Blunkall-Technologies/Olympus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

set age key dir to be in persist dir

Browse Source
This commit is contained in:
Nathan
2024-11-18 15:24:15 -06:00
parent 359bc6769d
commit af730c5b20
7 changed files with 102 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
flake.lock generated
View File

@@ -1193,11 +1193,11 @@
"locked": { "locked": {
"lastModified": 1, "lastModified": 1,
"narHash": "sha256-mrfMvef+tOYMK35horTWF43tQpES1zI7hb5RbzN3oIk=", "narHash": "sha256-mrfMvef+tOYMK35horTWF43tQpES1zI7hb5RbzN3oIk=",
"path": "/nix/store/2iad54f45q80l7js354b3gjs8a9ywd2g-source/home-manager", "path": "/nix/store/hpa0gcdys4xk1wif3ksp9yjkyd68lypx-source/home-manager",
"type": "path" "type": "path"
}, },
"original": { "original": {
"path": "/nix/store/2iad54f45q80l7js354b3gjs8a9ywd2g-source/home-manager", "path": "/nix/store/hpa0gcdys4xk1wif3ksp9yjkyd68lypx-source/home-manager",
"type": "path" "type": "path"
} }
}, },
@@ -1807,11 +1807,11 @@
"locked": { "locked": {
"lastModified": 1, "lastModified": 1,
"narHash": "sha256-QahOuoQdXshu38W5uO7hLhG/yFkT7S2l8Dxicq0wdGk=", "narHash": "sha256-QahOuoQdXshu38W5uO7hLhG/yFkT7S2l8Dxicq0wdGk=",
"path": "/nix/store/ipps7wbs0429asc5w15xlbhyy74k1xmy-source/programs", "path": "/nix/store/1jlhs5z0fkw1z8jf5bb4s5bhdqhsw930-source/programs",
"type": "path" "type": "path"
}, },
"original": { "original": {
"path": "/nix/store/ipps7wbs0429asc5w15xlbhyy74k1xmy-source/programs", "path": "/nix/store/1jlhs5z0fkw1z8jf5bb4s5bhdqhsw930-source/programs",
"type": "path" "type": "path"
} }
}, },
@@ -1882,11 +1882,11 @@
"locked": { "locked": {
"lastModified": 1, "lastModified": 1,
"narHash": "sha256-0Ztx5DVQ2I7hvCK/qjGa4XTdRgbzM8rhf19m0al8lVM=", "narHash": "sha256-0Ztx5DVQ2I7hvCK/qjGa4XTdRgbzM8rhf19m0al8lVM=",
"path": "/nix/store/ipps7wbs0429asc5w15xlbhyy74k1xmy-source/services/sddm", "path": "/nix/store/1jlhs5z0fkw1z8jf5bb4s5bhdqhsw930-source/services/sddm",
"type": "path" "type": "path"
}, },
"original": { "original": {
"path": "/nix/store/ipps7wbs0429asc5w15xlbhyy74k1xmy-source/services/sddm", "path": "/nix/store/1jlhs5z0fkw1z8jf5bb4s5bhdqhsw930-source/services/sddm",
"type": "path" "type": "path"
} }
}, },
@@ -1976,12 +1976,12 @@
}, },
"locked": { "locked": {
"lastModified": 1, "lastModified": 1,
"narHash": "sha256-cN8S1dX9UvYcLvw2DRKSY2NMhjwrPFA181sKCEJIrbQ=", "narHash": "sha256-4OsKmVNgQ6yPD++McosqTdHNXPMfSk/ooTzxwWxDXug=",
"path": "/nix/store/2iad54f45q80l7js354b3gjs8a9ywd2g-source/system-config", "path": "/nix/store/hpa0gcdys4xk1wif3ksp9yjkyd68lypx-source/system-config",
"type": "path" "type": "path"
}, },
"original": { "original": {
"path": "/nix/store/2iad54f45q80l7js354b3gjs8a9ywd2g-source/system-config", "path": "/nix/store/hpa0gcdys4xk1wif3ksp9yjkyd68lypx-source/system-config",
"type": "path" "type": "path"
} }
}, },

