Daholli/nixos-config
1
0
Fork 0
Code Issues 5 Pull requests Actions Packages Releases Activity

Factorio and Sops (#15)

Browse source
This commit is contained in:
Christoph Hollizeck 2024-04-27 20:49:28 +02:00 committed by GitHub
parent 600aed0b28 524b5b7d38
commit 18f81e4303
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 267 additions and 49 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
.sops.yaml Normal file
View file

@ -0,0 +1,7 @@
keys:
- &primary age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
creation_rules:
- path_regex: secrets/secrets.yaml$
key_groups:
- age:
- *primary

76
flake.lock
View file

@ -382,11 +382,11 @@
]
},
"locked": {
"lastModified": 1713077896,
"narHash": "sha256-Noot8H0EZEAFRQWyGxh9ryvhK96xpIqKbh78X447JWs=",
"lastModified": 1713906585,
"narHash": "sha256-fv84DCOkBtjF6wMATt0rfovu7e95L8rdEkSfNbwKR3U=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "630a0992b3627c64e34f179fab68e3d48c6991c0",
"rev": "bfa7c06436771e3a0c666ccc6ee01e815d4c33aa",
"type": "github"
},
"original": {
@ -462,11 +462,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1712909959,
"narHash": "sha256-7/5ubuwdEbQ7Z+Vqd4u0mM5L2VMNDsBh54visp27CtQ=",
"lastModified": 1713864415,
"narHash": "sha256-/BPDMJEkrsFAFOsQWhwm31wezlgshPFlLBn34KEUdVA=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "f58b25254be441cd2a9b4b444ed83f1e51244f1f",
"rev": "797f8d8082c7cc3259cba7275c699d4991b09ecc",
"type": "github"
},
"original": {
@ -477,11 +477,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1712791164,
"narHash": "sha256-3sbWO1mbpWsLepZGbWaMovSO7ndZeFqDSdX0hZ9nVyw=",
"lastModified": 1714076141,
"narHash": "sha256-Drmja/f5MRHZCskS6mvzFqxEaZMeciScCTFxWVLqWEY=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "1042fd8b148a9105f3c0aca3a6177fd1d9360ba5",
"rev": "7bb2ccd8cdc44c91edba16c48d2c8f331fb3d856",
"type": "github"
},
"original": {
@ -507,6 +507,38 @@
"type": "github"
}
},
"nixpkgs-stable_2": {
"locked": {
"lastModified": 1713638189,
"narHash": "sha256-q7APLfB6FmmSMI1Su5ihW9IwntBsk2hWNXh8XtSdSIk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "74574c38577914733b4f7a775dd77d24245081dd",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "release-23.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1713596654,
"narHash": "sha256-LJbHQQ5aX1LVth2ST+Kkse/DRzgxlVhTL1rxthvyhZc=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "fd16bb6d3bcca96039b11aa52038fafeb6e4f4be",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixvim": {
"inputs": {
"nixpkgs": [
@ -623,6 +655,7 @@
"nixvim": "nixvim",
"snowfall-flake": "snowfall-flake",
"snowfall-lib": "snowfall-lib_3",
"sops-nix": "sops-nix",
"unstable": "unstable_2"
}
},
@ -716,6 +749,25 @@
"type": "github"
}
},
"sops-nix": {
"inputs": {
"nixpkgs": "nixpkgs_2",
"nixpkgs-stable": "nixpkgs-stable_2"
},
"locked": {
"lastModified": 1713892811,
"narHash": "sha256-uIGmA2xq41vVFETCF1WW4fFWFT2tqBln+aXnWrvjGRE=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "f1b0adc27265274e3b0c9b872a8f476a098679bd",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
@ -809,11 +861,11 @@
},
"unstable_2": {
"locked": {
"lastModified": 1712791164,
"narHash": "sha256-3sbWO1mbpWsLepZGbWaMovSO7ndZeFqDSdX0hZ9nVyw=",
"lastModified": 1713714899,
"narHash": "sha256-+z/XjO3QJs5rLE5UOf015gdVauVRQd2vZtsFkaXBq2Y=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "1042fd8b148a9105f3c0aca3a6177fd1d9360ba5",
"rev": "6143fc5eeb9c4f00163267708e26191d1e918932",
"type": "github"
},
"original": {

3
flake.nix
View file

@ -41,6 +41,8 @@
url = "github:drduh/config";
flake = false;
};
sops-nix.url = "github:Mic92/sops-nix";
};
outputs =
@ -75,6 +77,7 @@
systems.modules.nixos = with inputs; [
home-manager.nixosModules.home-manager
nix-ld.nixosModules.nix-ld
sops-nix.nixosModules.sops
];
};
}

