Factorio and Sops (#15)

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &primary age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups: 
+    - age:
+      - *primary

flake.lock

@@ -382,11 +382,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1713077896,
+        "lastModified": 1713906585,
-        "narHash": "sha256-Noot8H0EZEAFRQWyGxh9ryvhK96xpIqKbh78X447JWs=",
+        "narHash": "sha256-fv84DCOkBtjF6wMATt0rfovu7e95L8rdEkSfNbwKR3U=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "630a0992b3627c64e34f179fab68e3d48c6991c0",
+        "rev": "bfa7c06436771e3a0c666ccc6ee01e815d4c33aa",
         "type": "github"
       },
       "original": {
@@ -462,11 +462,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1712909959,
+        "lastModified": 1713864415,
-        "narHash": "sha256-7/5ubuwdEbQ7Z+Vqd4u0mM5L2VMNDsBh54visp27CtQ=",
+        "narHash": "sha256-/BPDMJEkrsFAFOsQWhwm31wezlgshPFlLBn34KEUdVA=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "f58b25254be441cd2a9b4b444ed83f1e51244f1f",
+        "rev": "797f8d8082c7cc3259cba7275c699d4991b09ecc",
         "type": "github"
       },
       "original": {
@@ -477,11 +477,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1712791164,
+        "lastModified": 1714076141,
-        "narHash": "sha256-3sbWO1mbpWsLepZGbWaMovSO7ndZeFqDSdX0hZ9nVyw=",
+        "narHash": "sha256-Drmja/f5MRHZCskS6mvzFqxEaZMeciScCTFxWVLqWEY=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1042fd8b148a9105f3c0aca3a6177fd1d9360ba5",
+        "rev": "7bb2ccd8cdc44c91edba16c48d2c8f331fb3d856",
         "type": "github"
       },
       "original": {
@@ -507,6 +507,38 @@
         "type": "github"
       }
     },
+    "nixpkgs-stable_2": {
+      "locked": {
+        "lastModified": 1713638189,
+        "narHash": "sha256-q7APLfB6FmmSMI1Su5ihW9IwntBsk2hWNXh8XtSdSIk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "74574c38577914733b4f7a775dd77d24245081dd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1713596654,
+        "narHash": "sha256-LJbHQQ5aX1LVth2ST+Kkse/DRzgxlVhTL1rxthvyhZc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fd16bb6d3bcca96039b11aa52038fafeb6e4f4be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixvim": {
       "inputs": {
         "nixpkgs": [
@@ -623,6 +655,7 @@
         "nixvim": "nixvim",
         "snowfall-flake": "snowfall-flake",
         "snowfall-lib": "snowfall-lib_3",
+        "sops-nix": "sops-nix",
         "unstable": "unstable_2"
       }
     },
@@ -716,6 +749,25 @@
         "type": "github"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-stable": "nixpkgs-stable_2"
+      },
+      "locked": {
+        "lastModified": 1713892811,
+        "narHash": "sha256-uIGmA2xq41vVFETCF1WW4fFWFT2tqBln+aXnWrvjGRE=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "f1b0adc27265274e3b0c9b872a8f476a098679bd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -809,11 +861,11 @@
     },
     "unstable_2": {
       "locked": {
-        "lastModified": 1712791164,
+        "lastModified": 1713714899,
-        "narHash": "sha256-3sbWO1mbpWsLepZGbWaMovSO7ndZeFqDSdX0hZ9nVyw=",
+        "narHash": "sha256-+z/XjO3QJs5rLE5UOf015gdVauVRQd2vZtsFkaXBq2Y=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1042fd8b148a9105f3c0aca3a6177fd1d9360ba5",
+        "rev": "6143fc5eeb9c4f00163267708e26191d1e918932",
         "type": "github"
       },
       "original": {

flake.nix

@@ -41,6 +41,8 @@
       url = "github:drduh/config";
       flake = false;
     };
+
+    sops-nix.url = "github:Mic92/sops-nix";
   };
 
   outputs =
@@ -75,6 +77,7 @@
       systems.modules.nixos = with inputs; [
         home-manager.nixosModules.home-manager
         nix-ld.nixosModules.nix-ld
+        sops-nix.nixosModules.sops
       ];
     };
 }