7
system-config/configuration/homebox/default.nix
View File

@@ -167,7 +167,6 @@
"/var/lib/bluetooth" "/var/lib/bluetooth"
"/var/lib/nixos" "/var/lib/nixos"
"/var/lib/nixos-containers" "/var/lib/nixos-containers"
"/var/run/nixos-containers"
"/var/lib/systemd/coredump" "/var/lib/systemd/coredump"
"/var/lib/docker" "/var/lib/docker"
"/etc/NetworkManager/system-connections" "/etc/NetworkManager/system-connections"
@@ -182,7 +181,7 @@
}; };
sops = { sops = {
age.keyFile = "/home/nathan/.config/sops/age/keys.txt"; age.keyFile = "/persist/home/nathan/.config/sops/age/keys.txt";
defaultSopsFile = ./secrets/secrets.yaml; defaultSopsFile = ./secrets/secrets.yaml;
defaultSopsFormat = "yaml"; defaultSopsFormat = "yaml";
@@ -197,7 +196,7 @@
"pihole/pass" = {}; "pihole/pass" = {};
"nextcloud/pass" = { "nextcloud/pass" = {
owner = "nextcloud"; owner = "sshd";
}; };
}; };
}; };
@@ -258,7 +257,7 @@
pihole.enable = true; pihole.enable = true;
nextcloud.enable = true; nextcloud.enable = false;
gitlab.enable = true; gitlab.enable = true;
}; };

2
system-config/services/containers/authentik/default.nix
View File

@@ -21,7 +21,7 @@
systemd.services.launchAuthentik = { systemd.services.launchAuthentik = {
enable = true; enable = false;
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];

