reorg + condiational secrets

.sops.yaml

@@ -2,7 +2,7 @@ keys:
   - &adminkey age1jvqe2j70h97844nkz34z9k4epx3uahx50cx75ss8mty2dnxlrf7qqv9a0g
   - &StuPC-WSL_UBUNTU_2204 age1jvf8rd8krchw3ph0w2let8clvyuzcdhq2ug6sm7tx86refc2z5vq4w6lxr
   - &StuPC-WSL_NIXOS age1e0g0rrfdmp5f8f4xgkyp8zgxw2v5t3ldlm2t822xekdz0z6qj49q6aesuw
-  - &GO3_WSL_NIXOS age187fdx6pc2559tjh03jrcwp6yj8whd70h666g8a0ptyr0z49tfcsssdx6au
+  - &go3_WSL_NIXOS age187fdx6pc2559tjh03jrcwp6yj8whd70h666g8a0ptyr0z49tfcsssdx6au
   - &STU_ID age1r86w07gy3nm2ltkqx7wcv94wzneeqmqvcm88nzw4g902kdgwgvdqvjumrj
 creation_rules:
   - path_regex: host-secrets.yaml$
@@ -11,7 +11,7 @@ creation_rules:
       - *adminkey
       - *StuPC-WSL_UBUNTU_2204
       - *StuPC-WSL_NIXOS
-      - *GO3_WSL_NIXOS
+      - *go3_WSL_NIXOS
   - path_regex: user-secrets.yaml$
     key_groups:
     - age:
@@ -29,9 +29,9 @@ creation_rules:
       - *adminkey
       - *StuPC-WSL_NIXOS
   
-  - path_regex: secrets/hosts/Go3/.*$
+  - path_regex: secrets/hosts/go3-wsl/.*$
     key_groups:
     - age:
       - *adminkey
-      - *GO3_WSL_NIXOS
+      - *go3_WSL_NIXOS
   

configuration.nix

@@ -94,10 +94,10 @@ in
     #   map.modules ./devices (name: build.device (import name));
 
     nixosConfigurations = {
-        Go3 = nixpkgs.lib.nixosSystem {
+        go3-wsl = nixpkgs.lib.nixosSystem {
           specialArgs = { inherit inputs outputs; };
           modules = [
-            ./hosts/WSL/Go3
+            ./hosts/WSL/go3-wsl
           ];
         };
         StuPC-WSL = nixpkgs.lib.nixosSystem {

flake.nix

@@ -111,10 +111,10 @@
       # NixOS configuration entrypoint
       # Available through 'nixos-rebuild --flake .#your-hostname'
       nixosConfigurations = {
-        Go3 = nixpkgs.lib.nixosSystem {
+        go3-wsl = nixpkgs.lib.nixosSystem {
-          specialArgs = { inherit  inputs outputs lib;hostName = "Go3"; };
+          specialArgs = { inherit  inputs outputs lib;hostName = "go3-wsl"; };
           modules = [
-            ./hosts/Go3
+            ./hosts/go3-wsl
           ];
         };
         StuPC-WSL = nixpkgs.lib.nixosSystem {
@@ -130,10 +130,10 @@
       # Available through 'home-manager --flake .#your-username@your-hostname'
       homeConfigurations = {
         # FIXME replace with your username@hostname
-        "sstent@Go3" = home-manager.lib.homeManagerConfiguration {
+        "sstent@go3-wsl" = home-manager.lib.homeManagerConfiguration {
           # pkgs = nixpkgs.legacyPackages.x86_64-linux; # Home-manager requires 'pkgs' instance
           pkgs = pkgs;
-          extraSpecialArgs = { inherit inputs outputs lib; hostName = "Go3"; };
+          extraSpecialArgs = { inherit inputs outputs lib; hostName = "go3-wsl"; };
           modules = [
             # > Our main home-manager configuration file <
             ./home-manager/users/sstent

home-manager/global.nix

@@ -3,7 +3,7 @@
 
   imports = [
     # ./beets.nix
-    ./keybase.nix
+    # ./keybase.nix
     "${inputs.vscode-server}/modules/vscode-server/home.nix"
   ] ++ (builtins.attrValues outputs.homeManagerModules);
 

