repomaa/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use agenix

Browse Source
This commit is contained in:
Joakim Repomaa
2025-02-11 22:15:44 +02:00
parent 8a1f2c4968
commit 0bc01cd2b1
20 changed files with 182 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
flake.lock generated
View File

@@ -1,5 +1,28 @@
{
"nodes": {
"agenix": {
"inputs": {
"darwin": "darwin",
"home-manager": "home-manager",
"nixpkgs": [
"nixpkgs"
],
"systems": "systems"
},
"locked": {
"lastModified": 1736955230,
"narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
"owner": "ryantm",
"repo": "agenix",
"rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
"type": "github"
},
"original": {
"owner": "ryantm",
"repo": "agenix",
"type": "github"
}
},
"auto-cpufreq": {
"inputs": {
"nixpkgs": [
@@ -51,6 +74,28 @@
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1700795494,
"narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
"type": "github"
},
"original": {
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
@@ -144,7 +189,7 @@
},
"flake-utils": {
"inputs": {
"systems": "systems"
"systems": "systems_2"
},
"locked": {
"lastModified": 1710146030,
@@ -162,7 +207,7 @@
},
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
"systems": "systems_3"
},
"locked": {
"lastModified": 1701680307,
@@ -180,7 +225,7 @@
},
"flake-utils_3": {
"inputs": {
"systems": "systems_3"
"systems": "systems_4"
},
"locked": {
"lastModified": 1710146030,
@@ -298,6 +343,27 @@
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1703113217,
"narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "home-manager",
"type": "github"
}
},
"home-manager_2": {
"inputs": {
"nixpkgs": [
"nixpkgs"
@@ -645,13 +711,14 @@
},
"root": {
"inputs": {
"agenix": "agenix",
"auto-cpufreq": "auto-cpufreq",
"commander-nvim": "commander-nvim",
"flake-parts": "flake-parts",
"gen-nvim": "gen-nvim",
"gtrackmap": "gtrackmap",
"hastebin": "hastebin",
"home-manager": "home-manager",
"home-manager": "home-manager_2",
"ketchup": "ketchup",
"ksoloti-pr": "ksoloti-pr",
"lanzaboote": "lanzaboote",
@@ -730,6 +797,21 @@
"type": "github"
}
},
"systems_4": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"vimpeccable": {
"flake": false,
"locked": {

7
flake.nix
View File

@@ -52,8 +52,12 @@
inputs.nixpkgs.follows = "nixpkgs";
};
ksoloti-pr.url = "github:repomaa/nixpkgs/pkg/ksoloti";
agenix = {
url = "github:ryantm/agenix";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = { flake-parts, nixpkgs, ... }@inputs:
outputs = { flake-parts, agenix, nixpkgs, ... }@inputs:
flake-parts.lib.mkFlake { inherit inputs; } (
let
ssh.publicKeys.yubikey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLIUkESu5NnBi1M0+ZjYrkp6/rIFuwc3aguspf98jmOydNce6l65cnS3GRzc9oWx4lu11ahi87ZuE+pYV+gaHm4=";
@@ -74,6 +78,7 @@
(writeShellScriptBin "evaluate" ''
${nix}/bin/nix build --dry-run ".#nixosConfigurations.$1.config.system.build.toplevel" | ${nix-output-monitor}/bin/nom
'')
agenix.packages.${pkgs.system}.default
];
};
};

1
hosts/freun.dev/default.nix
View File

@@ -4,5 +4,6 @@
./hardware-configuration.nix
./configuration.nix
./services.nix
./secrets.nix
];
}

22
hosts/freun.dev/secrets.nix Normal file
View File

@@ -0,0 +1,22 @@
{ lib, config, ... }:
{
age.secrets = lib.listToAttrs
(
map (secret: { name = secret; value = { file = ../../secrets/${secret}.age; }; }) [
"gotosocial"
"hastebin-tokens"
"immich"
"storage-box-credentials"
"vaultwarden"
]
) // {
smtp-password = {
file = ../../secrets/smtp-password.age;
owner =
if (config.services.grafana.enable) then
config.systemd.services.grafana.serviceConfig.User
else
"root";
};
};
}

5
hosts/radish/packages.nix
View File

@@ -24,6 +24,11 @@
};
services = {
openssh = {
enable = true;
openFirewall = false;
};
tailscale = {
enable = true;
useRoutingFeatures = "client";

