introduce sops to the config to be able to use encrypted tokens and passwords, also use these in factorio

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &primary age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups: 
+    - age:
+      - *primary

flake.lock

@@ -382,11 +382,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1713166971,
+        "lastModified": 1713906585,
-        "narHash": "sha256-t0P/rKlsE5l1O3O2LYtAelLzp7PeoPCSzsIietQ1hSM=",
+        "narHash": "sha256-fv84DCOkBtjF6wMATt0rfovu7e95L8rdEkSfNbwKR3U=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1c43dcfac48a2d622797f7ab741670fdbcf8f609",
+        "rev": "bfa7c06436771e3a0c666ccc6ee01e815d4c33aa",
         "type": "github"
       },
       "original": {
@@ -462,11 +462,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1712909959,
+        "lastModified": 1713864415,
-        "narHash": "sha256-7/5ubuwdEbQ7Z+Vqd4u0mM5L2VMNDsBh54visp27CtQ=",
+        "narHash": "sha256-/BPDMJEkrsFAFOsQWhwm31wezlgshPFlLBn34KEUdVA=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "f58b25254be441cd2a9b4b444ed83f1e51244f1f",
+        "rev": "797f8d8082c7cc3259cba7275c699d4991b09ecc",
         "type": "github"
       },
       "original": {
@@ -477,11 +477,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1713297878,
+        "lastModified": 1714076141,
-        "narHash": "sha256-hOkzkhLT59wR8VaMbh1ESjtZLbGi+XNaBN6h49SPqEc=",
+        "narHash": "sha256-Drmja/f5MRHZCskS6mvzFqxEaZMeciScCTFxWVLqWEY=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "66adc1e47f8784803f2deb6cacd5e07264ec2d5c",
+        "rev": "7bb2ccd8cdc44c91edba16c48d2c8f331fb3d856",
         "type": "github"
       },
       "original": {
@@ -507,6 +507,38 @@
         "type": "github"
       }
     },
+    "nixpkgs-stable_2": {
+      "locked": {
+        "lastModified": 1713638189,
+        "narHash": "sha256-q7APLfB6FmmSMI1Su5ihW9IwntBsk2hWNXh8XtSdSIk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "74574c38577914733b4f7a775dd77d24245081dd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1713596654,
+        "narHash": "sha256-LJbHQQ5aX1LVth2ST+Kkse/DRzgxlVhTL1rxthvyhZc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fd16bb6d3bcca96039b11aa52038fafeb6e4f4be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixvim": {
       "inputs": {
         "nixpkgs": [
@@ -623,6 +655,7 @@
         "nixvim": "nixvim",
         "snowfall-flake": "snowfall-flake",
         "snowfall-lib": "snowfall-lib_3",
+        "sops-nix": "sops-nix",
         "unstable": "unstable_2"
       }
     },
@@ -716,6 +749,25 @@
         "type": "github"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-stable": "nixpkgs-stable_2"
+      },
+      "locked": {
+        "lastModified": 1713892811,
+        "narHash": "sha256-uIGmA2xq41vVFETCF1WW4fFWFT2tqBln+aXnWrvjGRE=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "f1b0adc27265274e3b0c9b872a8f476a098679bd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -809,11 +861,11 @@
     },
     "unstable_2": {
       "locked": {
-        "lastModified": 1712963716,
+        "lastModified": 1713714899,
-        "narHash": "sha256-WKm9CvgCldeIVvRz87iOMi8CFVB1apJlkUT4GGvA0iM=",
+        "narHash": "sha256-+z/XjO3QJs5rLE5UOf015gdVauVRQd2vZtsFkaXBq2Y=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "cfd6b5fc90b15709b780a5a1619695a88505a176",
+        "rev": "6143fc5eeb9c4f00163267708e26191d1e918932",
         "type": "github"
       },
       "original": {

flake.nix

@@ -41,6 +41,8 @@
       url = "github:drduh/config";
       flake = false;
     };
+
+    sops-nix.url = "github:Mic92/sops-nix";
   };
 
   outputs =
@@ -75,6 +77,7 @@
       systems.modules.nixos = with inputs; [
         home-manager.nixosModules.home-manager
         nix-ld.nixosModules.nix-ld
+        sops-nix.nixosModules.sops
       ];
     };
 }