56
modules/nixos/apps/factorio-server/default.nix Normal file
View file

@ -0,0 +1,56 @@
{
lib,
config,
pkgs,
...
}:
with lib;
with lib.wyrdgard;
let
cfg = config.wyrdgard.apps.factorio-server;
inherit (config.wyrdgard.user) name;
in
{
options.wyrdgard.apps.factorio-server = with types; {
enable = mkEnableOption "Enable Factorio Headless Server";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ factorio-headless ];
sops = {
secrets = {
factorio_token = { restartUnits = ["factorio.service"]; };
factorio_username = { restartUnits = ["factorio.service"]; };
factorio_game_password = { restartUnits = ["factorio.service"]; };
};
templates."extraSettingsFile.json".content = ''
{
"name": "Alles Nix!",
"description": "Trying to run a factorio-headless-server on my nix system",
"tags": ["vanilla"],
"max_players": 10,
"game_password": "${config.sops.placeholder.factorio_game_password}",
"allow_commands": "admins-only",
"autosave_slots": 5,
"ignore_player_limit_for_returning_players": true,
"username" : "${config.sops.placeholder.factorio_username}",
"admins": ["${config.sops.placeholder.factorio_username}"],
"token": "${config.sops.placeholder.factorio_token}"
}
'';
templates."extraSettingsFile.json".mode = "0444";
};
services.factorio = {
enable = true;
openFirewall = true;
public = true;
lan = true;
nonBlockingSaving = true;
autosave-interval = 5;
loadLatestSave = true;
bind = "192.168.178.34";
extraSettingsFile = config.sops.templates."extraSettingsFile.json".path;
};
};
}

32
modules/nixos/nix/default.nix
View file

@ -10,37 +10,14 @@ with lib;
with lib.wyrdgard;
let
cfg = config.wyrdgard.nix;
substituters-submodule = types.submodule (
{ name, ... }:
{
options = with types; {
key = mkOpt (nullOr str) null "The trusted public key for this substituter.";
};
}
);
in
{
options.wyrdgard.nix = with types; {
enable = mkBoolOpt true "Whether or not to manage nix configuration.";
package = mkOpt package pkgs.nixUnstable "Which nix package to use.";
default-substituter = {
url = mkOpt str "https://cache.nixos.org" "The url for the substituter.";
key =
mkOpt str "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"The trusted public key for the substituter.";
};
extra-substituters = mkOpt (attrsOf substituters-submodule) { } "Extra substituters to configure.";
};
config = mkIf cfg.enable {
assertions = mapAttrsToList (name: value: {
assertion = value.key != null;
message = "wyrdgard.nix.extra-substituters.${name}.key must be set";
}) cfg.extra-substituters;
environment.systemPackages = with pkgs; [
snowfallorg.flake
nixfmt
@ -53,7 +30,7 @@ in
users = [
"root"
config.wyrdgard.user.name
] ++ optional config.services.hydra.enable "hydra";
];
in
{
package = cfg.package;
@ -68,13 +45,6 @@ in
auto-optimise-store = true;
trusted-users = users;
allowed-users = users;
substituters = [
cfg.default-substituter.url
] ++ (mapAttrsToList (name: value: name) cfg.extra-substituters);
trusted-public-keys = [
cfg.default-substituter.key
] ++ (mapAttrsToList (name: value: value.key) cfg.extra-substituters);
}
// (lib.optionalAttrs config.wyrdgard.tools.direnv.enable {
keep-outputs = true;

32
modules/nixos/security/sops/default.nix Normal file
View file

@ -0,0 +1,32 @@
{
options,
config,
pkgs,
lib,
inputs,
...
}:
with lib;
with lib.wyrdgard;
let
cfg = config.wyrdgard.security.sops;
in
{
options.wyrdgard.security.sops = with types; {
enable = mkBoolOpt true "Enable sops (Default true)";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
sops
age
];
sops = {
defaultSopsFile = ../../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.keyFile = "/home/cholli/.config/sops/age/keys.txt";
};
};
}

58
modules/nixos/security/syncthing/default.nix Normal file
View file

@ -0,0 +1,58 @@
{
options,
config,
pkgs,
lib,
inputs,
...
}:
with lib;
with lib.wyrdgard;
let
cfg = config.wyrdgard.security.syncthing;
user = config.wyrdgard.user;
in
{
options.wyrdgard.security.syncthing = with types; {
enable = mkEnableOption "Enable Syncthing";
};
config = mkIf cfg.enable {
services.syncthing = {
enable = true;
user = user.name;
dataDir = "/home/" + user.name + "/Documents";
configDir = "/home/" + user.name + "/Documents/.config/syncthing";
settings = {
folders = {
"Documents" = {
# Name of folder in Syncthing, also the folder ID
path = "/home/" + user.name + "/Documents"; # Which folder to add to Syncthing
};
"Pictures" = {
path = "/home/" + user.name + "/Pictures";
};
"7vfj7-k83xj" = {
path = "/home/" + user.name + "/WhatsApp Documents";
};
};
gui = {
theme = "black";
};
};
};
# Syncthing ports: 8384 for remote access to GUI
# 22000 TCP and/or UDP for sync traffic
# 21027/UDP for discovery
# source: https://docs.syncthing.net/users/firewall.html
networking.firewall.allowedTCPPorts = [
8384
22000
];
networking.firewall.allowedUDPPorts = [
22000
21027
];
};
}

