Daholli/nixos-config
1
0
Fork 0
Code Issues 2 Pull requests Releases Packages Activity Actions

security: start setting permissions on secrets properly

Browse source
This commit is contained in:
Christoph Hollizeck 2025-12-01 23:53:27 +01:00
parent 01fb6d8ec9
commit ad9862019c
Signed by: Daholli
GPG key ID: 249300664F2AF2C7
11 changed files with 126 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

34
modules/server/factorio-server.nix
View file

@ -20,21 +20,25 @@
inherit sopsFile;
};
};
templates."extraSettingsFile.json".content = ''
{
"name": "Pyanodons Holli",
"description": "Trying to run a factorio-headless-server on my nix system",
"tags": ["vanilla"],
"max_players": 10,
"game_password": "${config.sops.placeholder."factorio/game_password"}",
"allow_commands": "admins-only",
"autosave_slots": 5,
"ignore_player_limit_for_returning_players": true,
"username" : "${config.sops.placeholder."factorio/username"}",
"token": "${config.sops.placeholder."factorio/token"}"
}
'';
templates."extraSettingsFile.json".mode = "0444";
templates."extraSettingsFile.json" = {
content = ''
{
"name": "Pyanodons Holli",
"description": "Trying to run a factorio-headless-server on my nix system",
"tags": ["vanilla"],
"max_players": 10,
"game_password": "${config.sops.placeholder."factorio/game_password"}",
"allow_commands": "admins-only",
"autosave_slots": 5,
"ignore_player_limit_for_returning_players": true,
"username" : "${config.sops.placeholder."factorio/username"}",
"token": "${config.sops.placeholder."factorio/token"}"
}
'';
mode = "0400";
owner = "factorio";
group = "factorio";
};
};
systemd.tmpfiles.rules = [

34
modules/server/hydra.nix
View file

@ -1,8 +1,18 @@
{
flake.modules.nixos.hydra =
{ ... }:
{ config, pkgs, ... }:
let
httpPort = 2000;
remotebuild-ssh-config = pkgs.writeTextFile {
name = "remotebuild-ssh-config";
text = ''
Host nixberry
IdentitiesOnly yes
IdentityFile ${config.sops.secrets."hydra/remotebuild/private-key".path}
User remotebuild
'';
};
in
{
services.nix-serve = {
@ -18,5 +28,27 @@
useSubstitutes = true;
};
systemd =
let
user = "hydra-queue-runner";
in
{
tmpfiles.rules = [
"d ${config.users.users.${user}.home}/.ssh 0700 ${user} ${user} -"
];
services.hydra-queue-runner = {
serviceConfig.ExecStartPre =
let
targetFile = "${config.users.users.${user}.home}/.ssh/config";
in
''
${pkgs.coreutils}/bin/ln -sf ${remotebuild-ssh-config} ${targetFile}
${pkgs.coreutils}/bin/chown ${user}:${user} ${targetFile}
'';
};
};
};
}