modules/nixos/apps/factorio-server/default.nix

@@ -17,25 +17,40 @@ in
 
   config = mkIf cfg.enable {
     environment.systemPackages = with pkgs; [ factorio-headless ];
+    sops = {
+      secrets = {
+        factorio_token = { restartUnits = ["factorio.service"]; };
+        factorio_username = { restartUnits = ["factorio.service"]; };
+        factorio_game_password = { restartUnits = ["factorio.service"]; };
+      };
+      templates."extraSettingsFile.json".content = ''
+        {
+          "name": "Alles Nix!",
+          "description": "Trying to run a factorio-headless-server on my nix system",
+          "tags": ["vanilla"],
+          "max_players": 10,
+          "game_password": "${config.sops.placeholder.factorio_game_password}",
+          "allow_commands": "admins-only",
+          "autosave_slots": 5,
+          "ignore_player_limit_for_returning_players": true,
+          "username" : "${config.sops.placeholder.factorio_username}",
+          "admins": ["${config.sops.placeholder.factorio_username}"],
+          "token": "${config.sops.placeholder.factorio_token}"
+        }
+      '';
+      templates."extraSettingsFile.json".mode = "0444";
+    };
 
     services.factorio = {
       enable = true;
       openFirewall = true;
       public = true;
       lan = true;
-      admins = [
-        "DaHolli"
-        "Galbrain"
-      ];
       nonBlockingSaving = true;
       autosave-interval = 5;
       loadLatestSave = true;
-      username = "DaHolli";
-      token = "4d4624ca9a23396e1955c1b4b364ff";
-      game-name = "Alles Nix!";
-      game-password = "1234";
-      saveName = "Vanilla";
       bind = "192.168.178.34";
+      extraSettingsFile = config.sops.templates."extraSettingsFile.json".path;
     };
   };
 }

modules/nixos/security/sops/default.nix

@@ -0,0 +1,32 @@
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+with lib;
+with lib.wyrdgard;
+let
+  cfg = config.wyrdgard.security.sops;
+in
+{
+  options.wyrdgard.security.sops = with types; {
+    enable = mkBoolOpt true "Enable sops (Default true)";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      sops
+      age
+    ];
+
+    sops = {
+      defaultSopsFile = ../../../../secrets/secrets.yaml;
+      defaultSopsFormat = "yaml";
+
+      age.keyFile = "/home/cholli/.config/sops/age/keys.txt";
+    };
+  };
+}

modules/nixos/security/syncthing/default.nix

@@ -0,0 +1,58 @@
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+with lib;
+with lib.wyrdgard;
+let
+  cfg = config.wyrdgard.security.syncthing;
+  user = config.wyrdgard.user;
+in
+{
+  options.wyrdgard.security.syncthing = with types; {
+    enable = mkEnableOption "Enable Syncthing";
+  };
+
+  config = mkIf cfg.enable {
+    services.syncthing = {
+      enable = true;
+      user = user.name;
+      dataDir = "/home/" + user.name + "/Documents";
+      configDir = "/home/" + user.name + "/Documents/.config/syncthing";
+      settings = {
+        folders = {
+          "Documents" = {
+            # Name of folder in Syncthing, also the folder ID
+            path = "/home/" + user.name + "/Documents"; # Which folder to add to Syncthing
+          };
+          "Pictures" = {
+            path = "/home/" + user.name + "/Pictures";
+          };
+          "7vfj7-k83xj" = {
+            path = "/home/" + user.name + "/WhatsApp Documents";
+          };
+        };
+        gui = {
+          theme = "black";
+        };
+      };
+    };
+
+    # Syncthing ports: 8384 for remote access to GUI
+    # 22000 TCP and/or UDP for sync traffic
+    # 21027/UDP for discovery
+    # source: https://docs.syncthing.net/users/firewall.html
+    networking.firewall.allowedTCPPorts = [
+      8384
+      22000
+    ];
+    networking.firewall.allowedUDPPorts = [
+      22000
+      21027
+    ];
+  };
+}

