From 524b5b7d3867f9b6590524650f04ad2f8b440d48 Mon Sep 17 00:00:00 2001 From: Christoph Hollizeck Date: Sat, 27 Apr 2024 20:39:13 +0200 Subject: [PATCH] introduce sops to the config to be able to use encrypted tokens and passwords, also use these in factorio --- .sops.yaml | 7 ++ flake.lock | 76 ++++++++++++++++--- flake.nix | 3 + .../nixos/apps/factorio-server/default.nix | 33 +++++--- modules/nixos/security/sops/default.nix | 32 ++++++++ modules/nixos/security/syncthing/default.nix | 58 ++++++++++++++ .../nixos/system/hardware/audio/default.nix | 17 +++-- secrets/secrets.yaml | 24 ++++++ systems/x86_64-linux/yggdrasil/default.nix | 6 +- 9 files changed, 226 insertions(+), 30 deletions(-) create mode 100644 .sops.yaml create mode 100644 modules/nixos/security/sops/default.nix create mode 100644 modules/nixos/security/syncthing/default.nix create mode 100644 secrets/secrets.yaml diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..76fe9cb --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,7 @@ +keys: + - &primary age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85 +creation_rules: + - path_regex: secrets/secrets.yaml$ + key_groups: + - age: + - *primary diff --git a/flake.lock b/flake.lock index df7ffb4..517e95f 100644 --- a/flake.lock +++ b/flake.lock @@ -382,11 +382,11 @@ ] }, "locked": { - "lastModified": 1713166971, - "narHash": "sha256-t0P/rKlsE5l1O3O2LYtAelLzp7PeoPCSzsIietQ1hSM=", + "lastModified": 1713906585, + "narHash": "sha256-fv84DCOkBtjF6wMATt0rfovu7e95L8rdEkSfNbwKR3U=", "owner": "nix-community", "repo": "home-manager", - "rev": "1c43dcfac48a2d622797f7ab741670fdbcf8f609", + "rev": "bfa7c06436771e3a0c666ccc6ee01e815d4c33aa", "type": "github" }, "original": { @@ -462,11 +462,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1712909959, - "narHash": "sha256-7/5ubuwdEbQ7Z+Vqd4u0mM5L2VMNDsBh54visp27CtQ=", + "lastModified": 1713864415, + "narHash": "sha256-/BPDMJEkrsFAFOsQWhwm31wezlgshPFlLBn34KEUdVA=", "owner": "nixos", "repo": "nixos-hardware", - "rev": "f58b25254be441cd2a9b4b444ed83f1e51244f1f", + "rev": "797f8d8082c7cc3259cba7275c699d4991b09ecc", "type": "github" }, "original": { @@ -477,11 +477,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1713297878, - "narHash": "sha256-hOkzkhLT59wR8VaMbh1ESjtZLbGi+XNaBN6h49SPqEc=", + "lastModified": 1714076141, + "narHash": "sha256-Drmja/f5MRHZCskS6mvzFqxEaZMeciScCTFxWVLqWEY=", "owner": "nixos", "repo": "nixpkgs", - "rev": "66adc1e47f8784803f2deb6cacd5e07264ec2d5c", + "rev": "7bb2ccd8cdc44c91edba16c48d2c8f331fb3d856", "type": "github" }, "original": { @@ -507,6 +507,38 @@ "type": "github" } }, + "nixpkgs-stable_2": { + "locked": { + "lastModified": 1713638189, + "narHash": "sha256-q7APLfB6FmmSMI1Su5ihW9IwntBsk2hWNXh8XtSdSIk=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "74574c38577914733b4f7a775dd77d24245081dd", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "release-23.11", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_2": { + "locked": { + "lastModified": 1713596654, + "narHash": "sha256-LJbHQQ5aX1LVth2ST+Kkse/DRzgxlVhTL1rxthvyhZc=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "fd16bb6d3bcca96039b11aa52038fafeb6e4f4be", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, "nixvim": { "inputs": { "nixpkgs": [ @@ -623,6 +655,7 @@ "nixvim": "nixvim", "snowfall-flake": "snowfall-flake", "snowfall-lib": "snowfall-lib_3", + "sops-nix": "sops-nix", "unstable": "unstable_2" } }, @@ -716,6 +749,25 @@ "type": "github" } }, + "sops-nix": { + "inputs": { + "nixpkgs": "nixpkgs_2", + "nixpkgs-stable": "nixpkgs-stable_2" + }, + "locked": { + "lastModified": 1713892811, + "narHash": "sha256-uIGmA2xq41vVFETCF1WW4fFWFT2tqBln+aXnWrvjGRE=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "f1b0adc27265274e3b0c9b872a8f476a098679bd", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1681028828, @@ -809,11 +861,11 @@ }, "unstable_2": { "locked": { - "lastModified": 1712963716, - "narHash": "sha256-WKm9CvgCldeIVvRz87iOMi8CFVB1apJlkUT4GGvA0iM=", + "lastModified": 1713714899, + "narHash": "sha256-+z/XjO3QJs5rLE5UOf015gdVauVRQd2vZtsFkaXBq2Y=", "owner": "nixos", "repo": "nixpkgs", - "rev": "cfd6b5fc90b15709b780a5a1619695a88505a176", + "rev": "6143fc5eeb9c4f00163267708e26191d1e918932", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 93b0ba1..3801936 100644 --- a/flake.nix +++ b/flake.nix @@ -41,6 +41,8 @@ url = "github:drduh/config"; flake = false; }; + + sops-nix.url = "github:Mic92/sops-nix"; }; outputs = @@ -75,6 +77,7 @@ systems.modules.nixos = with inputs; [ home-manager.nixosModules.home-manager nix-ld.nixosModules.nix-ld + sops-nix.nixosModules.sops ]; }; } diff --git a/modules/nixos/apps/factorio-server/default.nix b/modules/nixos/apps/factorio-server/default.nix index a0b29e9..0073dd0 100644 --- a/modules/nixos/apps/factorio-server/default.nix +++ b/modules/nixos/apps/factorio-server/default.nix @@ -17,25 +17,40 @@ in config = mkIf cfg.enable { environment.systemPackages = with pkgs; [ factorio-headless ]; + sops = { + secrets = { + factorio_token = { restartUnits = ["factorio.service"]; }; + factorio_username = { restartUnits = ["factorio.service"]; }; + factorio_game_password = { restartUnits = ["factorio.service"]; }; + }; + templates."extraSettingsFile.json".content = '' + { + "name": "Alles Nix!", + "description": "Trying to run a factorio-headless-server on my nix system", + "tags": ["vanilla"], + "max_players": 10, + "game_password": "${config.sops.placeholder.factorio_game_password}", + "allow_commands": "admins-only", + "autosave_slots": 5, + "ignore_player_limit_for_returning_players": true, + "username" : "${config.sops.placeholder.factorio_username}", + "admins": ["${config.sops.placeholder.factorio_username}"], + "token": "${config.sops.placeholder.factorio_token}" + } + ''; + templates."extraSettingsFile.json".mode = "0444"; + }; services.factorio = { enable = true; openFirewall = true; public = true; lan = true; - admins = [ - "DaHolli" - "Galbrain" - ]; nonBlockingSaving = true; autosave-interval = 5; loadLatestSave = true; - username = "DaHolli"; - token = "4d4624ca9a23396e1955c1b4b364ff"; - game-name = "Alles Nix!"; - game-password = "1234"; - saveName = "Vanilla"; bind = "192.168.178.34"; + extraSettingsFile = config.sops.templates."extraSettingsFile.json".path; }; }; } diff --git a/modules/nixos/security/sops/default.nix b/modules/nixos/security/sops/default.nix new file mode 100644 index 0000000..8a3db4b --- /dev/null +++ b/modules/nixos/security/sops/default.nix @@ -0,0 +1,32 @@ +{ + options, + config, + pkgs, + lib, + inputs, + ... +}: +with lib; +with lib.wyrdgard; +let + cfg = config.wyrdgard.security.sops; +in +{ + options.wyrdgard.security.sops = with types; { + enable = mkBoolOpt true "Enable sops (Default true)"; + }; + + config = mkIf cfg.enable { + environment.systemPackages = with pkgs; [ + sops + age + ]; + + sops = { + defaultSopsFile = ../../../../secrets/secrets.yaml; + defaultSopsFormat = "yaml"; + + age.keyFile = "/home/cholli/.config/sops/age/keys.txt"; + }; + }; +} diff --git a/modules/nixos/security/syncthing/default.nix b/modules/nixos/security/syncthing/default.nix new file mode 100644 index 0000000..b48f622 --- /dev/null +++ b/modules/nixos/security/syncthing/default.nix @@ -0,0 +1,58 @@ +{ + options, + config, + pkgs, + lib, + inputs, + ... +}: +with lib; +with lib.wyrdgard; +let + cfg = config.wyrdgard.security.syncthing; + user = config.wyrdgard.user; +in +{ + options.wyrdgard.security.syncthing = with types; { + enable = mkEnableOption "Enable Syncthing"; + }; + + config = mkIf cfg.enable { + services.syncthing = { + enable = true; + user = user.name; + dataDir = "/home/" + user.name + "/Documents"; + configDir = "/home/" + user.name + "/Documents/.config/syncthing"; + settings = { + folders = { + "Documents" = { + # Name of folder in Syncthing, also the folder ID + path = "/home/" + user.name + "/Documents"; # Which folder to add to Syncthing + }; + "Pictures" = { + path = "/home/" + user.name + "/Pictures"; + }; + "7vfj7-k83xj" = { + path = "/home/" + user.name + "/WhatsApp Documents"; + }; + }; + gui = { + theme = "black"; + }; + }; + }; + + # Syncthing ports: 8384 for remote access to GUI + # 22000 TCP and/or UDP for sync traffic + # 21027/UDP for discovery + # source: https://docs.syncthing.net/users/firewall.html + networking.firewall.allowedTCPPorts = [ + 8384 + 22000 + ]; + networking.firewall.allowedUDPPorts = [ + 22000 + 21027 + ]; + }; +} diff --git a/modules/nixos/system/hardware/audio/default.nix b/modules/nixos/system/hardware/audio/default.nix index dd741d8..dfd99ad 100644 --- a/modules/nixos/system/hardware/audio/default.nix +++ b/modules/nixos/system/hardware/audio/default.nix @@ -32,13 +32,16 @@ in alsa.enable = true; alsa.support32Bit = true; pulse.enable = true; - extraConfig = { - "11-bluetooth-policy" = { - "bluetooth_policy.policy" = { - "media-role.use-headset-profile" = false; - }; - }; - }; + wireplumber.configPackages = [ + (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/11-bluetooth-policy.conf" '' + wireplumber.settings = { + bluetooth.autoswitch-to-headset-profile = false + } + '') + (pkgs.writeTextDir "share/wireplumber/policy.lua.d/11-bluetooth-policy.conf" '' + bluetooth_policy.policy["media-role.use-headset-profile"] = false + '') + ]; }; }; } diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml new file mode 100644 index 0000000..d8f1f76 --- /dev/null +++ b/secrets/secrets.yaml @@ -0,0 +1,24 @@ +#ENC[AES256_GCM,data:Y75QxOB7YrOA,iv:mZ2f288IG/pmlQRtCqdcz03dDTYMnnj50Vsk/BwTJ+c=,tag:gPHZgq091G4LYMan9R6z1w==,type:comment] +factorio_username: ENC[AES256_GCM,data:rI7vF0XlaQ==,iv:+d5dD+nawphw+g8zavFXUr87bewTL1d+fuFnYKuYJKc=,tag:B8/6I7zi0b6xo8TFsY35Ug==,type:str] +factorio_token: ENC[AES256_GCM,data:0JOQv4UGiz2j2KPEoNm2IuE3qt8XfKuVEBWJ2+fF,iv:EUc8vhrB5NcgFKO7xTCxG2PzUuFCJFIl1KB90NqCOXw=,tag:rCilwxD8sw+Ql5HzvcUEJQ==,type:str] +factorio_game_password: ENC[AES256_GCM,data:OWETag==,iv:jkru1eLic7rl5RJVOMfF4cyT3FBGYCj3EKkpvMF22dk=,tag:sypcyM8ixpNdG70xiOzVIg==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZzJXVmZuRVlqQzVJcnds + V0paNCtXdkJKbzBrMEZGOVlYTTY2V2g2RDB3CkpWclcxNFZtb3I4VnZva3hJRy9I + dXRZUHIyVVpMVlRYc29CQktRTXJJYlEKLS0tIGgwWHBVLzl4dlErbllFZmFmUGxv + TzdjVjVtWmxNNm96WHhXSGM4WjErMkEKoGtyn6M91h+ye8U/ltOuOQ74RUo/2R37 + l5vR47FUyzilUliIK2PDUMXM/S3Yk3Zi6g3XL8OPd53X5I1UYUJmRw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-04-27T18:23:44Z" + mac: ENC[AES256_GCM,data:U1Q5GQKV804mzs91/cgbHbdj96wZSdBQNj6U0Iw3Ybg4kgGbIdIP13gXzX/etoFTJzcy7JB4812KAjwoAFDcMjMtTADHIg8fo4zrSUm/FVVoX+SpVqtAqKprFOGgnX7DzAlUqlseZOZF05gmf7tz6vc2QUY4V8BvfTqfdFVrSHE=,iv:8nxqbUmstmf9nESDzcHtljH879lIyxE+JvnbVo/h3Tg=,tag:3cXhHBaQPc0dC6742ow3wA==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.8.1 diff --git a/systems/x86_64-linux/yggdrasil/default.nix b/systems/x86_64-linux/yggdrasil/default.nix index 61a59a7..1b58632 100644 --- a/systems/x86_64-linux/yggdrasil/default.nix +++ b/systems/x86_64-linux/yggdrasil/default.nix @@ -9,7 +9,7 @@ with lib.wyrdgard; { imports = [ ./hardware.nix ]; - environment.systemPackages = with pkgs; [ ]; + environment.systemPackages = with pkgs; [ jetbrains.rust-rover ]; environment.pathsToLink = [ "/libexec" ]; @@ -23,7 +23,7 @@ with lib.wyrdgard; discord = enabled; _1password = enabled; onedrive = enabled; - factorio-server = disabled; + factorio-server = enabled; }; system = { @@ -36,6 +36,8 @@ with lib.wyrdgard; gpu.nvidia = enabled; }; }; + + security.syncthing = enabled; }; system.stateVersion = "23.11";