Daholli/nixos-config
1
0
Fork 0
Code Issues 5 Pull requests Actions Packages Releases Activity

introduce sops to the config to be able to use encrypted tokens and passwords, also use these in factorio

Browse source
This commit is contained in:
Christoph Hollizeck 2024-04-27 20:39:13 +02:00
parent e19de9f507
commit 524b5b7d38
No known key found for this signature in database
9 changed files with 226 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
.sops.yaml Normal file
View file

@ -0,0 +1,7 @@
keys:
- &primary age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
creation_rules:
- path_regex: secrets/secrets.yaml$
key_groups:
- age:
- *primary

76
flake.lock
View file

@ -382,11 +382,11 @@
]
},
"locked": {
"lastModified": 1713166971,
"narHash": "sha256-t0P/rKlsE5l1O3O2LYtAelLzp7PeoPCSzsIietQ1hSM=",
"lastModified": 1713906585,
"narHash": "sha256-fv84DCOkBtjF6wMATt0rfovu7e95L8rdEkSfNbwKR3U=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "1c43dcfac48a2d622797f7ab741670fdbcf8f609",
"rev": "bfa7c06436771e3a0c666ccc6ee01e815d4c33aa",
"type": "github"
},
"original": {
@ -462,11 +462,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1712909959,
"narHash": "sha256-7/5ubuwdEbQ7Z+Vqd4u0mM5L2VMNDsBh54visp27CtQ=",
"lastModified": 1713864415,
"narHash": "sha256-/BPDMJEkrsFAFOsQWhwm31wezlgshPFlLBn34KEUdVA=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "f58b25254be441cd2a9b4b444ed83f1e51244f1f",
"rev": "797f8d8082c7cc3259cba7275c699d4991b09ecc",
"type": "github"
},
"original": {
@ -477,11 +477,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1713297878,
"narHash": "sha256-hOkzkhLT59wR8VaMbh1ESjtZLbGi+XNaBN6h49SPqEc=",
"lastModified": 1714076141,
"narHash": "sha256-Drmja/f5MRHZCskS6mvzFqxEaZMeciScCTFxWVLqWEY=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "66adc1e47f8784803f2deb6cacd5e07264ec2d5c",
"rev": "7bb2ccd8cdc44c91edba16c48d2c8f331fb3d856",
"type": "github"
},
"original": {
@ -507,6 +507,38 @@
"type": "github"
}
},
"nixpkgs-stable_2": {
"locked": {
"lastModified": 1713638189,
"narHash": "sha256-q7APLfB6FmmSMI1Su5ihW9IwntBsk2hWNXh8XtSdSIk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "74574c38577914733b4f7a775dd77d24245081dd",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "release-23.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1713596654,
"narHash": "sha256-LJbHQQ5aX1LVth2ST+Kkse/DRzgxlVhTL1rxthvyhZc=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "fd16bb6d3bcca96039b11aa52038fafeb6e4f4be",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixvim": {
"inputs": {
"nixpkgs": [
@ -623,6 +655,7 @@
"nixvim": "nixvim",
"snowfall-flake": "snowfall-flake",
"snowfall-lib": "snowfall-lib_3",
"sops-nix": "sops-nix",
"unstable": "unstable_2"
}
},
@ -716,6 +749,25 @@
"type": "github"
}
},
"sops-nix": {
"inputs": {
"nixpkgs": "nixpkgs_2",
"nixpkgs-stable": "nixpkgs-stable_2"
},
"locked": {
"lastModified": 1713892811,
"narHash": "sha256-uIGmA2xq41vVFETCF1WW4fFWFT2tqBln+aXnWrvjGRE=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "f1b0adc27265274e3b0c9b872a8f476a098679bd",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
@ -809,11 +861,11 @@
},
"unstable_2": {
"locked": {
"lastModified": 1712963716,
"narHash": "sha256-WKm9CvgCldeIVvRz87iOMi8CFVB1apJlkUT4GGvA0iM=",
"lastModified": 1713714899,
"narHash": "sha256-+z/XjO3QJs5rLE5UOf015gdVauVRQd2vZtsFkaXBq2Y=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "cfd6b5fc90b15709b780a5a1619695a88505a176",
"rev": "6143fc5eeb9c4f00163267708e26191d1e918932",
"type": "github"
},
"original": {

