mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

chore: update to new agenix-rekey format

Browse source
This commit is contained in:
oddlama 2023-06-07 19:48:15 +02:00
parent 972b0456da
commit dec790c589
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
21 changed files with 195 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hosts/common/core/net.nix
View file

@ -15,7 +15,16 @@
;
in {
# TODO needed until https://github.com/NixOS/nixpkgs/issues/236146 is resolved
boot.initrd.network.flushBeforeStage2 = true;
boot.initrd.systemd = {
services.systemd-networkd = {
before = ["initrd-switch-root.target"];
conflicts = ["initrd-switch-root.target"];
};
sockets.systemd-networkd = {
before = ["initrd-switch-root.target"];
conflicts = ["initrd-switch-root.target"];
};
};
networking = {
hostName = nodeName;

2
hosts/common/core/system.nix
View file

@ -343,7 +343,7 @@
// lib.optionalAttrs (nodePath != null && lib.pathExists local) {inherit local;};
# Setup secret rekeying parameters
rekey = {
age.rekey = {
inherit
(inputs.self.secretsConfig)
masterIdentities

9
hosts/common/initrd-ssh.nix
View file

@ -4,13 +4,14 @@
nodePath,
...
}: {
rekey.secrets.initrd_host_ed25519_key.file = nodePath + "/secrets/initrd_host_ed25519_key.age";
# TODO generate script
age.secrets.initrd_host_ed25519_key.file = nodePath + "/secrets/initrd_host_ed25519_key.age";
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
port = 4;
hostKeys = [config.rekey.secrets.initrd_host_ed25519_key.path];
hostKeys = [config.age.secrets.initrd_host_ed25519_key.path];
};
# Make sure that there is always a valid initrd hostkey available that can be installed into
@ -21,8 +22,8 @@
# for the first time, and the secrets were rekeyed for the the new host identity.
system.activationScripts.agenixEnsureInitrdHostkey = {
text = ''
[[ -e ${config.rekey.secrets.initrd_host_ed25519_key.path} ]] \
|| ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f ${config.rekey.secrets.initrd_host_ed25519_key.path}
[[ -e ${config.age.secrets.initrd_host_ed25519_key.path} ]] \
|| ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f ${config.age.secrets.initrd_host_ed25519_key.path}
'';
deps = ["agenixInstall"];
};

6
hosts/sentinel/acme.nix
View file

@ -1,8 +1,8 @@
{config, ...}: let
inherit (config.repo.secrets.local) acme;
in {
rekey.secrets.acme-credentials = {
file = ./secrets/acme-credentials.age;
age.secrets.acme-credentials = {
rekeyFile = ./secrets/acme-credentials.age;
mode = "440";
group = "acme";
};
@ -11,7 +11,7 @@ in {
acceptTerms = true;
defaults = {
inherit (acme) email;
credentialsFile = config.rekey.secrets.acme-credentials.path;
credentialsFile = config.age.secrets.acme-credentials.path;
dnsProvider = "cloudflare";
dnsPropagationCheck = true;
reloadServices = ["nginx"];

6
hosts/sentinel/caddy.nix
View file

@ -15,8 +15,8 @@ in {
# TODO message = "non-deterministic uid detected for: ${name}";
# TODO });
rekey.secrets.loki-basic-auth = {
file = ./secrets/loki-basic-auth.age;
age.secrets.loki-basic-auth = {
rekeyFile = ./secrets/loki-basic-auth.age;
mode = "440";
group = "caddy";
};
@ -125,7 +125,7 @@ in {
encode zstd gzip
skip_log
basicauth {
import ${config.rekey.secrets.loki-basic-auth.path}
import ${config.age.secrets.loki-basic-auth.path}
}
reverse_proxy {
to http://${nodes.ward-loki.config.extra.wireguard.proxy-sentinel.ipv4}:${lokiPort}

BIN
hosts/sentinel/secrets/loki-basic-auth.age
View file

Binary file not shown.

