summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.sops.yaml10
-rw-r--r--flake.lock24
-rw-r--r--flake.nix140
-rw-r--r--flora/configuration.nix4
-rw-r--r--flora/services/akkoma.nix16
-rw-r--r--flora/services/mail.nix4
-rw-r--r--home/packages.nix2
-rw-r--r--secrets/flora.yaml35
8 files changed, 163 insertions, 72 deletions
diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..c3f890a
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,10 @@
+keys:
+ - &ilex age18wkr3kjalalzrq9l05q32gnlaqr7t6rqqzde307m83rs9fp4xcfsdtj9gt
+ # server's ssh pubkeys as age keys
+ - &flora age1d8hulw7weg6gwxv0cmz969w04d2jkphdx93tm9xs0mqr0ut0t4ls4g4vah
+creation_rules:
+ - path_regex: secrets/[^/]+\.yaml$
+ key_groups:
+ - age:
+ - *ilex
+ - *flora
diff --git a/flake.lock b/flake.lock
index 9c91a7f..8523132 100644
--- a/flake.lock
+++ b/flake.lock
@@ -330,6 +330,7 @@
"rust-overlay": "rust-overlay",
"showrt": "showrt",
"simple-nixos-mailserver": "simple-nixos-mailserver",
+ "sops-nix": "sops-nix",
"tracktrain": "tracktrain",
"traveltext": "traveltext",
"uplcg": "uplcg",
@@ -397,6 +398,29 @@
"type": "gitlab"
}
},
+ "sops-nix": {
+ "inputs": {
+ "nixpkgs": [
+ "nixpkgs-unstable"
+ ],
+ "nixpkgs-stable": [
+ "nixpkgs"
+ ]
+ },
+ "locked": {
+ "lastModified": 1681209176,
+ "narHash": "sha256-wyQokPpkNZnsl/bVf8m1428tfA0hJ0w/qexq4EizhTc=",
+ "owner": "Mic92",
+ "repo": "sops-nix",
+ "rev": "00d5fd73756d424de5263b92235563bc06f2c6e1",
+ "type": "github"
+ },
+ "original": {
+ "owner": "Mic92",
+ "repo": "sops-nix",
+ "type": "github"
+ }
+ },
"tracktrain": {
"flake": false,
"locked": {
diff --git a/flake.nix b/flake.nix
index c1c790f..cf0aaff 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,4 +1,3 @@
-
{
description = "testing nix flakes for server deployment";
@@ -10,10 +9,15 @@
home-manager.inputs.nixpkgs.follows = "nixpkgs";
deploy-rs.url = "github:serokell/deploy-rs";
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
- simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
- emacs-overlay.url = "gitlab:nix-community/emacs-overlay?rev=d938b780a3d8072aeac0178c46121060079ff217";
+ simple-nixos-mailserver.url =
+ "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
+ emacs-overlay.url =
+ "gitlab:nix-community/emacs-overlay?rev=d938b780a3d8072aeac0178c46121060079ff217";
rust-overlay.url = "github:oxalica/rust-overlay";
rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
+ sops-nix.url = "github:Mic92/sops-nix";
+ sops-nix.inputs.nixpkgs.follows = "nixpkgs-unstable";
+ sops-nix.inputs.nixpkgs-stable.follows = "nixpkgs";
uplcg.url = "git+https://stuebinm.eu/git/uplcg?ref=main";
uplcg.flake = false;
@@ -40,64 +44,69 @@
walint.flake = false;
};
- outputs = { self, deploy-rs, ... }@inputs:
- let
- nixpkgs = import inputs.nixpkgs {
- system = "x86_64-linux";
- overlays = [
- inputs.rust-overlay.overlays.default
- self.overlays.default
- ];
- };
- mkConfig = imports: config:
- inputs.nixpkgs.lib.nixosSystem rec {