3
flake.nix
View file

@ -41,6 +41,8 @@
url = "github:drduh/config";
flake = false;
};
sops-nix.url = "github:Mic92/sops-nix";
};
outputs =
@ -75,6 +77,7 @@
systems.modules.nixos = with inputs; [
home-manager.nixosModules.home-manager
nix-ld.nixosModules.nix-ld
sops-nix.nixosModules.sops
];
};
}

33
modules/nixos/apps/factorio-server/default.nix
View file

@ -17,25 +17,40 @@ in
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ factorio-headless ];
sops = {
secrets = {
factorio_token = { restartUnits = ["factorio.service"]; };
factorio_username = { restartUnits = ["factorio.service"]; };
factorio_game_password = { restartUnits = ["factorio.service"]; };
};
templates."extraSettingsFile.json".content = ''
{
"name": "Alles Nix!",
"description": "Trying to run a factorio-headless-server on my nix system",
"tags": ["vanilla"],
"max_players": 10,
"game_password": "${config.sops.placeholder.factorio_game_password}",
"allow_commands": "admins-only",
"autosave_slots": 5,
"ignore_player_limit_for_returning_players": true,
"username" : "${config.sops.placeholder.factorio_username}",
"admins": ["${config.sops.placeholder.factorio_username}"],
"token": "${config.sops.placeholder.factorio_token}"
}
'';
templates."extraSettingsFile.json".mode = "0444";
};
services.factorio = {
enable = true;
openFirewall = true;
public = true;
lan = true;
admins = [
"DaHolli"
"Galbrain"
];
nonBlockingSaving = true;
autosave-interval = 5;
loadLatestSave = true;
username = "DaHolli";
token = "4d4624ca9a23396e1955c1b4b364ff";
game-name = "Alles Nix!";
game-password = "1234";
saveName = "Vanilla";
bind = "192.168.178.34";
extraSettingsFile = config.sops.templates."extraSettingsFile.json".path;
};
};
}

32
modules/nixos/security/sops/default.nix Normal file
View file

@ -0,0 +1,32 @@
{
options,
config,
pkgs,
lib,
inputs,
...
}:
with lib;
with lib.wyrdgard;
let
cfg = config.wyrdgard.security.sops;
in
{
options.wyrdgard.security.sops = with types; {
enable = mkBoolOpt true "Enable sops (Default true)";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
sops
age
];
sops = {
defaultSopsFile = ../../../../secrets/secrets.yaml;
defaultSopsFormat = "yaml";
age.keyFile = "/home/cholli/.config/sops/age/keys.txt";
};
};
}

58
modules/nixos/security/syncthing/default.nix Normal file
View file

@ -0,0 +1,58 @@
{
options,
config,
pkgs,
lib,
inputs,
...
}:
with lib;
with lib.wyrdgard;
let
cfg = config.wyrdgard.security.syncthing;
user = config.wyrdgard.user;
in
{
options.wyrdgard.security.syncthing = with types; {
enable = mkEnableOption "Enable Syncthing";
};
config = mkIf cfg.enable {
services.syncthing = {
enable = true;
user = user.name;
dataDir = "/home/" + user.name + "/Documents";
configDir = "/home/" + user.name + "/Documents/.config/syncthing";
settings = {
folders = {
"Documents" = {
# Name of folder in Syncthing, also the folder ID
path = "/home/" + user.name + "/Documents"; # Which folder to add to Syncthing
};
"Pictures" = {
path = "/home/" + user.name + "/Pictures";
};
"7vfj7-k83xj" = {
path = "/home/" + user.name + "/WhatsApp Documents";
};
};
gui = {
theme = "black";
};
};
};
# Syncthing ports: 8384 for remote access to GUI
# 22000 TCP and/or UDP for sync traffic
# 21027/UDP for discovery
# source: https://docs.syncthing.net/users/firewall.html
networking.firewall.allowedTCPPorts = [
8384
22000
];
networking.firewall.allowedUDPPorts = [
22000
21027
];
};
}