modules/nixos/apps/factorio-server/default.nix

@@ -0,0 +1,56 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib;
+with lib.wyrdgard;
+let
+  cfg = config.wyrdgard.apps.factorio-server;
+  inherit (config.wyrdgard.user) name;
+in
+{
+  options.wyrdgard.apps.factorio-server = with types; {
+    enable = mkEnableOption "Enable Factorio Headless Server";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [ factorio-headless ];
+    sops = {
+      secrets = {
+        factorio_token = { restartUnits = ["factorio.service"]; };
+        factorio_username = { restartUnits = ["factorio.service"]; };
+        factorio_game_password = { restartUnits = ["factorio.service"]; };
+      };
+      templates."extraSettingsFile.json".content = ''
+        {
+          "name": "Alles Nix!",
+          "description": "Trying to run a factorio-headless-server on my nix system",
+          "tags": ["vanilla"],
+          "max_players": 10,
+          "game_password": "${config.sops.placeholder.factorio_game_password}",
+          "allow_commands": "admins-only",
+          "autosave_slots": 5,
+          "ignore_player_limit_for_returning_players": true,
+          "username" : "${config.sops.placeholder.factorio_username}",
+          "admins": ["${config.sops.placeholder.factorio_username}"],
+          "token": "${config.sops.placeholder.factorio_token}"
+        }
+      '';
+      templates."extraSettingsFile.json".mode = "0444";
+    };
+
+    services.factorio = {
+      enable = true;
+      openFirewall = true;
+      public = true;
+      lan = true;
+      nonBlockingSaving = true;
+      autosave-interval = 5;
+      loadLatestSave = true;
+      bind = "192.168.178.34";
+      extraSettingsFile = config.sops.templates."extraSettingsFile.json".path;
+    };
+  };
+}

modules/nixos/nix/default.nix

@@ -10,37 +10,14 @@ with lib;
 with lib.wyrdgard;
 let
   cfg = config.wyrdgard.nix;
-
-  substituters-submodule = types.submodule (
-    { name, ... }:
-    {
-      options = with types; {
-        key = mkOpt (nullOr str) null "The trusted public key for this substituter.";
-      };
-    }
-  );
 in
 {
   options.wyrdgard.nix = with types; {
     enable = mkBoolOpt true "Whether or not to manage nix configuration.";
     package = mkOpt package pkgs.nixUnstable "Which nix package to use.";
-
-    default-substituter = {
-      url = mkOpt str "https://cache.nixos.org" "The url for the substituter.";
-      key =
-        mkOpt str "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-          "The trusted public key for the substituter.";
-    };
-
-    extra-substituters = mkOpt (attrsOf substituters-submodule) { } "Extra substituters to configure.";
   };
 
   config = mkIf cfg.enable {
-    assertions = mapAttrsToList (name: value: {
-      assertion = value.key != null;
-      message = "wyrdgard.nix.extra-substituters.${name}.key must be set";
-    }) cfg.extra-substituters;
-
     environment.systemPackages = with pkgs; [
       snowfallorg.flake
       nixfmt
@@ -53,7 +30,7 @@ in
         users = [
           "root"
           config.wyrdgard.user.name
-        ] ++ optional config.services.hydra.enable "hydra";
+        ];
       in
       {
         package = cfg.package;
@@ -68,13 +45,6 @@ in
             auto-optimise-store = true;
             trusted-users = users;
             allowed-users = users;
-
-            substituters = [
-              cfg.default-substituter.url
-            ] ++ (mapAttrsToList (name: value: name) cfg.extra-substituters);
-            trusted-public-keys = [
-              cfg.default-substituter.key
-            ] ++ (mapAttrsToList (name: value: value.key) cfg.extra-substituters);
           }
           // (lib.optionalAttrs config.wyrdgard.tools.direnv.enable {
             keep-outputs = true;

modules/nixos/security/sops/default.nix

@@ -0,0 +1,32 @@
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+with lib;
+with lib.wyrdgard;
+let
+  cfg = config.wyrdgard.security.sops;
+in
+{
+  options.wyrdgard.security.sops = with types; {
+    enable = mkBoolOpt true "Enable sops (Default true)";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      sops
+      age
+    ];
+
+    sops = {
+      defaultSopsFile = ../../../../secrets/secrets.yaml;
+      defaultSopsFormat = "yaml";
+
+      age.keyFile = "/home/cholli/.config/sops/age/keys.txt";
+    };
+  };
+}

modules/nixos/security/syncthing/default.nix

@@ -0,0 +1,58 @@
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+with lib;
+with lib.wyrdgard;
+let
+  cfg = config.wyrdgard.security.syncthing;
+  user = config.wyrdgard.user;
+in
+{
+  options.wyrdgard.security.syncthing = with types; {
+    enable = mkEnableOption "Enable Syncthing";
+  };
+
+  config = mkIf cfg.enable {
+    services.syncthing = {
+      enable = true;
+      user = user.name;
+      dataDir = "/home/" + user.name + "/Documents";
+      configDir = "/home/" + user.name + "/Documents/.config/syncthing";
+      settings = {
+        folders = {
+          "Documents" = {
+            # Name of folder in Syncthing, also the folder ID
+            path = "/home/" + user.name + "/Documents"; # Which folder to add to Syncthing
+          };
+          "Pictures" = {
+            path = "/home/" + user.name + "/Pictures";
+          };
+          "7vfj7-k83xj" = {
+            path = "/home/" + user.name + "/WhatsApp Documents";
+          };
+        };
+        gui = {
+          theme = "black";
+        };
+      };
+    };
+
+    # Syncthing ports: 8384 for remote access to GUI
+    # 22000 TCP and/or UDP for sync traffic
+    # 21027/UDP for discovery
+    # source: https://docs.syncthing.net/users/firewall.html
+    networking.firewall.allowedTCPPorts = [
+      8384
+      22000
+    ];
+    networking.firewall.allowedUDPPorts = [
+      22000
+      21027
+    ];
+  };
+}