- system = "x86_64-linux";
- modules = [ config ] ++ imports;
- pkgs = nixpkgs;
-
- specialArgs = {
- inherit inputs system;
- craneLib = inputs.crane.lib.${system};
+ outputs = { self, deploy-rs, sops-nix, ... }@inputs:
+ let
+ nixpkgs = import inputs.nixpkgs {
+ system = "x86_64-linux";
+ overlays =
+ [ inputs.rust-overlay.overlays.default self.overlays.default ];
};
- };
- mkServer = mkConfig [ ./common/headless.nix ];
- mkDesktop = mkConfig [ ./common/desktop.nix ];
- deploy-vps = hostname: {
- inherit hostname;
- profiles.system = {
- user = "root";
- sshUser = "root";
- path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.${hostname};
+ mkConfig = imports: config:
+ inputs.nixpkgs.lib.nixosSystem rec {
+ system = "x86_64-linux";
+ modules = [ config ] ++ imports;
+ pkgs = nixpkgs;
+
+ specialArgs = {
+ inherit inputs system;
+ craneLib = inputs.crane.lib.${system};
+ };
+ };
+ mkDesktop = mkConfig [ ./common/desktop.nix ];
+ mkServer = mkConfig [
+ ./common/headless.nix
+ sops-nix.nixosModules.sops
+ ];
+ deploy-vps = hostname: {
+ inherit hostname;
+ profiles.system = {
+ user = "root";
+ sshUser = "root";
+ path = deploy-rs.lib.x86_64-linux.activate.nixos
+ self.nixosConfigurations.${hostname};
+ };
};
- };
- in {
+ in {
- nixosConfigurations = {
- chaski = mkServer ./chaski/configuration.nix;
- flora = mkServer ./flora/configuration.nix;
- abbenay = mkDesktop ./abbenay/configuration.nix;
- cyberbox = mkDesktop ./cyberbox/configuration.nix;
- surltesh-echer = mkDesktop ./surltesh-echer/configuration.nix;
- ilex = mkDesktop ./ilex/configuration.nix;
- };
+ nixosConfigurations = {
+ chaski = mkServer ./chaski/configuration.nix;
+ flora = mkServer ./flora/configuration.nix;
+ abbenay = mkDesktop ./abbenay/configuration.nix;
+ cyberbox = mkDesktop ./cyberbox/configuration.nix;
+ surltesh-echer = mkDesktop ./surltesh-echer/configuration.nix;
+ ilex = mkDesktop ./ilex/configuration.nix;
+ };
- deploy.nodes = {
- chaski = deploy-vps "chaski";
- flora = deploy-vps "flora";
- parsons = {
- hostname = "parsons";
- profiles.home = {
- user = "stuebinm";
- sshUser = "stuebinm";
- path = deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurations.stuebinm-minimal;
- };
+ deploy.nodes = {
+ chaski = deploy-vps "chaski";
+ flora = deploy-vps "flora";
+ parsons = {
+ hostname = "parsons";
+ profiles.home = {
+ user = "stuebinm";
+ sshUser = "stuebinm";
+ path = deploy-rs.lib.x86_64-linux.activate.home-manager
+ self.homeConfigurations.stuebinm-minimal;
+ };
+ };
};
- };
- checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+ checks = builtins.mapAttrs
+ (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
- homeConfigurations =
- let home = root: inputs.home-manager.lib.homeManagerConfiguration rec {
+ homeConfigurations = let
+ home = root:
+ inputs.home-manager.lib.homeManagerConfiguration rec {
pkgs = nixpkgs;
modules = [ root ];
extraSpecialArgs = {
@@ -110,19 +119,18 @@