3
modules/default.nix
View File

@@ -1,9 +1,10 @@
{ ... }:
{ inputs, ... }:
{
imports = [
./vlans.nix
./firewall.nix
./storage-box-mounts.nix
./services
inputs.agenix.nixosModules.default
];
}

3
modules/services/gotosocial.nix
View File

@@ -1,6 +1,7 @@
{ config, lib, ... }:
let
cfg = config.modules.services.gotosocial;
secrets = config.age.secrets;
domain = config.networking.domain;
fqdn = "${cfg.subdomain}.${domain}";
port = cfg.port;
@@ -24,7 +25,7 @@ in
config = lib.mkIf cfg.enable {
services.gotosocial = {
enable = true;
environmentFile = "/var/secrets/gotosocial.env";
environmentFile = secrets.gotosocial.path;
settings = {
host = fqdn;
account-domain = domain;

3
modules/services/grafana.nix
View File

@@ -1,6 +1,7 @@
{ lib, config, ... }:
let
cfg = config.modules.services.grafana;
secrets = config.age.secrets;
fqdn = "${cfg.subdomain}.${config.networking.domain}";
in
{
@@ -40,7 +41,7 @@ in
from_address = "noreply@freun.dev";
from_name = "Vaultwarden";
user = "noreply@freun.dev";
password = "$__file{/var/secrets/smtp-password}";
password = "$__file{${secrets.smtp-password.path}}";
};
};
};

3
modules/services/hastebin.nix
View File

@@ -1,6 +1,7 @@
{ lib, config, inputs, ... }:
let
cfg = config.services.hastebin;
secrets = config.age.secrets;
fqdn = "${cfg.subdomain}.${config.networking.domain}";
in
{
@@ -33,7 +34,7 @@ in
"jsx"
];
};
auth_tokens_file = "/var/secrets/hastebin-tokens";
auth_tokens_file = secrets.hastebin-tokens.path;
};
modules.services.webserver = {

25
modules/services/immich.nix
View File

@@ -1,6 +1,7 @@
{ pkgs, lib, config, ... }:
let
cfg = config.modules.services.immich;
secrets = config.age.secrets;
fqdn = "${cfg.subdomain}.${config.networking.domain}";
volumeServices = names: (
@@ -52,6 +53,13 @@ let
{ }
services
);
environment = {
TZ = cfg.timezone;
DB_USERNAME = "postgres";
POSTGRES_USER = environment.DB_USERNAME;
DB_DATABASE_NAME = "immich";
};
in
{
options.modules.services.immich = {
@@ -59,6 +67,10 @@ in
subdomain = lib.mkOption {
type = lib.types.str;
};
timezone = lib.mkOption {
type = lib.types.str;
default = "Europe/Helsinki";
};
version = lib.mkOption {
type = lib.types.str;
default = "latest";
@@ -97,8 +109,9 @@ in
virtualisation.oci-containers.containers = {
"immich_machine_learning" = {
image = "ghcr.io/immich-app/immich-machine-learning:${cfg.version}";
inherit environment;
environmentFiles = [
"/var/secrets/immich.env"
secrets.immich.path
];
volumes = [
"immich_model_cache:/cache:rw"
@@ -113,9 +126,9 @@ in
"immich_postgres" = {
image = "registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0";
environmentFiles = [
"/var/secrets/immich.env"
secrets.immich.path
];
environment = {
environment = environment // {
POSTGRES_INITDB_ARGS = "--data-checksums";
};
volumes = [
@@ -131,8 +144,9 @@ in
"immich_redis" = {
image = "registry.hub.docker.com/library/redis:6.2-alpine";
inherit environment;
environmentFiles = [
"/var/secrets/immich.env"
secrets.immich.path
];
log-driver = "journald";
extraOptions = [
@@ -143,8 +157,9 @@ in
"immich_server" = {
image = "ghcr.io/immich-app/immich-server:${cfg.version}";
inherit environment;
environmentFiles = [
"/var/secrets/immich.env"
secrets.immich.path
];
volumes = [
"/etc/localtime:/etc/localtime:ro"