39
hosts/ward/default.nix
View file

@ -24,6 +24,7 @@ in {
./fs.nix
./net.nix
./promtail.nix
];
boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" "r8169"];
@ -68,7 +69,7 @@ in {
parentNodeName,
...
}: {
rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXXjI6uB26xOF0DPy/QyLladoGIKfAtofyqPgIkCH/g";
age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXXjI6uB26xOF0DPy/QyLladoGIKfAtofyqPgIkCH/g";
extra.wireguard.proxy-sentinel.client.via = "sentinel";
@ -91,14 +92,14 @@ in {
};
};
rekey.secrets.grafana-secret-key = {
file = ./secrets/grafana-secret-key.age;
age.secrets.grafana-secret-key = {
rekeyFile = ./secrets/grafana-secret-key.age;
mode = "440";
group = "grafana";
};
rekey.secrets.loki-basic-auth-password-grafana = {
file = ./secrets/loki-basic-auth-password-grafana.age;
age.secrets.loki-basic-auth-password = {
rekeyFile = ./secrets/loki-basic-auth-password.age;
mode = "440";
group = "grafana";
};
@ -116,14 +117,11 @@ in {
enable_gzip = true;
http_addr = config.extra.wireguard.proxy-sentinel.ipv4;
http_port = 3001;
# cert_key = /etc/grafana/grafana.key;
# cert_file = /etc/grafana/grafana.crt;
# protocol = "https"
};
security = {
disable_initial_admin_creation = true;
secret_key = "$__file{${config.rekey.secrets.grafana-secret-key.path}}";
secret_key = "$__file{${config.age.secrets.grafana-secret-key.path}}";
cookie_secure = true;
disable_gravatar = true;
hide_version = true;
@ -137,7 +135,7 @@ in {
allow_sign_up = true;
auto_login = true;
client_id = "grafana";
#client_secret = "$__file{${config.rekey.secrets.grafana-oauth-client-secret.path}}";
#client_secret = "$__file{${config.age.secrets.grafana-oauth-client-secret.path}}";
client_secret = "r6Yk5PPSXFfYDPpK6TRCzXK8y1rTrfcb8F7wvNC5rZpyHTMF"; # TODO temporary test not a real secret
scopes = "openid email profile";
login_attribute_path = "prefered_username";
@ -167,8 +165,8 @@ in {
url = "https://${lokiDomain}";
orgId = 1;
basicAuth = true;
basicAuthUser = "grafana";
secureJsonData.basicAuthPassword = "$__file{${config.rekey.secrets.loki-basic-auth-password-grafana.path}}";
basicAuthUser = "iB6UEjt4so4xWqei";
secureJsonData.basicAuthPassword = "$__file{${config.age.secrets.loki-basic-auth-password.path}}";
}
];
};
@ -180,13 +178,12 @@ in {
config,
...
}: {
rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2TxWynLb8V9SP45kFqsoCWhe/dG8N1xWNuJG5VQndq";
age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2TxWynLb8V9SP45kFqsoCWhe/dG8N1xWNuJG5VQndq";
extra.wireguard.proxy-sentinel.client.via = "sentinel";
networking.nftables.firewall = {
zones = lib.mkForce {
#local-vms.interfaces = ["local-vms"];
proxy-sentinel.interfaces = ["proxy-sentinel"];
sentinel = {
parent = "proxy-sentinel";
@ -204,13 +201,13 @@ in {
};
};
rekey.secrets."kanidm-self-signed.crt" = {
file = ./secrets/kanidm-self-signed.crt.age;
age.secrets."kanidm-self-signed.crt" = {
rekeyFile = ./secrets/kanidm-self-signed.crt.age;
mode = "440";
group = "kanidm";
};
rekey.secrets."kanidm-self-signed.key" = {
file = ./secrets/kanidm-self-signed.key.age;
age.secrets."kanidm-self-signed.key" = {
rekeyFile = ./secrets/kanidm-self-signed.key.age;
mode = "440";
group = "kanidm";
};
@ -221,8 +218,8 @@ in {
serverSettings = {
domain = authDomain;
origin = "https://${config.services.kanidm.serverSettings.domain}";
tls_chain = config.rekey.secrets."kanidm-self-signed.crt".path;
tls_key = config.rekey.secrets."kanidm-self-signed.key".path;
tls_chain = config.age.secrets."kanidm-self-signed.crt".path;
tls_key = config.age.secrets."kanidm-self-signed.key".path;
bindaddress = "${config.extra.wireguard.proxy-sentinel.ipv4}:8300";
trust_x_forward_for = true;
};
@ -247,7 +244,7 @@ in {
utils,
...
}: {
rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICDDvvF3+KwfoZrPAUAt2HS7y5FM9S5Mr1iRkBUqoXno";
age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICDDvvF3+KwfoZrPAUAt2HS7y5FM9S5Mr1iRkBUqoXno";
extra.wireguard.proxy-sentinel.client.via = "sentinel";