home-manager/users/sstent/default.nix

@@ -8,7 +8,7 @@
 # in
 {
   imports = [
-    ../../global
+    ../../global.nix
   ];
       home.username = "sstent";
       home.homeDirectory = "/home/sstent";
@@ -98,6 +98,8 @@ programs = {
     enable = true;
     userName  = "sstent";
     userEmail = "stuart.stent@gmail.com";
+    extraConfig = { pull.rebase = true; };
+
   };
  ssh = {
     enable = true;

hosts/StuPC-WSL/default.nix

@@ -2,7 +2,6 @@
 
   imports = [
     ../common.nix
-    ../mnt-public.nix
     ../user-sstent.nix
       inputs.nixos-wsl.nixosModules.wsl
   ];
@@ -10,42 +9,12 @@
   # system.stateVersion = "22.11";
   nixpkgs.hostPlatform.system = "x86_64-linux";
   networking.hostName = "StuPC-WSL";
-  custom.mullvad.enable = true;
+  custom = {
-  wsl = {
+    mullvad.enable = true;
-    enable = true;
+    mnt_public.enable = true;
-    wslConf.automount.root = "/mnt";
+    syncthing.enable = true;
-    defaultUser = "sstent";
+    wsl.enable = true;
-    startMenuLaunchers = true;
-    interop.preserveArgvZero = true;
-    nativeSystemd = true;
-    # Enable native Docker support
-    docker-native.enable = true;
-    # Enable integration with Docker Desktop (needs to be installed)
-    # docker-desktop.enable = true;
-  };
-  
-   systemd.services.nixs-wsl-systemd-fix = {
-    description = "Fix the /dev/shm symlink to be a mount";
-    unitConfig = {
-      DefaultDependencies = "no";
-      Before = [
-        "sysinit.target"
-        "systemd-tmpfiles-setup-dev.service"
-        "systemd-tmpfiles-setup.service"
-        "systemd-sysctl.service"
-      ];
-      ConditionPathExists = "/dev/shm";
-      ConditionPathIsSymbolicLink = "/dev/shm";
-      ConditionPathIsMountPoint = "/run/shm";
-    };
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = [
-        "${pkgs.coreutils-full}/bin/rm /dev/shm"
-        "/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
-      ];
-    };
-    wantedBy = [ "sysinit.target" ];
   };
 
+
 }

hosts/common.nix

@@ -1,10 +1,9 @@
 # This file (and the global directory) holds config that i use on all hosts
-{ lib, inputs, outputs, pkgs, ... }:
+{ lib, inputs, outputs, pkgs, config, ... }:
 {
   imports = [
     inputs.home-manager.nixosModules.home-manager
-    ./sops.nix
+    inputs.sops-nix.nixosModules.sops
-    ./syncthing.nix
    ]++ (builtins.attrValues outputs.nixosModules);
 
 ###dotfiles path variable
@@ -32,6 +31,14 @@
 config = {
   system.stateVersion = "22.11";
 
+
+  sops = {
+  # defaultSopsFile = ./secrets.yaml;
+  defaultSopsFile = "${config._secretstore}/host-secrets.yaml";
+  age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+};
+
+
   home-manager = {
     useUserPackages = true;
     extraSpecialArgs = { inherit inputs outputs; };

hosts/go3-wsl/default.nix

@@ -0,0 +1,20 @@
+{ lib, pkgs, config, inputs,  ... }: {
+
+  imports = [
+    ../common.nix
+    ../user-sstent.nix
+      inputs.nixos-wsl.nixosModules.wsl
+  ];
+
+  # system.stateVersion = "22.11";
+  nixpkgs.hostPlatform.system = "x86_64-linux";
+  networking.hostName = "go3-wsl";
+
+  custom = {
+    mullvad.enable = true;
+    mnt_public.enable = true;
+    syncthing.enable = true;
+    wsl.enable = true;
+  };
+
+}

hosts/mnt-public.nix

@@ -1,31 +0,0 @@
-{ lib, inputs, outputs, ... }:
-{
-
-    fileSystems."/mnt/Public" = {
-        device = "//192.168.1.109/Public";
-        fsType = "cifs";
-        # options = ["uid=0,gid=1000"];
-        options = ["guest" "uid=1000"];
-    };
-}
-
-
-
-# { lib, pkgs, config, ... }:
-# with lib;
-
-# let cfg = config.services.ssh-proxy;
-# in {
-#   options.services.ssh-proxy = {
-#     enable = mkOption {
-#       type = types.bool;
-#       default = false;
-#       description = ''
-#         Enable Mnt Public for WSL
-#       '';
-#     };
-#   };
-
-#   config = mkIf cfg.enable {
-
-#   }