stuebinm-minimal = home ./home/home-minimal.nix;
};
- home = self.homeConfigurations.stuebinm.activationPackage;
- home-minimal = self.homeConfigurations.stuebinm-minimal.activationPackage;
+ home = self.homeConfigurations.stuebinm.activationPackage;
+ home-minimal = self.homeConfigurations.stuebinm-minimal.activationPackage;
- overlays.default = final: prev:
- import ./pkgs/overlay.nix { inherit inputs; } final prev;
- packages.x86_64-linux = {
- inherit (nixpkgs) galmon-core galmon-full glitchtip typst
- almanac kijetesantakaluotokieni showrt isabelle-utils isabat
- emacs29 crs-tools;
- };
+ overlays.default = final: prev:
+ import ./pkgs/overlay.nix { inherit inputs; } final prev;
+ packages.x86_64-linux = {
+ inherit (nixpkgs)
+ galmon-core galmon-full glitchtip typst almanac
+ kijetesantakaluotokieni showrt isabelle-utils isabat emacs29
+ crs-tools;
+ };
- nixosModules = {
- glitchtip = import ./modules/glitchtip.nix;
+ nixosModules = { glitchtip = import ./modules/glitchtip.nix; };
};
- };
}
diff --git a/flora/configuration.nix b/flora/configuration.nix
index 3eaaa08..954e5e6 100644
--- a/flora/configuration.nix
+++ b/flora/configuration.nix
@@ -19,6 +19,10 @@
boot.loader.grub.version = 2;
boot.loader.grub.devices = [ "/dev/sda" ];
+ sops.defaultSopsFile = ../secrets/flora.yaml;
+ # This will automatically import SSH keys as age keys
+ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
networking = {
hostName = "flora";
diff --git a/flora/services/akkoma.nix b/flora/services/akkoma.nix
index 98cfb7b..3eb9173 100644
--- a/flora/services/akkoma.nix
+++ b/flora/services/akkoma.nix
@@ -12,6 +12,11 @@ let
staticDir = "/var/lib/akkoma/static";
in
{
+ sops.secrets = {
+ "akkoma/keyBase" = {};
+ "akkoma/signingSalt" = {};
+ "akkoma/jokenDefaultSigner" = {};
+ };
containers.pleroma = {
autoStart = true;
@@ -22,6 +27,11 @@ in
hostAddress6 = "fd00::42:30";
localAddress6 = "fd00::42:31";
+ bindMounts."/sops" = {
+ hostPath = "/run/secrets/akkoma";
+ isReadOnly = true;
+ };
+
config = {pkgs, config, ...}: {
# generating the manual will fail when mixing nixos channels,
@@ -63,10 +73,10 @@ in
":pleroma"."Pleroma.Web.Endpoint" = {
"url" = { host = "pleroma.stuebinm.eu"; scheme = "https"; port = 443; };
"http" = { ip = "::"; port = 4000; };
- secret_key_base._secret = "/secret/secret_key_base";
- signing_salt._secret = "/secret/signing_salt";
+ secret_key_base._secret = "/sops/keyBase";
+ signing_salt._secret = "/sops/signingSalt";
};
- ":joken".":default_signer"._secret = "/secret/joken_default_signer";
+ ":joken".":default_signer"._secret = "/sops/jokenDefaultSigner";
":pleroma" = {
":instance" = {
diff --git a/flora/services/mail.nix b/flora/services/mail.nix
index d41f0e8..e43e56f 100644
--- a/flora/services/mail.nix
+++ b/flora/services/mail.nix
@@ -3,7 +3,7 @@
{
imports = [ inputs.simple-nixos-mailserver.nixosModule ];
-
+ sops.secrets."mail/hashedPassword" = {};
mailserver = {
enable = true;
@@ -14,7 +14,7 @@
# nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
loginAccounts = {
"hello@stuebinm.eu" = {
- hashedPasswordFile = "/var/mailstate/hello-password";
+ hashedPasswordFile = "/run/secrets/mail/hashedPassword";
aliases = ["postmaster@stuebinm.eu" "abuse@stuebinm.eu"];
};
};
diff --git a/home/packages.nix b/home/packages.nix
index afa2458..d3d9f2f 100644
--- a/home/packages.nix
+++ b/home/packages.nix
@@ -22,7 +22,7 @@ in
# general cli utils
almanac libnotify grim slurp wl-clipboard showrt
kijetesantakaluotokieni mpc_cli duf dufs progress hledger
- wineWowPackages.full
+ wineWowPackages.full sops
# graphical utils
kitty baobab
# gnss things
diff --git a/secrets/flora.yaml b/secrets/flora.yaml
new file mode 100644
index 0000000..ca2db83
--- /dev/null
+++ b/secrets/flora.yaml
@@ -0,0 +1,35 @@
+mail:
+ hashedPassword: ENC[AES256_GCM,data:qZXAeESD86BaBjWF2YXtUn6wHUUVBIwHl5C0VE/5p8eIMHdRQbMwGP/uWBwUvh6Uey6iDj7YmSjhH0JN,iv:s/jOYehNIqMOuLHRjdVQG6nUJEuXbE+w4gyF14U3Scw=,tag:p3rKHAalK3sYp/b0NndKaw==,type:str]
+akkoma:
+ keyBase: ENC[AES256_GCM,data:E9jPxP8Hg3civkyqHYPdAizisq/Oxw1zHsOmN0XvzPcKlX63ov3Akb1EFGsNqDBoSwTXtMoQk305cMB6VPLqmw==,iv:5c5W83leUmwy3w0dDvkWNdS7JWeseuxEnQc7f98O3bg=,tag:xz5JtAzvqSlkS6FKd8hVhw==,type:str]
+ signingSalt: ENC[AES256_GCM,data:/htaDciCAhI=,iv:MV4vYD+qaNBicKZEmYffGfTqE2AQgfUdQVjTrLGPMck=,tag:/Of2A9X2QeE6k4lHwWKcOQ==,type:str]
+ jokenDefaultSigner: ENC[AES256_GCM,data:1Wl/N58oiGiGeBHSkJPqLeHOyBmVgLGshAmTyi2H8cu7w/tIHMxW2sd11hhzyq2FCNVsL3Bi+yXgydG7uCl5yw==,iv:criEzJfQMsAUZ7tnIQvr9HOqn7NjBBzXL+rFAgzohPY=,tag:+izDkiUEfwD1+Ym2OuZRnA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age18wkr3kjalalzrq9l05q32gnlaqr7t6rqqzde307m83rs9fp4xcfsdtj9gt
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGekdoUEZhR2Vkb0cwdUVT
+ Zm16MHVWY3Rybm43UDhuVngwbCsrNUxxL3hVClZHUy8vTjdMZGRlM2FTNDdWdWZE
+ Zk4zblIydWtCMzFRK0Y5KzY1SXpVOE0KLS0tIDFXVnEvSjZoMkg5M0JxcXBaakl0
+ Z2FUNFpXSzN4a05XK0dWVkdMMHVmRlEKQnPz8rcGSdEWkV0LPR5edJRmLYQZMVR+
+ PJL64NDEg3t8uQak3jiiBgBGptXFJ0dWrXqdP3Zv1JlU8pbYka2GOg==
+ -----END AGE ENCRYPTED FILE-----
+ - recipient: age1d8hulw7weg6gwxv0cmz969w04d2jkphdx93tm9xs0mqr0ut0t4ls4g4vah
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQd1M1UzRtbDh0QnhOZDJl
+ bFBPQWhqR2pRK05wVmJ5cmtyWjdtSE9DSXlVCklZTVdsUStTUFRYaXR0c3I4NUVu
+ dldUdjQvR1RYTGFkZlhxVzEwcUJnTjAKLS0tIHdNTm1XSkpNdzJWUm9KeGlnQzhS
+ SEx0Y2tsaGtkV3dMd0t0ejl3WVkwOW8KTpb14yYJ1bOeLquOrmworNqiwYoZSYiQ
+ LkLkXKSGf6T3BrL0t0bM3fgwSQN3k92GGsEZzY7I2hhxZoNXGBOaKg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-04-11T16:27:36Z"
+ mac: ENC[AES256_GCM,data:jDwXDqpcX8eaYkVsHAt9rEVoavFCXF16YJV4QkjREy24f7c52pIqbOQ3RYcslyXjGWz0MCgUQ6B2w1MOvY6+xIF+dqPf1sSM5jnbazr9iyvhPIdlKWWq8MXHJEPDqC71ZkfGrPCboZmuZit2lWPu+czalZP/Dcm7bJexEsr2NZs=,iv:DVbxbYbgWNCTCgVKs3SvUCiDF0C9Av/OyrlGQHXW8WE=,tag:zwXtxzc6T8QO1T/esyDkNQ==,type:str]
+ pgp: []
+ unencrypted_suffix: _unencrypted
+ version: 3.7.3
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-22 15:19:49 +0000