66
hosts/ward/promtail.nix
View file

@ -1,20 +1,45 @@
{
lib,
config,
lib,
nodeName,
nodes,
parentNodeName,
...
}: {
}: let
inherit (nodes.sentinel.config.repo.secrets.local) personalDomain;
lokiDomain = "loki.${personalDomain}";
in {
age.secrets.loki-basic-auth-password = {
rekeyFile = ./secrets/loki-basic-auth-password.age;
file = ./aaa;
#file = ./aaa;
#generate = "alnum48";
mode = "440";
group = "promtail";
};
#age.secrets.loki-basic-auth-password = {
# generate = "alnum48";
# mode = "440";
# group = "promtail";
#};
services.promtail = {
enable = true;
configuration = {
server.http_listen_port = 9080;
server.grpc_listen_port = 0;
server = {
http_listen_port = 9080;
grpc_listen_port = 0;
log_level = "warn";
};
clients = [
{
basic_auth.username = "promtail@thalheim.io";
basic_auth.password_file = config.sops.secrets.promtail-password.path;
url = "http://loki.r/loki/api/v1/push";
#basic_auth.username = nodeName;
#basic_auth.password_file = config.age.random-secrets.loki-basic-auth-password.path;
basic_auth.username = "iB6UEjt4so4xWqei";
basic_auth.password_file = config.age.secrets.loki-basic-auth-password.path;
url = "https://${lokiDomain}/loki/api/v1/push";
}
];
@ -23,7 +48,7 @@
job_name = "journal";
journal = {
json = true;
max_age = "12h";
max_age = "24h";
labels.job = "systemd-journal";
};
pipeline_stages = [
@ -55,7 +80,6 @@
{
template = {
source = "msg";
# FIXME would be cleaner to have this in a match block, but could not get it to work
template = "{{if .coredump_exe}}{{.coredump_exe}} core dumped (user: {{.coredump_uid}}/{{.coredump_gid}}, command: {{.coredump_cmdline}}){{else}}{{.msg}}{{end}}";
};
}
@ -83,6 +107,30 @@
source_labels = ["__journal__hostname"];
target_label = "host";
}
{
source_labels = ["__journal_priority"];
target_label = "priority";
}
{
source_labels = ["__journal_priority_keyword"];
target_label = "level";
}
#{
# source_labels = ["__journal__systemd_unit"];
# target_label = "unit";
#}
{
source_labels = ["__journal__systemd_user_unit"];
target_label = "user_unit";
}
{
source_labels = ["__journal__boot_id"];
target_label = "boot_id";
}
{
source_labels = ["__journal__comm"];
target_label = "command";
}
];
}
];

0
hosts/ward/secrets/loki-basic-auth-password-grafana.age → hosts/ward/secrets/loki-basic-auth-password.age
View file

6
hosts/ward/vaultwarden.nix
View file

@ -33,7 +33,7 @@
#SMTP_SECURITY = "force_tls";
#SMTP_USERNAME={{ vaultwarden_smtp_username }};
#SMTP_PASSWORD={{ vaultwarden_smtp_password }};
#environmentFile = config.rekey.secrets.vaultwarden-env.path;
#environmentFile = config.age.secrets.vaultwarden-env.path;
};
# Replace uses of old name
@ -58,8 +58,8 @@
virtualHosts."${config.repo.secrets.local.vaultwarden.domain}" = {
forceSSL = true;
#enableACME = true;
sslCertificate = config.rekey.secrets."selfcert.crt".path;
sslCertificateKey = config.rekey.secrets."selfcert.key".path;
sslCertificate = config.age.secrets."selfcert.crt".path;
sslCertificateKey = config.age.secrets."selfcert.key".path;
locations."/" = {
proxyPass = "http://vaultwarden";
proxyWebsockets = true;

4
hosts/zackbiene/esphome.nix
View file

@ -26,8 +26,8 @@
virtualHosts."${config.repo.secrets.local.esphome.domain}" = {
forceSSL = true;
#enableACME = true;
sslCertificate = config.rekey.secrets."selfcert.crt".path;
sslCertificateKey = config.rekey.secrets."selfcert.key".path;
sslCertificate = config.age.secrets."selfcert.crt".path;
sslCertificateKey = config.age.secrets."selfcert.key".path;
locations."/" = {
proxyPass = "http://esphome";
proxyWebsockets = true;

10
hosts/zackbiene/home-assistant.nix
View file

@ -89,14 +89,14 @@ in {
extraPackages = python3Packages: with python3Packages; [psycopg2];
};
rekey.secrets."home-assistant-secrets.yaml" = {
file = ./secrets/home-assistant-secrets.yaml.age;
age.secrets."home-assistant-secrets.yaml" = {
rekeyFile = ./secrets/home-assistant-secrets.yaml.age;
owner = "hass";
};
systemd.services.home-assistant = {
preStart = lib.mkBefore ''
ln -sf ${config.rekey.secrets."home-assistant-secrets.yaml".path} ${config.services.home-assistant.configDir}/secrets.yaml
ln -sf ${config.age.secrets."home-assistant-secrets.yaml".path} ${config.services.home-assistant.configDir}/secrets.yaml
touch -a ${config.services.home-assistant.configDir}/{automations,scenes,scripts,manual}.yaml
'';
};
@ -118,8 +118,8 @@ in {
serverAliases = ["192.168.1.21"]; # TODO remove later
forceSSL = true;
#enableACME = true;
sslCertificate = config.rekey.secrets."selfcert.crt".path;
sslCertificateKey = config.rekey.secrets."selfcert.key".path;
sslCertificate = config.age.secrets."selfcert.crt".path;
sslCertificateKey = config.age.secrets."selfcert.key".path;
locations."/" = {
proxyPass = "http://homeassistant";
proxyWebsockets = true;

