system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
# Let 'nixos-version --json' know about the Git revision of this flake.
system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
- security.gnupg.agent.enable = true;
- security.gnupg.store = inputs.pass + "/hosts/${hostName}";
/*
system.configurationRevision =
if inputs.self ? rev
program = (pkgs.writeShellScript "switch" (''
set -eux
set -o pipefail
+ shopt -s globstar
nix-store --add-root hosts/${hostName}.nixpkgs --indirect --realise ${nixpkgsPath}
nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
+
nix copy --to ssh://${target}${lib.optionalString config.install.substituteOnDestination " --substitute-on-destination"} ${build.toplevel}
- ${sendkeys.program}
+
'' + lib.optionalString config.boot.initrd.network.ssh.enable ''
# Send the SSH key of the initrd
- gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
+ gpg --decrypt 'pass/hosts/${hostName}/initrd/ssh.key.gpg' |
ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
# Send the Wireguard key of the initrd
- gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
+ gpg --decrypt 'pass/hosts/${hostName}/wireguard/wg-intra/privateKey.gpg' |
ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
'' + ''
- ssh ${target} \
- nix-env --profile '${profile}' --set '${build.toplevel}' '&&' \
- '${profile}'/bin/switch-to-configuration switch
+ ssh ${target} set -x ';' \
+ systemctl reset-failed nixos-fallback '2>/dev/null' ';' \
+ systemd-run -u nixos-fallback --description=nixos-fallback /bin/sh -xc '''\'''
+ PATH=${with pkgs; lib.makeBinPath [ coreutils nix systemd ]}
+ sleep $((10 * 60))
+ ${profile}/bin/switch-to-configuration switch
+ systemctl reboot
+ '\'''' '&&' \
+ ${build.toplevel}/bin/switch-to-configuration test
+
+ ssh ${target} -o ControlPath=none set -x ';' \
+ systemctl stop nixos-fallback.service ';' \
+ nix-env --profile ${profile} --set '${build.toplevel}' ';' \
+ ${build.toplevel}/bin/switch-to-configuration boot '&&' \
+ nix-env --delete-generations 7d --profile ${profile}
''
)).outPath;
};
sudo -k dd conv=notrunc oflag=direct,sync status=progress of="''${1:-/dev/mmcblk0}"
'').outPath;
};
- # Example: nix run .#losurdo.sendkeys
- "sendkeys" = {
- type = "app";
- #program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
- program = (pkgs.writeShellScript "sendkeys" ''
- set -eux
- #chmod -R g-rwx,o-rwx "$PWD/secrets/hosts"
- #rsync -ai --no-times --numeric-ids --usermap=:root --groupmap=:root --chmod=Du+rwx,Fu=r,go-rwx --delete "$PWD/secrets/hosts/${hostName}/root/" ${target}:/root/secrets
- #trap 'git reset secrets/hosts' EXIT
- #git rm -rf --cached --ignore-unmatch secrets/hosts # prevent copying to /nix/store
- ${pkgs.bash}/bin/bash -eux ${config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys"}
- '').outPath;
- };
}) inputs.self.nixosConfigurations;}
);
}
-{ pkgs, lib, config, hosts, ... }:
+{ pkgs, lib, config, inputs, hosts, hostName, ... }:
let
domain = "autogeree.net";
domainID = lib.replaceStrings ["."] ["_"] domain;
validMinDays = 10;
};
systemd.services."acme-${domain}" = {
- serviceConfig.LoadCredentialEncrypted = "${domain}.tsig:" + ./. + "/${domain}.tsig.cred";
+ serviceConfig.LoadCredentialEncrypted =
+ [ "${domain}.tsig:${inputs.self}/hosts/${hostName}/acme/${domain}.tsig.cred" ];
environment = {
RFC2136_TSIG_SECRET = "%d/${domain}.tsig";
RFC2136_NAMESERVER = "ns.${domain}:53";
-{ pkgs, lib, config, hosts, ... }:
+{ pkgs, lib, config, inputs, hosts, hostName, ... }:
let
domain = "sourcephile.fr";
domainID = lib.replaceStrings ["."] ["_"] domain;
credentialsFile = "/dev/null";
};
systemd.services."acme-${domain}" = {
- serviceConfig.LoadCredentialEncrypted = "${domain}.tsig:" + ./. + "/${domain}.tsig.cred";
+ serviceConfig.LoadCredentialEncrypted =
+ [ "${domain}.tsig:${inputs.self}/hosts/${hostName}/acme/${domain}.tsig.cred" ];
environment = {
RFC2136_TSIG_SECRET = "%d/${domain}.tsig";