hosts/sops.nix

@@ -1,18 +0,0 @@
-{ inputs, lib, config, ... }:
-{
-  imports = [
-    inputs.sops-nix.nixosModules.sops
-  ];
-
-  sops = {
-  # defaultSopsFile = ./secrets.yaml;
-  defaultSopsFile = "${config._secretstore}/host-secrets.yaml";
-  age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-#   secrets.discogs_json = { 
-#   mode = "0440";
-#   owner = config.users.users.sstent.name;
-#   group = config.users.users.sstent.group;
-# };
-};
-
-}

hosts/syncthing.nix

@@ -1,61 +0,0 @@
-{ inputs, lib, config, pkgs, ... }:
-let
-  # cfg = config.modules.services.syncthing;
-  host = config.networking.hostName;
-  # Device IDs don't really need to be secret, but according to syncthing docs
-  # one can get the device IP if they know the device ID.
-  # devices = import ../../secrets/syncthing-devices.nix;
-  # FFS!! path concatenation in nix is a pain in the ass! see
-  # https://gist.github.com/CMCDragonkai/de84aece83f8521d087416fa21e34df4
-  # cert-text = builtins.readFile ("${config._secretstore}/hosts/" + "/${host}" + /syncthing/cert.pem);
-  # key-text = builtins.readFile ("${config._secretstore}/hosts/" + "/${host}" + /syncthing/key.pem);
-in {
-
-services.syncthing = {
-  enable = true;
-  dataDir = "/home/sstent";
-  # cert = "${pkgs.writeText "syncthing-cert.pem" cert-text}";
-  # key = "${pkgs.writeText "syncthing-key.pem" key-text}";
-  openDefaultPorts = true;
-  configDir = "/home/sstent/.config/syncthing";
-  user = "sstent";
-  group = "users";
-  guiAddress = "0.0.0.0:8385";
-    declarative = {
-    overrideDevices = true;
-    overrideFolders = true;
-    devices = {
-      "StuPC" = { id = "Z43MPGF-OKG6K34-WTTFUDO-UG6E3TE-YCLSOAT-5LN5KMW-QHL2VSK-EZCGCAP"; };
-      "Go3" = { id = "YDOL433-AHAL33M-NWLLDDQ-2D36ZIE-YNZVTKE-25TRBZ2-JXRSN7Y-Z5EOVQN"; };
-    };
-    folders = {
-      "default" = { 
-        path = "/home/sstent/sync"; 
-        devices = [ "StuPC" "Go3" ];  
-      };
-    };
-  };
-};
-
-}
-
-
-
-# { lib, pkgs, config, ... }:
-# with lib;
-
-# let cfg = config.services.ssh-proxy;
-# in {
-#   options.services.ssh-proxy = {
-#     enable = mkOption {
-#       type = types.bool;
-#       default = false;
-#       description = ''
-#         Enable Mnt Public for WSL
-#       '';
-#     };
-#   };
-
-#   config = mkIf cfg.enable {
-
-#   }

modules/home-manager/beets/default.nix

@@ -13,17 +13,9 @@ in {
 
   config = mkIf cfg.enable {
 
-      # xdg.configFile."beets/config.old".source = config.lib.file.mkOutOfStoreSymlink /run/user/1000/secrets/test;
+  sops = {
-
-#   secrets.discogs_json = { 
-#   mode = "0440";
-#   owner = config.users.users.sstent.name;
-#   group = config.users.users.sstent.group;
-# };
-sops = {
     secrets.discogs_json = {
-     path = "${config.xdg.configHome}/discogs_token.json";
+     path = "${config.xdg.configHome}/beets/discogs_token.json";
-    # path = "${config.home.homeDirectory}/${getEnv_name}";
     };
   };
       programs.beets = {

modules/home-manager/keybase/default.nix

@@ -5,13 +5,8 @@ let
 cfg = config.custom.keybase;
 username = config.home.username;
 secretstore = config._secretstore;
-# host = config.networking.hostName;
 
 in {
-  # imports =  [
-  #   "${inputs.self}/lib/hm_secrets.nix" 
-  #   ];
-
   options.custom.keybase = {
     enable = mkOption {
       type = types.bool;

