From b03c913349a1a39cc16cce46d5fb88867825b611 Mon Sep 17 00:00:00 2001 From: oddlama Date: Tue, 14 Mar 2023 23:55:59 +0100 Subject: [PATCH] feat: implement repository-wide secrets --- flake.nix | 1 + hosts/zackbiene/default.nix | 1 + hosts/zackbiene/nginx.nix | 43 +++++++++++++++++++++++++ hosts/zackbiene/secrets/secrets.nix.age | 11 +++++++ modules/core/default.nix | 6 ---- modules/core/nix.nix | 4 ++- nix/colmena.nix | 12 ++++++- nix/extra-builtins.nix | 29 +++++++++++++++++ nix/secrets.nix | 31 ++++++++++++++++++ 9 files changed, 130 insertions(+), 8 deletions(-) create mode 100644 hosts/zackbiene/nginx.nix create mode 100644 hosts/zackbiene/secrets/secrets.nix.age create mode 100644 nix/extra-builtins.nix create mode 100644 nix/secrets.nix diff --git a/flake.nix b/flake.nix index 7d03ee6..ddf7de5 100644 --- a/flake.nix +++ b/flake.nix @@ -47,6 +47,7 @@ } @ inputs: { hosts = import ./nix/hosts.nix inputs; + secrets = import ./nix/secrets.nix inputs; colmena = import ./nix/colmena.nix inputs; overlays = import ./nix/overlay.nix inputs; homeConfigurations = import ./nix/home-manager.nix inputs; diff --git a/hosts/zackbiene/default.nix b/hosts/zackbiene/default.nix index f7bcad0..3b5555f 100644 --- a/hosts/zackbiene/default.nix +++ b/hosts/zackbiene/default.nix @@ -20,6 +20,7 @@ ./mosquitto.nix ./zigbee2mqtt.nix ./esphome.nix + ./nginx.nix ]; boot.loader.grub.enable = false; diff --git a/hosts/zackbiene/nginx.nix b/hosts/zackbiene/nginx.nix new file mode 100644 index 0000000..2e4307c --- /dev/null +++ b/hosts/zackbiene/nginx.nix @@ -0,0 +1,43 @@ +{ + lib, + config, + nodeSecrets, + ... +}: { + #security.acme.acceptTerms = true; + #security.acme.defaults.email = "admin+acme@example.com"; + services.nginx = { + enable = true; + + # Use recommended settings + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + + # Only allow PFS-enabled ciphers with AES256 + sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; + ## SSL config + #ssl_protocols TLSv1.2 TLSv1.3; + #ssl_dhparam /etc/nginx/dhparam.pem; + #ssl_ciphers EECDH+AESGCM:EDH+AESGCM; + #ssl_ecdh_curve secp384r1; + #ssl_session_timeout 10m; + #ssl_session_cache shared:SSL:10m; + #ssl_session_tickets off; + # + ## OCSP stapling + #ssl_stapling on; + #ssl_stapling_verify on; + + virtualHosts = { + "${nodeSecrets.zigbee2mqtt.domain}" = { + #forceSSL = true; + #enableACME = true; + locations."/" = { + root = "/var/www"; + }; + }; + }; + }; +} diff --git a/hosts/zackbiene/secrets/secrets.nix.age b/hosts/zackbiene/secrets/secrets.nix.age new file mode 100644 index 0000000..41194ba --- /dev/null +++ b/hosts/zackbiene/secrets/secrets.nix.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> X25519 i6aU9NyNgN17pez4P33oV7d/HNDirMTDIDvZQiWyD0U +3TgVPXyYypC+b7c17ZoV1ZbASpqzgskJ0OUVtBgxhFk +-> piv-p256 xqSe8Q A3kpyhwhqEsSqoVD7SB8VK5dU0ZiOrsOdloF+iviN/mq +W315d5mn13I4JWpsut801LKgGieKF8NIuJ6TeF4wCtI +-> Vzkv-grease u +ScmUF1PthzjmA8USzPlx5s5zcTDMGb2zcniHiOHz/ax4cTDKtnDgr8hI6r/6cKXs +5EkFcJHCI4nNFSCK8WHIIaGDpWWB6YrkkicVQU9K7QRa57xhVniotpH1rOnbEcFN +j5M +--- 4rSnr2uChIZoKOe3DDWFK/3JUUPAst1LDOulv1WN1Ek +þÊýÔ´‹âW…b^zËrFç= lenSuffix && builtins.substring (lenContent - lenSuffix) lenContent content == suffix; +in { + rageImportDecrypt = identities: nixFile: + assert assertMsg (builtins.isPath nixFile) "The file to decrypt must be given as a path to prevent impurity."; + assert assertMsg (hasSuffix ".nix.age" nixFile) "The content of the decrypted file must be a nix expression and should therefore end in .nix.age"; + exec (["rage" "-d"] ++ (builtins.concatMap (x: ["-i" x]) identities) ++ [nixFile]); +} diff --git a/nix/secrets.nix b/nix/secrets.nix new file mode 100644 index 0000000..cb9c63e --- /dev/null +++ b/nix/secrets.nix @@ -0,0 +1,31 @@ +# This file manages access to repository-secrets. Anything that is technically +# not a secret on your hosts, but something you want to keep secret from the public. +# Anything you don't want people to see on GitHub that isn't a password or encrypted +# using agenix. +# +# All of these secrets may (and probably will be) put into the world-readable nix-store +# on the build and target hosts. You'll most likely want to store personally identifiable +# information here, such as: +# - MAC Addreses +# - Static IP addresses +# - Your full name (when configuring e.g. users) +# - Your postal address (when configuring e.g. home-assistant) +# - ... +{ + self, + nixpkgs, + ... +} @ inputs: +with nixpkgs.lib; let + mergeArray = f: unique (concatLists (mapAttrsToList (_: f) self.nodes)); + mergedMasterIdentities = mergeArray (x: x.config.rekey.masterIdentities or []); + # "Imports" an encrypted .nix.age file + importEncrypted = path: + if builtins.pathExists path + then builtins.extraBuiltins.rageImportDecrypt mergedMasterIdentities path + else _: {}; +in + (importEncrypted ../secrets/secrets.nix.age inputs) + // { + nodes = mapAttrs (hostName: _: importEncrypted ../hosts/${hostName}/secrets/secrets.nix.age inputs) self.nodes; + }