RFC2136_NAMESERVER = "ns.${domain}:53";
-{ pkgs, lib, config, hosts, hostName, ... }:
+{ pkgs, lib, config, inputs, hosts, hostName, ... }:
let
inherit (config.users) users groups;
inherit (config.networking) domain;
startAt = "*:0/5"; # every 5 min
serviceConfig = {
Type = "simple";
- LoadCredentialEncrypted = "${hostName}.tsig:" + ./nsupdate/tsig.cred;
+ LoadCredentialEncrypted = [ "${hostName}.tsig:${inputs.self}/hosts/${hostName}/networking/nsupdate/tsig.cred" ];
ExecStart = pkgs.writeShellScript "nsupdate" ''
set -eux
publicIPv4=$(${pkgs.curl}/bin/curl -s4 https://whoami.sourcephile.fr/addr ||
-{ pkgs, lib, config, hosts, hostName, ... }:
+{ pkgs, lib, config, inputs, hosts, hostName, ... }:
let
wgIface = "wg-extra";
listenPort = 16843;
}
'';
#boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = "privateKey:" + ./. + "/${wgIface}/privateKey.cred";
+systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted =
+ [ "privateKey:${inputs.self}/hosts/${hostName}/networking/wireguard/${wgIface}/privateKey.cred" ];
networking.wireguard.interfaces."${wgIface}" = {
# publicKey: 1Iyq96rPHfyrt4B31NqKLgWzlglkMAWjA41aF279gjM=
privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
-{ pkgs, lib, config, hostName, inputs, ... }:
+{ pkgs, lib, config, inputs, hostName, ... }:
let
inherit (config.services) transmission;
inherit (config.users) users;
startAt = "06..19:0,15,30,45:00";
script = "true";
};
-systemd.services.transmission.serviceConfig.LoadCredentialEncrypted = "settings.json:" + transmission/settings.json.cred;
+systemd.services.transmission.serviceConfig.LoadCredentialEncrypted =
+ [ "settings.json:${inputs.self}/hosts/${hostName}/transmission/settings.json.cred" ];
services.transmission = {
enable = true;
performanceNetParameters = true;
enable = true;
realm = "turn.${domain}";
use-auth-secret = true;
- static-auth-secret = builtins.readFile coturn/static-auth-secret.clear;
+ static-auth-secret = lib.readFile coturn/static-auth-secret.clear;
pkey = "/var/lib/acme/${domain}/key.pem";
cert = "/var/lib/acme/${domain}/fullchain.pem";
- dh-file = coturn/dh4096.pem;
+ dh-file = lib.readFile coturn/dh4096.pem;
listening-ips = [ipv4];
relay-ips = [ipv4];
secure-stun = false;
-Subproject commit 3b441579dd52096501089d6801c245fd5ef985b5
+Subproject commit 39df25065cd861586a3e7568b924955734f8d837
enable = true;
user = "git";
group = users."git-daemon".name;
- adminPubkey = ../../users/julm/ssh/gnupg.pub;
+ adminPubkey = lib.readFile ../../users/julm/ssh/gnupg.pub;
extraGitoliteRc = ''
$RC{UMASK} = 0027; # NOTE: no quote around in Perl, so it's octal
$RC{LOG_DEST} = 'repo-log,syslog';
-{ pkgs, lib, config, credentials, host, ... }:
+{ pkgs, lib, config, inputs, hostName, host, ... }:
let
domain = "i.sourcephile.fr";
dnsIface = "iode";
gwIface = config.networking.defaultGateway.interface;
in
{
-systemd.services.iodined.serviceConfig.LoadCredentialEncrypted = "password:${credentials}/iodine/password.secret";
+systemd.services.iodined.serviceConfig.LoadCredentialEncrypted =
+ [ "password:${inputs.self}/hosts/${hostName}/iodine/password.cred" ];
systemd.sockets.iodined = {
enable = true;
listenDatagrams = [ "127.0.0.1:1053" ];
-{ inputs, pkgs, lib, config, hosts, ... }:
+{ pkgs, lib, config, inputs, hostName, hosts, ... }:
let
domain = "autogeree.net";
domainID = lib.replaceStrings ["."] ["_"] domain;
inherit (builtins) attrValues;
inherit (config) networking;
- inherit (config.security) gnupg;
inherit (config.services) knot;
inherit (config.users) users;
in
{
-services.knot.zones."${domain}" = {
+services.knot.zones.${domain} = {
conf = ''
acl:
- id: acl_localhost_acme_${domainID}
set output-net-knot-ipv6 { type ipv6_addr; elements = { 2001:4b98:d:1::40 }; }
}
'';
-users.groups.keys.members = [ users.knot.name ];
services.knot = {
- keyFiles = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".path ];
+ keyFiles = [
+ "/run/credentials/knot.service/${domain}.acme.conf"
+ ];
};