17
modules/nixos/system/hardware/audio/default.nix
View file

@ -32,13 +32,16 @@ in
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
extraConfig = {
"11-bluetooth-policy" = {
"bluetooth_policy.policy" = {
"media-role.use-headset-profile" = false;
};
};
};
wireplumber.configPackages = [
(pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/11-bluetooth-policy.conf" ''
wireplumber.settings = {
bluetooth.autoswitch-to-headset-profile = false
}
'')
(pkgs.writeTextDir "share/wireplumber/policy.lua.d/11-bluetooth-policy.conf" ''
bluetooth_policy.policy["media-role.use-headset-profile"] = false
'')
];
};
};
}

24
secrets/secrets.yaml Normal file
View file

@ -0,0 +1,24 @@
#ENC[AES256_GCM,data:Y75QxOB7YrOA,iv:mZ2f288IG/pmlQRtCqdcz03dDTYMnnj50Vsk/BwTJ+c=,tag:gPHZgq091G4LYMan9R6z1w==,type:comment]
factorio_username: ENC[AES256_GCM,data:rI7vF0XlaQ==,iv:+d5dD+nawphw+g8zavFXUr87bewTL1d+fuFnYKuYJKc=,tag:B8/6I7zi0b6xo8TFsY35Ug==,type:str]
factorio_token: ENC[AES256_GCM,data:0JOQv4UGiz2j2KPEoNm2IuE3qt8XfKuVEBWJ2+fF,iv:EUc8vhrB5NcgFKO7xTCxG2PzUuFCJFIl1KB90NqCOXw=,tag:rCilwxD8sw+Ql5HzvcUEJQ==,type:str]
factorio_game_password: ENC[AES256_GCM,data:OWETag==,iv:jkru1eLic7rl5RJVOMfF4cyT3FBGYCj3EKkpvMF22dk=,tag:sypcyM8ixpNdG70xiOzVIg==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1amdd4hu6k0czf3mtlhd03yj3yzkdaynl7q5fdlqmjzpe9pwgxfjs3j0c85
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZzJXVmZuRVlqQzVJcnds
V0paNCtXdkJKbzBrMEZGOVlYTTY2V2g2RDB3CkpWclcxNFZtb3I4VnZva3hJRy9I
dXRZUHIyVVpMVlRYc29CQktRTXJJYlEKLS0tIGgwWHBVLzl4dlErbllFZmFmUGxv
TzdjVjVtWmxNNm96WHhXSGM4WjErMkEKoGtyn6M91h+ye8U/ltOuOQ74RUo/2R37
l5vR47FUyzilUliIK2PDUMXM/S3Yk3Zi6g3XL8OPd53X5I1UYUJmRw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-04-27T18:23:44Z"
mac: ENC[AES256_GCM,data:U1Q5GQKV804mzs91/cgbHbdj96wZSdBQNj6U0Iw3Ybg4kgGbIdIP13gXzX/etoFTJzcy7JB4812KAjwoAFDcMjMtTADHIg8fo4zrSUm/FVVoX+SpVqtAqKprFOGgnX7DzAlUqlseZOZF05gmf7tz6vc2QUY4V8BvfTqfdFVrSHE=,iv:8nxqbUmstmf9nESDzcHtljH879lIyxE+JvnbVo/h3Tg=,tag:3cXhHBaQPc0dC6742ow3wA==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

6
systems/x86_64-linux/yggdrasil/default.nix
View file

@ -9,7 +9,7 @@ with lib.wyrdgard;
{
imports = [ ./hardware.nix ];
environment.systemPackages = with pkgs; [ ];
environment.systemPackages = with pkgs; [ jetbrains.rust-rover ];
environment.pathsToLink = [ "/libexec" ];
@ -23,7 +23,7 @@ with lib.wyrdgard;
discord = enabled;
_1password = enabled;
onedrive = enabled;
factorio-server = disabled;
factorio-server = enabled;
};
system = {
@ -36,6 +36,8 @@ with lib.wyrdgard;
gpu.nvidia = enabled;
};
};
security.syncthing = enabled;
};
system.stateVersion = "23.11";