modules/nixos/submodules/graphical-interface/default.nix

@@ -16,15 +16,18 @@ in
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [ ];
+    environment.systemPackages = with pkgs; [ xdg-utils ];
 
     services = {
       xserver = {
         enable = true;
       };
-      displayManager.sddm = {
+      displayManager = {
-        enable = true;
+        defaultSession = "plasmax11";
-        wayland.enable = true;
+        sddm = {
+          enable = true;
+          wayland.enable = true;
+        };
       };
       desktopManager.plasma6 = enabled;
     };

modules/nixos/system/hardware/audio/default.nix

@@ -24,7 +24,7 @@ in
     programs.noisetorch.enable = true;
 
     sound.enable = true;
-    hardware.pulseaudio.enable = false;
+    hardware.pulseaudio = disabled;
     security.rtkit.enable = true;
 
     services.pipewire = {
@@ -32,6 +32,16 @@ in
       alsa.enable = true;
       alsa.support32Bit = true;
       pulse.enable = true;
+      wireplumber.configPackages = [
+        (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/11-bluetooth-policy.conf" ''
+          wireplumber.settings = {	
+            bluetooth.autoswitch-to-headset-profile = false	
+          }
+        '')
+        (pkgs.writeTextDir "share/wireplumber/policy.lua.d/11-bluetooth-policy.conf" ''
+          bluetooth_policy.policy["media-role.use-headset-profile"] = false
+        '')
+      ];
     };
   };
 }

secrets/secrets.yaml

@@ -0,0 +1,24 @@
+#ENC[AES256_GCM,data:Y75QxOB7YrOA,iv:mZ2f288IG/pmlQRtCqdcz03dDTYMnnj50Vsk/BwTJ+c=,tag:gPHZgq091G4LYMan9R6z1w==,type:comment]
+factorio_username: ENC[AES256_GCM,data:rI7vF0XlaQ==,iv:+d5dD+nawphw+g8zavFXUr87bewTL1d+fuFnYKuYJKc=,tag:B8/6I7zi0b6xo8TFsY35Ug==,type:str]
+factorio_token: ENC[AES256_GCM,data:0JOQv4UGiz2j2KPEoNm2IuE3qt8XfKuVEBWJ2+fF,iv:EUc8vhrB5NcgFKO7xTCxG2PzUuFCJFIl1KB90NqCOXw=,tag:rCilwxD8sw+Ql5HzvcUEJQ==,type:str]
+factorio_game_password: ENC[AES256_GCM,data:OWETag==,iv:jkru1eLic7rl5RJVOMfF4cyT3FBGYCj3EKkpvMF22dk=,tag:sypcyM8ixpNdG70xiOzVIg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZzJXVmZuRVlqQzVJcnds
+            V0paNCtXdkJKbzBrMEZGOVlYTTY2V2g2RDB3CkpWclcxNFZtb3I4VnZva3hJRy9I
+            dXRZUHIyVVpMVlRYc29CQktRTXJJYlEKLS0tIGgwWHBVLzl4dlErbllFZmFmUGxv
+            TzdjVjVtWmxNNm96WHhXSGM4WjErMkEKoGtyn6M91h+ye8U/ltOuOQ74RUo/2R37
+            l5vR47FUyzilUliIK2PDUMXM/S3Yk3Zi6g3XL8OPd53X5I1UYUJmRw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-04-27T18:23:44Z"
+    mac: ENC[AES256_GCM,data:U1Q5GQKV804mzs91/cgbHbdj96wZSdBQNj6U0Iw3Ybg4kgGbIdIP13gXzX/etoFTJzcy7JB4812KAjwoAFDcMjMtTADHIg8fo4zrSUm/FVVoX+SpVqtAqKprFOGgnX7DzAlUqlseZOZF05gmf7tz6vc2QUY4V8BvfTqfdFVrSHE=,iv:8nxqbUmstmf9nESDzcHtljH879lIyxE+JvnbVo/h3Tg=,tag:3cXhHBaQPc0dC6742ow3wA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

systems/x86_64-linux/yggdrasil/default.nix

@@ -9,7 +9,7 @@ with lib.wyrdgard;
 {
   imports = [ ./hardware.nix ];
 
-  environment.systemPackages = with pkgs; [ ];
+  environment.systemPackages = with pkgs; [ jetbrains.rust-rover ];
 
   environment.pathsToLink = [ "/libexec" ];
 
@@ -23,6 +23,7 @@ with lib.wyrdgard;
       discord = enabled;
       _1password = enabled;
       onedrive = enabled;
+      factorio-server = enabled;
     };
 
     system = {
@@ -35,6 +36,8 @@ with lib.wyrdgard;
         gpu.nvidia = enabled;
       };
     };
+
+    security.syncthing = enabled;
   };
 
   system.stateVersion = "23.11";