modules/nixos/system/hardware/audio/default.nix

@@ -32,13 +32,16 @@ in
       alsa.enable = true;
       alsa.support32Bit = true;
       pulse.enable = true;
-      extraConfig = {
+      wireplumber.configPackages = [
-        "11-bluetooth-policy" = {
+        (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/11-bluetooth-policy.conf" ''
-          "bluetooth_policy.policy" = {
+          wireplumber.settings = {	
-            "media-role.use-headset-profile" = false;
+            bluetooth.autoswitch-to-headset-profile = false	
-          };
+          }
-        };
+        '')
-      };
+        (pkgs.writeTextDir "share/wireplumber/policy.lua.d/11-bluetooth-policy.conf" ''
+          bluetooth_policy.policy["media-role.use-headset-profile"] = false
+        '')
+      ];
     };
   };
 }

secrets/secrets.yaml

@@ -0,0 +1,24 @@
+#ENC[AES256_GCM,data:Y75QxOB7YrOA,iv:mZ2f288IG/pmlQRtCqdcz03dDTYMnnj50Vsk/BwTJ+c=,tag:gPHZgq091G4LYMan9R6z1w==,type:comment]
+factorio_username: ENC[AES256_GCM,data:rI7vF0XlaQ==,iv:+d5dD+nawphw+g8zavFXUr87bewTL1d+fuFnYKuYJKc=,tag:B8/6I7zi0b6xo8TFsY35Ug==,type:str]
+factorio_token: ENC[AES256_GCM,data:0JOQv4UGiz2j2KPEoNm2IuE3qt8XfKuVEBWJ2+fF,iv:EUc8vhrB5NcgFKO7xTCxG2PzUuFCJFIl1KB90NqCOXw=,tag:rCilwxD8sw+Ql5HzvcUEJQ==,type:str]
+factorio_game_password: ENC[AES256_GCM,data:OWETag==,iv:jkru1eLic7rl5RJVOMfF4cyT3FBGYCj3EKkpvMF22dk=,tag:sypcyM8ixpNdG70xiOzVIg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZzJXVmZuRVlqQzVJcnds
+            V0paNCtXdkJKbzBrMEZGOVlYTTY2V2g2RDB3CkpWclcxNFZtb3I4VnZva3hJRy9I
+            dXRZUHIyVVpMVlRYc29CQktRTXJJYlEKLS0tIGgwWHBVLzl4dlErbllFZmFmUGxv
+            TzdjVjVtWmxNNm96WHhXSGM4WjErMkEKoGtyn6M91h+ye8U/ltOuOQ74RUo/2R37
+            l5vR47FUyzilUliIK2PDUMXM/S3Yk3Zi6g3XL8OPd53X5I1UYUJmRw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-04-27T18:23:44Z"
+    mac: ENC[AES256_GCM,data:U1Q5GQKV804mzs91/cgbHbdj96wZSdBQNj6U0Iw3Ybg4kgGbIdIP13gXzX/etoFTJzcy7JB4812KAjwoAFDcMjMtTADHIg8fo4zrSUm/FVVoX+SpVqtAqKprFOGgnX7DzAlUqlseZOZF05gmf7tz6vc2QUY4V8BvfTqfdFVrSHE=,iv:8nxqbUmstmf9nESDzcHtljH879lIyxE+JvnbVo/h3Tg=,tag:3cXhHBaQPc0dC6742ow3wA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

systems/x86_64-linux/yggdrasil/default.nix

@@ -9,7 +9,7 @@ with lib.wyrdgard;
 {
   imports = [ ./hardware.nix ];
 
-  environment.systemPackages = with pkgs; [ ];
+  environment.systemPackages = with pkgs; [ jetbrains.rust-rover ];
 
   environment.pathsToLink = [ "/libexec" ];
 
@@ -23,7 +23,7 @@ with lib.wyrdgard;
       discord = enabled;
       _1password = enabled;
       onedrive = enabled;
-      factorio-server = disabled;
+      factorio-server = enabled;
     };
 
     system = {
@@ -36,6 +36,8 @@ with lib.wyrdgard;
         gpu.nvidia = enabled;
       };
     };
+
+    security.syncthing = enabled;
   };
 
   system.stateVersion = "23.11";