servers/losurdo/system.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.security) pass;
   5 in
   6 {
   7 # This value determines the NixOS release with which your system is to be
   8 # compatible, in order to avoid breaking some software such as database servers.
   9 # You should change this only after NixOS release notes say you should.
  10 system.stateVersion = "19.09"; # Did you read the comment?
  11
  12 # Avoid the use of systemd-run --user --scope tmux
  13 # and let mosh work smoothly.
  14 services.logind.killUserProcesses = false;
  15
  16 install = {
  17   enable = true;
  18   shellScript = lib.mkBefore ''
  19     (
  20     PATH="$PATH:${with pkgs; lib.makeBinPath [gnupg openssh]}"
  21     set -x
  22     gpg --decrypt '${pass.store}/root/key.pass.gpg' |
  23     ssh '${config.install.target}' install -D -m 400 -o root -g root /dev/stdin /root/key.pass
  24     )
  25   '';
  26 };
  27 security.pass = {
  28   store = ../../../sec/pass/servers/losurdo;
  29   secrets."root/key" = {};
  30 };
  31 systemd.services = lib.mapAttrs' (target: secret:
  32   lib.nameValuePair (lib.removeSuffix ".service" secret.service)
  33     (lib.optionalAttrs (target != "root/key") {
  34       after = [ pass.secrets."root/key".service ];
  35       wants = [ pass.secrets."root/key".service ];
  36     })
  37   ) pass.secrets // {
  38  "${lib.removeSuffix ".service" (pass.secrets."root/key".service)}".postStart = ''
  39     set -x
  40     ${pkgs.gnupg}/bin/gpg --batch --pinentry-mode loopback \
  41      --passphrase-file /root/key.pass \
  42      --import '${pass.secrets."root/key".path}'
  43     shred -u '${pass.secrets."root/key".path}'
  44   '';
  45 };
  46
  47 services.unbound.enable = true;
  48
  49 environment.systemPackages = with pkgs; [
  50   cryptsetup
  51   direnv
  52   file
  53   fio
  54   gdb
  55   git
  56   gptfdisk
  57   #hey
  58   home-manager
  59   lm_sensors
  60   rsync
  61   smartctl-tbw
  62   socat
  63   sanoid
  64   #iptables-nftables-compat
  65   gnupg
  66 ];
  67 }