7
modules/nixos/submodules/graphical-interface/default.nix
View file

@ -16,16 +16,19 @@ in
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ ];
environment.systemPackages = with pkgs; [ xdg-utils ];
services = {
xserver = {
enable = true;
};
displayManager.sddm = {
displayManager = {
defaultSession = "plasmax11";
sddm = {
enable = true;
wayland.enable = true;
};
};
desktopManager.plasma6 = enabled;
};
};

12
modules/nixos/system/hardware/audio/default.nix
View file

@ -24,7 +24,7 @@ in
programs.noisetorch.enable = true;
sound.enable = true;
hardware.pulseaudio.enable = false;
hardware.pulseaudio = disabled;
security.rtkit.enable = true;
services.pipewire = {
@ -32,6 +32,16 @@ in
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
wireplumber.configPackages = [
(pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/11-bluetooth-policy.conf" ''
wireplumber.settings = {
bluetooth.autoswitch-to-headset-profile = false
}
'')
(pkgs.writeTextDir "share/wireplumber/policy.lua.d/11-bluetooth-policy.conf" ''
bluetooth_policy.policy["media-role.use-headset-profile"] = false
'')
];
};
};
}

24
secrets/secrets.yaml Normal file
View file

@ -0,0 +1,24 @@
#ENC[AES256_GCM,data:Y75QxOB7YrOA,iv:mZ2f288IG/pmlQRtCqdcz03dDTYMnnj50Vsk/BwTJ+c=,tag:gPHZgq091G4LYMan9R6z1w==,type:comment]
factorio_username: ENC[AES256_GCM,data:rI7vF0XlaQ==,iv:+d5dD+nawphw+g8zavFXUr87bewTL1d+fuFnYKuYJKc=,tag:B8/6I7zi0b6xo8TFsY35Ug==,type:str]
factorio_token: ENC[AES256_GCM,data:0JOQv4UGiz2j2KPEoNm2IuE3qt8XfKuVEBWJ2+fF,iv:EUc8vhrB5NcgFKO7xTCxG2PzUuFCJFIl1KB90NqCOXw=,tag:rCilwxD8sw+Ql5HzvcUEJQ==,type:str]
factorio_game_password: ENC[AES256_GCM,data:OWETag==,iv:jkru1eLic7rl5RJVOMfF4cyT3FBGYCj3EKkpvMF22dk=,tag:sypcyM8ixpNdG70xiOzVIg==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZzJXVmZuRVlqQzVJcnds
V0paNCtXdkJKbzBrMEZGOVlYTTY2V2g2RDB3CkpWclcxNFZtb3I4VnZva3hJRy9I
dXRZUHIyVVpMVlRYc29CQktRTXJJYlEKLS0tIGgwWHBVLzl4dlErbllFZmFmUGxv
TzdjVjVtWmxNNm96WHhXSGM4WjErMkEKoGtyn6M91h+ye8U/ltOuOQ74RUo/2R37
l5vR47FUyzilUliIK2PDUMXM/S3Yk3Zi6g3XL8OPd53X5I1UYUJmRw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-04-27T18:23:44Z"
mac: ENC[AES256_GCM,data:U1Q5GQKV804mzs91/cgbHbdj96wZSdBQNj6U0Iw3Ybg4kgGbIdIP13gXzX/etoFTJzcy7JB4812KAjwoAFDcMjMtTADHIg8fo4zrSUm/FVVoX+SpVqtAqKprFOGgnX7DzAlUqlseZOZF05gmf7tz6vc2QUY4V8BvfTqfdFVrSHE=,iv:8nxqbUmstmf9nESDzcHtljH879lIyxE+JvnbVo/h3Tg=,tag:3cXhHBaQPc0dC6742ow3wA==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

5
systems/x86_64-linux/yggdrasil/default.nix
View file

@ -9,7 +9,7 @@ with lib.wyrdgard;
{
imports = [ ./hardware.nix ];
environment.systemPackages = with pkgs; [ ];
environment.systemPackages = with pkgs; [ jetbrains.rust-rover ];
environment.pathsToLink = [ "/libexec" ];
@ -23,6 +23,7 @@ with lib.wyrdgard;
discord = enabled;
_1password = enabled;
onedrive = enabled;
factorio-server = enabled;
};
system = {
@ -35,6 +36,8 @@ with lib.wyrdgard;
gpu.nvidia = enabled;
};
};
security.syncthing = enabled;
};
system.stateVersion = "23.11";