modules/nixos/mnt_public/default.nix

@@ -0,0 +1,19 @@
+{ lib, inputs, outputs, config, ... }:
+with lib;
+
+ let cfg = config.custom.mnt_public;
+in {
+  options.custom.mnt_public.enable = mkEnableOption "Enable mnt/Public";
+
+  config = mkIf cfg.enable {
+
+
+    fileSystems."/mnt/Public" = {
+        device = "//192.168.1.109/Public";
+        fsType = "cifs";
+        # options = ["uid=0,gid=1000"];
+        options = ["guest" "uid=1000"];
+    };
+ };
+}
+

modules/nixos/syncthing/default.nix

@@ -0,0 +1,33 @@
+{ lib, inputs, outputs, config, ... }:
+with lib;
+
+ let cfg = config.custom.syncthing;
+in {
+  options.custom.syncthing.enable = mkEnableOption "Enable mnt/Public";
+
+  config = mkIf cfg.enable {
+
+services.syncthing = {
+  enable = true;
+  dataDir = "/home/sstent";
+  openDefaultPorts = true;
+  configDir = "/home/sstent/.config/syncthing";
+  user = "sstent";
+  group = "users";
+  guiAddress = "0.0.0.0:8385";
+    
+    overrideDevices = true;
+    overrideFolders = true;
+    devices = {
+      "StuPC" = { id = "Z43MPGF-OKG6K34-WTTFUDO-UG6E3TE-YCLSOAT-5LN5KMW-QHL2VSK-EZCGCAP"; };
+      "go3" = { id = "YDOL433-AHAL33M-NWLLDDQ-2D36ZIE-YNZVTKE-25TRBZ2-JXRSN7Y-Z5EOVQN"; };
+    };
+    folders = {
+      "default" = { 
+        path = "/home/sstent/sync"; 
+        devices = [ "StuPC" "go3" ];  
+      };
+    };
+};
+  };
+}

modules/nixos/vpn/default.nix

@@ -2,28 +2,28 @@
 with lib;
 
 let 
-cfg = config.custom.mullvad;
 secretstore = config._secretstore;
 host = config.networking.hostName;
 
+cfg = config.custom.mullvad;
+
+secret = if builtins.pathExists "${secretstore}/hosts/${host}/mullvad/device.json" then
+     ./secrets.nix
+   else
+    { };
 
 in {
 
   #define option to enable this 
   options.custom.mullvad.enable = mkEnableOption "Enable SSH";
 
+  # imports = [ secret ];
+
   config = mkIf cfg.enable {
   networking.wireguard.enable = true;
   services.mullvad-vpn.enable = true;
 
- sops.secrets.device_json = {
+    # set some options after every daemon start
-    sopsFile = "${secretstore}/hosts/${host}/mullvad/device.json";
-    format = "binary";
-  };  
-  
-  environment.etc."mullvad-vpn/device.conf".source = config.sops.secrets.device_json.path;
-
-  # set some options after every daemon start
   # to avoid accidentally leaving unsafe settings
   systemd.services."mullvad-daemon" = {
     postStart = ''
@@ -33,42 +33,9 @@ in {
       ${pkgs.mullvad}/bin/mullvad relay set location ca mtr
     '';
   };
+  
 
 
 
 };
-}
+}
-    #    secrets = hm_secrets "${secretstore}/user_dotfiles/${username}@${hostName}/keybase/" "${config.xdg.configHome}/keybase/";
-# 
-
-# { config, pkgs, ... }:
-
-# {
-#   age.secrets.mullvad.file = ../secrets/mullvad.age;
-
-#   networking.wireguard.enable = true;
-
-#   services.mullvad-vpn.enable = true;
-
-#   # set some options after every daemon start
-#   # to avoid accidentally leaving unsafe settings
-#   systemd.services."mullvad-daemon" = {
-#     serviceConfig.LoadCredential =
-#       [ "account:${config.age.secrets.mullvad.path}" ];
-#     postStart = ''
-#       while ! ${pkgs.mullvad}/bin/mullvad status >/dev/null; do sleep 1; done
-#       account="$(<"$CREDENTIALS_DIRECTORY/account")"
-#       current_account="$(${pkgs.mullvad}/bin/mullvad account get | grep "account:" | sed 's/.* //')"
-#       if [[ "$current_account" != "$account" ]]; then
-#         ${pkgs.mullvad}/bin/mullvad account login "$account"
-#       fi
-#       ${pkgs.mullvad}/bin/mullvad always-require-vpn set on
-#       ${pkgs.mullvad}/bin/mullvad dns set default \
-#         --block-ads --block-trackers --block-malware
-#       ${pkgs.mullvad}/bin/mullvad lan set allow
-#       ${pkgs.mullvad}/bin/mullvad tunnel ipv6 set on
-#       ${pkgs.mullvad}/bin/mullvad relay set tunnel-protocol wireguard
-#       ${pkgs.mullvad}/bin/mullvad relay set location de dus
-#     '';
-#   };
-# }

