 +9,12 @@
# system.stateVersion = "22.11";
nixpkgs.hostPlatform.system = "x86_64-linux";
networking.hostName = "StuPC-WSL";
custom.mullvad.enable = true;
wsl = {
enable = true;
wslConf.automount.root = "/mnt";
defaultUser = "sstent";
startMenuLaunchers = true;
interop.preserveArgvZero = true;
nativeSystemd = true;
# Enable native Docker support
docker-native.enable = true;
# Enable integration with Docker Desktop (needs to be installed)
# docker-desktop.enable = true;
};
systemd.services.nixs-wsl-systemd-fix = {
description = "Fix the /dev/shm symlink to be a mount";
unitConfig = {
DefaultDependencies = "no";
Before = [
"sysinit.target"
"systemd-tmpfiles-setup-dev.service"
"systemd-tmpfiles-setup.service"
"systemd-sysctl.service"
];
ConditionPathExists = "/dev/shm";
ConditionPathIsSymbolicLink = "/dev/shm";
ConditionPathIsMountPoint = "/run/shm";
};
serviceConfig = {
Type = "oneshot";
ExecStart = [
"${pkgs.coreutils-full}/bin/rm /dev/shm"
"/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
];
};
wantedBy = [ "sysinit.target" ];
custom = {
mullvad.enable = true;
mnt_public.enable = true;
syncthing.enable = true;
wsl.enable = true;
};
}

13
hosts/common.nix
View File

@@ -1,10 +1,9 @@
# This file (and the global directory) holds config that i use on all hosts
{ lib, inputs, outputs, pkgs, ... }:
{ lib, inputs, outputs, pkgs, config, ... }:
{
imports = [
inputs.home-manager.nixosModules.home-manager
./sops.nix
./syncthing.nix
inputs.sops-nix.nixosModules.sops
]++ (builtins.attrValues outputs.nixosModules);
###dotfiles path variable
@@ -32,6 +31,14 @@
config = {
system.stateVersion = "22.11";
sops = {
# defaultSopsFile = ./secrets.yaml;
defaultSopsFile = "${config._secretstore}/host-secrets.yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
home-manager = {
useUserPackages = true;
extraSpecialArgs = { inherit inputs outputs; };

20
hosts/go3-wsl/default.nix Normal file
View File

@@ -0,0 +1,20 @@
{ lib, pkgs, config, inputs, ... }: {
imports = [
../common.nix
../user-sstent.nix
inputs.nixos-wsl.nixosModules.wsl
];
# system.stateVersion = "22.11";
nixpkgs.hostPlatform.system = "x86_64-linux";
networking.hostName = "go3-wsl";
custom = {
mullvad.enable = true;
mnt_public.enable = true;
syncthing.enable = true;
wsl.enable = true;
};
}

31
hosts/mnt-public.nix
View File

@@ -1,31 +0,0 @@
{ lib, inputs, outputs, ... }:
{
fileSystems."/mnt/Public" = {
device = "//192.168.1.109/Public";
fsType = "cifs";
# options = ["uid=0,gid=1000"];
options = ["guest" "uid=1000"];
};
}
# { lib, pkgs, config, ... }:
# with lib;
# let cfg = config.services.ssh-proxy;
# in {
# options.services.ssh-proxy = {
# enable = mkOption {
# type = types.bool;
# default = false;
# description = ''
# Enable Mnt Public for WSL
# '';
# };
# };
# config = mkIf cfg.enable {
# }

18
hosts/sops.nix
View File

@@ -1,18 +0,0 @@
{ inputs, lib, config, ... }:
{
imports = [
inputs.sops-nix.nixosModules.sops
];
sops = {
# defaultSopsFile = ./secrets.yaml;
defaultSopsFile = "${config._secretstore}/host-secrets.yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# secrets.discogs_json = {
# mode = "0440";
# owner = config.users.users.sstent.name;
# group = config.users.users.sstent.group;
# };
};
}

61
hosts/syncthing.nix
View File

@@ -1,61 +0,0 @@
{ inputs, lib, config, pkgs, ... }:
let
# cfg = config.modules.services.syncthing;
host = config.networking.hostName;
# Device IDs don't really need to be secret, but according to syncthing docs
# one can get the device IP if they know the device ID.
# devices = import ../../secrets/syncthing-devices.nix;
# FFS!! path concatenation in nix is a pain in the ass! see
# https://gist.github.com/CMCDragonkai/de84aece83f8521d087416fa21e34df4
# cert-text = builtins.readFile ("${config._secretstore}/hosts/" + "/${host}" + /syncthing/cert.pem);
# key-text = builtins.readFile ("${config._secretstore}/hosts/" + "/${host}" + /syncthing/key.pem);
in {
services.syncthing = {
enable = true;
dataDir = "/home/sstent";
# cert = "${pkgs.writeText "syncthing-cert.pem" cert-text}";
# key = "${pkgs.writeText "syncthing-key.pem" key-text}";
openDefaultPorts = true;
configDir = "/home/sstent/.config/syncthing";
user = "sstent";
group = "users";
guiAddress = "0.0.0.0:8385";
declarative = {
overrideDevices = true;
overrideFolders = true;
devices = {
"StuPC" = { id = "Z43MPGF-OKG6K34-WTTFUDO-UG6E3TE-YCLSOAT-5LN5KMW-QHL2VSK-EZCGCAP"; };
"Go3" = { id = "YDOL433-AHAL33M-NWLLDDQ-2D36ZIE-YNZVTKE-25TRBZ2-JXRSN7Y-Z5EOVQN"; };
};
folders = {
"default" = {
path = "/home/sstent/sync";
devices = [ "StuPC" "Go3" ];
};
};
};
};
}
# { lib, pkgs, config, ... }:
# with lib;
# let cfg = config.services.ssh-proxy;
# in {
# options.services.ssh-proxy = {
# enable = mkOption {
# type = types.bool;
# default = false;
# description = ''
# Enable Mnt Public for WSL
# '';
# };
# };
# config = mkIf cfg.enable {
# }