4
hosts/zackbiene/hostapd.nix
View file

@ -8,7 +8,7 @@
disabledModules = ["services/networking/hostapd.nix"];
# Associates each known client to a unique password
rekey.secrets.wifi-clients.file = ./secrets/wifi-clients.age;
age.secrets.wifi-clients.rekeyFile = ./secrets/wifi-clients.age;
services.hostapd = {
enable = true;
@ -22,7 +22,7 @@
macAcl = "allow";
apIsolate = true;
authentication = {
saePasswordsFile = config.rekey.secrets.wifi-clients.path;
saePasswordsFile = config.age.secrets.wifi-clients.path;
saeAddToMacAllow = true;
enableRecommendedPairwiseCiphers = true;
};

12
hosts/zackbiene/mosquitto.nix
View file

@ -3,14 +3,14 @@
config,
...
}: {
rekey.secrets.mosquitto-pw-zigbee2mqtt = {
file = ./secrets/mosquitto-pw-zigbee2mqtt.age;
age.secrets.mosquitto-pw-zigbee2mqtt = {
rekeyFile = ./secrets/mosquitto-pw-zigbee2mqtt.age;
mode = "440";
owner = "zigbee2mqtt";
group = "mosquitto";
};
rekey.secrets.mosquitto-pw-home_assistant = {
file = ./secrets/mosquitto-pw-home_assistant.age;
age.secrets.mosquitto-pw-home_assistant = {
rekeyFile = ./secrets/mosquitto-pw-home_assistant.age;
mode = "440";
owner = "hass";
group = "mosquitto";
@ -24,11 +24,11 @@
acl = ["pattern readwrite #"];
users = {
zigbee2mqtt = {
passwordFile = config.rekey.secrets.mosquitto-pw-zigbee2mqtt.path;
passwordFile = config.age.secrets.mosquitto-pw-zigbee2mqtt.path;
acl = ["readwrite #"];
};
home_assistant = {
passwordFile = config.rekey.secrets.mosquitto-pw-home_assistant.path;
passwordFile = config.age.secrets.mosquitto-pw-home_assistant.path;
acl = ["readwrite #"];
};
};

12
hosts/zackbiene/nginx.nix
View file

@ -3,18 +3,18 @@
config,
...
}: {
rekey.secrets."selfcert.crt" = {
file = ./secrets/selfcert.crt.age;
age.secrets."selfcert.crt" = {
rekeyFile = ./secrets/selfcert.crt.age;
mode = "440";
group = "nginx";
};
rekey.secrets."selfcert.key" = {
file = ./secrets/selfcert.key.age;
age.secrets."selfcert.key" = {
rekeyFile = ./secrets/selfcert.key.age;
mode = "440";
group = "nginx";
};
rekey.secrets."dhparams.pem" = {
file = ./secrets/dhparams.pem.age;
age.secrets."dhparams.pem" = {
rekeyFile = ./secrets/dhparams.pem.age;
mode = "440";
group = "nginx";
};

10
hosts/zackbiene/zigbee2mqtt.nix
View file

@ -3,8 +3,8 @@
config,
...
}: {
rekey.secrets."mosquitto-pw-zigbee2mqtt.yaml" = {
file = ./secrets/mosquitto-pw-zigbee2mqtt.yaml.age;
age.secrets."mosquitto-pw-zigbee2mqtt.yaml" = {
rekeyFile = ./secrets/mosquitto-pw-zigbee2mqtt.yaml.age;
mode = "440";
owner = "zigbee2mqtt";
group = "mosquitto";
@ -22,7 +22,7 @@
mqtt = {
server = "mqtt://localhost:1883";
user = "zigbee2mqtt";
password = "!${config.rekey.secrets."mosquitto-pw-zigbee2mqtt.yaml".path} password";
password = "!${config.age.secrets."mosquitto-pw-zigbee2mqtt.yaml".path} password";
};
# TODO once 1.30.3 is out
# frontend.host = "/run/zigbee2mqtt/zigbee2mqtt.sock";
@ -41,8 +41,8 @@
virtualHosts."${config.repo.secrets.local.zigbee2mqtt.domain}" = {
forceSSL = true;
#enableACME = true;
sslCertificate = config.rekey.secrets."selfcert.crt".path;
sslCertificateKey = config.rekey.secrets."selfcert.key".path;
sslCertificate = config.age.secrets."selfcert.crt".path;
sslCertificateKey = config.age.secrets."selfcert.key".path;
locations."/".proxyPass = "http://zigbee2mqtt";
# TODO dynamic definitions for the "local" network, IPv6
extraConfig = ''