modules/nixos/vpn/secrets.nix

@@ -0,0 +1,23 @@
+{ lib, pkgs, config, ... }:
+with lib;
+
+let 
+secretstore = config._secretstore;
+host = config.networking.hostName;
+secretpath = "${secretstore}/hosts/${host}/mullvad/device.json";
+
+in {
+
+
+ sops.secrets.device_json= {
+    sopsFile = "${secretstore}/hosts/${host}/mullvad/device.json";
+    device_json.format = "binary";
+ };
+
+  environment.etc."mullvad-vpn/device.conf".source = config.sops.secrets.device_json.path;
+
+
+
+
+
+}

modules/nixos/wsl2/default.nix

@@ -1,51 +1,51 @@
-{ lib, pkgs, config, inputs,  ... }: {
+{ lib, inputs, outputs, config, pkgs, ... }:
-
+with lib;
-  imports = [
+
-    ../common.nix
+ let cfg = config.custom.wsl;
-    ../mnt-public.nix
+in {
-    ../user-sstent.nix
+  options.custom.wsl.enable = mkEnableOption "Enable WSL2 settings";
-      inputs.nixos-wsl.nixosModules.wsl
+
-  ];
+  config = mkIf cfg.enable {
-
+
-  # system.stateVersion = "22.11";
+  wsl = {
-  nixpkgs.hostPlatform.system = "x86_64-linux";
+    enable = true;
-  networking.hostName = "Go3";
+    wslConf.automount.root = "/mnt";
-
+    defaultUser = "sstent";
-  wsl = {
+    startMenuLaunchers = true;
-    enable = true;
+    interop.preserveArgvZero = true;
-    wslConf.automount.root = "/mnt";
+    nativeSystemd = true;
-    defaultUser = "sstent";
+    # Enable native Docker support
-    startMenuLaunchers = true;
+    docker-native.enable = true;
-    interop.preserveArgvZero = true;
+    # Enable integration with Docker Desktop (needs to be installed)
-    nativeSystemd = true;
+    # docker-desktop.enable = true;
-    # Enable native Docker support
+  };
-    docker-native.enable = true;
+  
-    # Enable integration with Docker Desktop (needs to be installed)
+   systemd.services.nixs-wsl-systemd-fix = {
-    # docker-desktop.enable = true;
+    description = "Fix the /dev/shm symlink to be a mount";
-  };
+    unitConfig = {
-  
+      DefaultDependencies = "no";
-   systemd.services.nixs-wsl-systemd-fix = {
+      Before = [
-    description = "Fix the /dev/shm symlink to be a mount";
+        "sysinit.target"
-    unitConfig = {
+        "systemd-tmpfiles-setup-dev.service"
-      DefaultDependencies = "no";
+        "systemd-tmpfiles-setup.service"
-      Before = [
+        "systemd-sysctl.service"
-        "sysinit.target"
+      ];
-        "systemd-tmpfiles-setup-dev.service"
+      ConditionPathExists = "/dev/shm";
-        "systemd-tmpfiles-setup.service"
+      ConditionPathIsSymbolicLink = "/dev/shm";
-        "systemd-sysctl.service"
+      ConditionPathIsMountPoint = "/run/shm";
-      ];
+    };
-      ConditionPathExists = "/dev/shm";
+    serviceConfig = {
-      ConditionPathIsSymbolicLink = "/dev/shm";
+      Type = "oneshot";
-      ConditionPathIsMountPoint = "/run/shm";
+      ExecStart = [
-    };
+        "${pkgs.coreutils-full}/bin/rm /dev/shm"
-    serviceConfig = {
+        "/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
-      Type = "oneshot";
+      ];
-      ExecStart = [
+    };
-        "${pkgs.coreutils-full}/bin/rm /dev/shm"
+    wantedBy = [ "sysinit.target" ];
-        "/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
+  };
-      ];
+
-    };
+
-    wantedBy = [ "sysinit.target" ];
+
-  };
+
-
+  };
-}
+}