3
modules/services/vaultwarden.nix
View File

@@ -1,6 +1,7 @@
{ lib, config, ... }:
let
cfg = config.modules.services.vaultwarden;
secrets = config.age.secrets;
fqdn = "${cfg.subdomain}.${config.networking.domain}";
port = config.services.vaultwarden.config.ROCKET_PORT;
in
@@ -23,7 +24,7 @@ in
services.vaultwarden = {
enable = true;
dbBackend = "postgresql";
environmentFile = "/var/secrets/vaultwarden.env";
environmentFile = secrets.vaultwarden.path;
config = {
DOMAIN = "https://${fqdn}";
DATABASE_URL = "postgres://%2Fvar%2Frun%2Fpostgresql/vaultwarden";

4
modules/services/webserver.nix
View File

@@ -38,10 +38,6 @@ in
type = lib.types.str;
default = "hetzner";
};
environmentFile = lib.mkOption {
type = lib.types.str;
default = "/var/secrets/lego";
};
};
vHosts = lib.mkOption {
type = lib.types.attrsOf types.vhost;

4
modules/storage-box-mounts.nix
View File

@@ -23,12 +23,14 @@ let
};
cfg = config.modules.storageBoxMounts;
secrets = config.age.secrets;
mountOptions = { uid, gid, ... }: [
"x-systemd.automount"
"auto"
"x-systemd.device-timeout=5s"
"x-systemd.mount-timeout=5s"
"credentials=/var/secrets/storage-box-credentials"
"credentials=${secrets.storage-box-credentials.path}"
] ++ (
if (uid != null) then [ "uid=${toString uid}" ] else [ ]
) ++ (

10
secrets/gotosocial.age Normal file
View File

@@ -0,0 +1,10 @@
age-encryption.org/v1
-> ssh-ed25519 osOCZA j4E5QbHMQm/p5X87ADaDs3UXoYvK6kNOZN548Giiuxg
SGiUy4u4wZEPV5HyREfyGnmi1pZUxxTLNvpvWbvLw6A
-> ssh-ed25519 Zmk+Rw CKL/dmRt1uK8rXcL5/jvKVt8kbOMwbtD6QEszgkXjmU
t64DTcIze3o+KTYm5xtAW7l7B7EntcCN1DsOgmJLLno
-> ssh-ed25519 PT7ffg 0X40j5NfqTW0zDuJZTzJt0A96lzOMUqwiT8ePYHYRjM
22724DDGthA6cyJhB/oquTRy1VEEw6/0YBdDov61m2k
--- Somq6fnDd8OEprRrsbpy53fxyay1XL5TIgVa6KV2MJY
L¾Ê¿–'ûÿ¡Hj­²
#MìôbuÂ%dKƒ<12>ˆªø¹íõ0†ãûL/‡ü*I /’±<E28099>½š}¦{õ§ç·IÔÍVˆA

BIN
secrets/hastebin-tokens.age Normal file
View File

Binary file not shown.

BIN
secrets/immich.age Normal file
View File

Binary file not shown.

19
secrets/secrets.nix Normal file
View File

@@ -0,0 +1,19 @@
let
moco = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRXRJUwX98l2Vl4bUZdyHGhLjlf1RGAA5VCa4dmEJdU";
jokke = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0IGUXVtUChrWHMaHoGq4USQwviHR1v1CLeDztWshZ4";
users = [ moco jokke ];
apu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICAZkIuXtpP9a9bHkBl+MJI//q3ClMqzx03Rd/Xe4rjc";
freun-dev = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvCSjIjipog1Xf9mPc683r5VSGSjVc8v1UZg5VrbbxM";
radish = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQ0fy4n3yyD64+g55eZazeI5g9FurJnlC6fRiOXbbks";
hosts = [ apu freun-dev radish ];
in
{
"gotosocial.age".publicKeys = users ++ [ freun-dev ];
"hastebin-tokens.age".publicKeys = users ++ [ freun-dev ];
"immich.age".publicKeys = users ++ [ freun-dev ];
"storage-box-credentials.age".publicKeys = users ++ [ freun-dev ];
"vaultwarden.age".publicKeys = users ++ [ freun-dev ];
"smtp-password.age".publicKeys = users ++ [ freun-dev ];
}

BIN
secrets/smtp-password.age Normal file
View File

Binary file not shown.

BIN
secrets/storage-box-credentials.age Normal file
View File

Binary file not shown.

BIN
secrets/vaultwarden.age Normal file
View File

Binary file not shown.