116
system-config/services/containers/gitlab/default.nix
View File

@@ -7,34 +7,20 @@
config = lib.mkIf config.sysconfig.opts.virtualization.gitlab.enable { config = lib.mkIf config.sysconfig.opts.virtualization.gitlab.enable {
sops.secrets."gitlab/db_pass" = { sops.secrets = {
owner = "sshd"; "gitlab/db_pass" = {};
}; "gitlab/root_pass" = {};
sops.secrets."gitlab/root_pass" = { "gitlab/secrets/secret" = {};
owner = "sshd"; "gitlab/secrets/otp" = {};
}; "gitlab/secrets/db" = {};
sops.secrets."gitlab/secrets/secret" = { "gitlab/secrets/jws" = {};
owner = "sshd"; "gitlab/oidc/id" = {};
}; "gitlab/oidc/secret" = {};
sops.secrets."gitlab/secrets/otp" = {
owner = "sshd";
};
sops.secrets."gitlab/secrets/db" = {
owner = "sshd";
};
sops.secrets."gitlab/secrets/jws" = {
owner = "sshd";
};
sops.secrets."gitlab/oidc/id" = {
owner = "sshd";
};
sops.secrets."gitlab/oidc/secret" = {
owner = "sshd";
}; };
containers.gitlab = { containers.gitlab = {
autoStart = false; autoStart = true;
privateNetwork = true; privateNetwork = true;
hostAddress = "192.168.100.10"; hostAddress = "192.168.100.10";
localAddress = "192.168.100.16"; localAddress = "192.168.100.16";
@@ -43,51 +29,49 @@
hostPath = "/ssd1/Gitlab/data"; hostPath = "/ssd1/Gitlab/data";
isReadOnly = false; isReadOnly = false;
}; };
"/etc/gitlab/dbpass" = {
hostPath = config.sops.secrets."gitlab/db_pass".path;
isReadOnly = false;
};
"/etc/gitlab/rootpass" = {
hostPath = config.sops.secrets."gitlab/root_pass".path;
isReadOnly = false;
};
"/etc/gitlab/db" = {
hostPath = config.sops.secrets."gitlab/secrets/db".path;
isReadOnly = false;
};
"/etc/gitlab/secret" = {
hostPath = config.sops.secrets."gitlab/secrets/secret".path;
isReadOnly = false;
};
"/etc/gitlab/jws" = {
hostPath = config.sops.secrets."gitlab/secrets/jws".path;
isReadOnly = false;
};
"/etc/gitlab/otp" = {
hostPath = config.sops.secrets."gitlab/secrets/otp".path;
isReadOnly = false;
};
"/etc/gitlab/oidc-id" = {
hostPath = config.sops.secrets."gitlab/oidc/id".path;
isReadOnly = false;
};
"/etc/gitlab/oidc-secret" = {
hostPath = config.sops.secrets."gitlab/oidc/secret".path;
isReadOnly = false;
};
}; };
extraFlags = [
"--load-credential=dbpass:${config.sops.secrets."gitlab/db_pass".path}"
"--load-credential=rootpass:${config.sops.secrets."gitlab/root_pass".path}"
"--load-credential=secret:${config.sops.secrets."gitlab/secrets/secret".path}"
"--load-credential=otp:${config.sops.secrets."gitlab/secrets/otp".path}"
"--load-credential=db:${config.sops.secrets."gitlab/secrets/db".path}"
"--load-credential=jws:${config.sops.secrets."gitlab/secrets/jws".path}"
"--load-credential=oidc_id:${config.sops.secrets."gitlab/oidc/id".path}"
"--load-credential=oidc_secret:${config.sops.secrets."gitlab/oidc/secret".path}"
];
config = { config = {
systemd.tmpfiles.rules = [ systemd.services.secrets_setup = {
"z /etc/gitlab/dbpass - gitlab gitlab" wantedBy = [ "gitlab.service" ];
"z /etc/gitlab/rootpass - gitlab gitlab"
"z /etc/gitlab/db - gitlab gitlab" serviceConfig = {
"z /etc/gitlab/secret - gitlab gitlab" LoadCredential = [
"z /etc/gitlab/jws - gitlab gitlab" "dbpass"
"z /etc/gitlab/otp - gitlab gitlab" "rootpass"
"z /etc/gitlab/oidc-id - gitlab gitlab" "secret"
"z /etc/gitlab/oidc-secret - gitlab gitlab" "db"
"otp"
"jws"
"oidc_id"
"oidc_secret"
]; ];
};
script = ''
cat ''${CREDENTIALS_DIRECTORY}/dbpass > /etc/gitlab/dbpass
cat ''${CREDENTIALS_DIRECTORY}/rootpass > /etc/gitlab/rootpass
cat ''${CREDENTIALS_DIRECTORY}/secret > /etc/gitlab/secret
cat ''${CREDENTIALS_DIRECTORY}/db > /etc/gitlab/db
cat ''${CREDENTIALS_DIRECTORY}/otp > /etc/gitlab/otp
cat ''${CREDENTIALS_DIRECTORY}/jws > /etc/gitlab/jws
cat ''${CREDENTIALS_DIRECTORY}/oidc_id > /etc/gitlab/oidc-id
cat ''${CREDENTIALS_DIRECTORY}/oidc_secret > /etc/gitlab/oidc-secret
chown gitlab:gitlab /etc/gitlab/*
'';
};
services.gitlab = { services.gitlab = {
enable = true; enable = true;
@@ -162,7 +146,7 @@
systemd.services.gitlab-backup.environment.BACKUP = "dump"; systemd.services.gitlab-backup.environment.BACKUP = "dump";
networking.firewall.allowedTCPPorts = [ 22 80 443 ]; networking.firewall.allowedTCPPorts = [ 22 80 ];
system.stateVersion = "24.05"; system.stateVersion = "24.05";
}; };

49
system-config/services/containers/nextcloud/default.nix
View File

@@ -40,7 +40,7 @@
containers.nextcloud = { containers.nextcloud = {
autoStart = false; autoStart = true;
privateNetwork = true; privateNetwork = true;
hostAddress = "192.168.100.10"; hostAddress = "192.168.100.10";
localAddress = "192.168.100.15"; localAddress = "192.168.100.15";
@@ -48,47 +48,70 @@
bindMounts = { bindMounts = {
"/etc/nextcloud" = { "/etc/nextcloud" = {
hostPath = "/ssd1/Nextcloud"; hostPath = "/ssd1/Nextcloud/data";
isReadOnly = false; isReadOnly = false;
}; };
"/etc/nextcloud-admin-pass" = {
hostPath = config.sops.secrets."nextcloud/pass".path;
isReadOnly = false;
};
}; };
extraFlags = [
"--load-credential=nextcloud-admin-pass:${config.sops.secrets."nextcloud/pass".path}"
];
config = { config, lib, pkgs, ... }: { config = { config, lib, pkgs, ... }: {
/*systemd.tmpfiles.rules = [
"Z /etc/nextcloud - nextcloud nextcloud"
];*/
systemd.services.secrets_setup = {
wantedBy = [ "nextcloud-setup.service" ];
serviceConfig = {
LoadCredential = [
"nextcloud-admin-pass"
];
};
script = ''
cat $CREDENTIALS_DIRECTORY/nextcloud-admin-pass > /etc/nextcloud-admin-pass
chown nextcloud:nextcloud /etc/nextcloud-admin-pass
'';
};
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
services.nginx.virtualHosts."192.168.100.15".listen = [ { addr = "0.0.0.0"; port = 80; } ]; services.nginx = {
virtualHosts."192.168.100.15".listen = [ { addr = "0.0.0.0"; port = 80; } ];
user = "nextcloud";
group = "nextcloud";
};
services.nextcloud = { services.nextcloud = {
enable = true; enable = true;
package = pkgs.nextcloud30; package = pkgs.nextcloud30;
hostName = "localhost"; hostName = "192.168.100.15";
config = { config = {
adminpassFile = "/etc/nextcloud-admin-pass"; adminpassFile = "/etc/nextcloud-admin-pass";
adminuser = "root"; adminuser = "root";
dbtype = "mysql"; dbtype = "mysql";
}; };
https = true; https = true;
datadir = "/ssd1/Nextcloud/data"; #datadir = "/etc/nextcloud/data";
home = "/ssd1/Nextcloud/nextcloud_home"; #home = "/etc/nextcloud/nextcloud_home";
appstoreEnable = true; #appstoreEnable = true;
extraApps = with config.services.nextcloud.package.packages.apps; { extraApps = with config.services.nextcloud.package.packages.apps; {
inherit mail contacts calendar tasks user_oidc; inherit mail contacts calendar tasks user_oidc;
}; };
extraAppsEnable = true; extraAppsEnable = true;
settings = { settings = {
overwriteprotocol = "https"; overwriteprotocol = "https";
trusted_domains = [ "nextcloud.blunkall.us" "dummy.blunkall.us" ]; trusted_domains = [ "nextcloud.blunkall.us" ];
trusted_proxies = [ "192.168.100.11" ]; trusted_proxies = [ "192.168.100.11" ];
default_phone_region = "US"; default_phone_region = "US";
}; };
database.createLocally = true; database.createLocally = true;
}; };
system.stateVersion = "23.05"; system.stateVersion = "24.05";
}; };
}; };
}; };

2
system-config/services/containers/pihole/default.nix
View File

@@ -16,7 +16,7 @@
}; };
systemd.services.launchPihole = { systemd.services.launchPihole = {
enable = true; enable = false;
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];

2
system-config/services/containers/traefik/default.nix
View File

@@ -223,7 +223,7 @@
pihole.loadBalancer.servers = [ { url = "http://192.168.100.10:8080"; } ]; pihole.loadBalancer.servers = [ { url = "http://192.168.100.10:8080"; } ];
nextcloud.loadBalancer.servers = [ { url = "http://192.168.100.10:8081"; } ]; nextcloud.loadBalancer.servers = [ { url = "http://192.168.100.15:80"; } ];
}; };
}; };
}; };