-security.gnupg.secrets."knot/tsig/${domain}/acme.conf" = {
- # Generated with: keymgr -t acme_${domainID}
- user = users.knot.name;
-};
-systemd.services.knot = {
- after = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
- wants = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
+systemd.services.knot.serviceConfig = {
+ LoadCredentialEncrypted = [
+ "${domain}.acme.conf:${inputs.self}/hosts/${hostName}/${domain}/acme.conf.cred"
+ ];
};
/* Useless since the zone is public
services.unbound.settings = {
-{ inputs, pkgs, lib, config, hosts, credentials, ... }:
+{ pkgs, lib, config, inputs, hostName, hosts, ... }:
let
domain = "sourcephile.fr";
domainID = lib.replaceStrings ["."] ["_"] domain;
inherit (config) networking;
- inherit (config.security) gnupg;
inherit (config.services) knot;
inherit (config.users) users;
in
@ CAA 128 issue "letsencrypt.org"
'';
};
-users.groups.keys.members = [ users.knot.name ];
services.knot = {
keyFiles = [
- gnupg.secrets."knot/tsig/${domain}/acme.conf".path
+ "/run/credentials/knot.service/${domain}.acme.conf"
# Generated with: keymgr -t losurdo_${domainID}
"/run/credentials/knot.service/losurdo.conf"
];
};
+systemd.services.knot = {
+ serviceConfig = {
+ LoadCredentialEncrypted = [
+ "${domain}.acme.conf:${inputs.self}/hosts/${hostName}/${domain}/acme.conf.cred"
+ "losurdo.conf:${inputs.self}/hosts/${hostName}/${domain}/losurdo.conf.cred"
+ ];
+ };
+};
networking.nftables.ruleset = ''
table inet filter {
# Gandi DNS
}
}
'';
-security.gnupg.secrets = {
- "knot/tsig/${domain}/acme.conf" = {
- # Generated with: keymgr -t acme_${domainID}
- user = users.knot.name;
- };
-};
-systemd.services.knot = {
- serviceConfig = {
- LoadCredentialEncrypted = "losurdo.conf:${credentials}/knot/tsig/losurdo.conf.secret";
- };
- /*
- preStart = ''
- test ! -d "$CREDENTIALS_DIRECTORY" ||
- ln -fns "$CREDENTIALS_DIRECTORY" /var/lib/knot/credentials
- '';
- */
- after = [
- gnupg.secrets."knot/tsig/${domain}/acme.conf".service
- ];
- wants = [
- gnupg.secrets."knot/tsig/${domain}/acme.conf".service
- ];
-};
/* Useless since the zone is public
services.unbound.settings = {
stub-zone = {
-{ pkgs, lib, config, hostName, ... }:
+{ pkgs, lib, config, inputs, hostName, ... }:
let
inherit (config.networking) domain;
- inherit (config.security) gnupg;
inherit (config.services) nginx postgresql;
inherit (config.users) users groups;
srv = "miniflux";
WATCHDOG = "1";
WORKER_POOL_SIZE = "2";
};
- adminCredentialsFile = gnupg.secrets."miniflux/credentials".path;
+ adminCredentialsFile = "/run/credentials/miniflux.service/credentials";
};
-security.gnupg.secrets."miniflux/credentials" = {};
systemd.services.miniflux = {
- after = [ gnupg.secrets."miniflux/credentials".service ];
- wants = [ gnupg.secrets."miniflux/credentials".service ];
partOf = [ "postgresql.service" ];
# For the socket-activation
wantedBy = lib.mkForce [ ];
RefuseManualStart = true;
};
serviceConfig = {
+ LoadCredentialEncrypted = [
+ "credentials:${inputs.self}/hosts/${hostName}/miniflux/credentials.cred"
+ ];
# For postgres auth
User = users."miniflux".name;
Group = groups."postgres".name;
proxyPass = "http://unix:/run/miniflux.sock:/";
};
};
-systemd.services.nginx.serviceConfig.LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
+systemd.services.nginx.serviceConfig.LogsDirectory =
+ lib.mkForce ["nginx/${domain}/${srv}"];
}
{ domain, ... }:
-{ pkgs, lib, config, ... }:
+{ pkgs, lib, config, inputs, hostName, ... }:
let
inherit (config) networking;
- inherit (config.security) gnupg;
inherit (config.services) nginx;
srv = "www";
root = "/var/lib/nginx/${domain}";
LogsDirectory = lib.mkForce [
"nginx/${domain}/${srv}"
];
+ LoadCredentialEncrypted = [
+ "${domain}.${srv}.julm.PC.htpasswd:${inputs.self}/hosts/${hostName}/nginx/${domain}/${srv}/julm/PC/htpasswd.cred"
+ ];
};
services.nginx = {
virtualHosts."${domain}.${srv}" = {
};
locations."/julm/PC/" = {
alias = "${root}/julm/PC/";
- basicAuthFile = gnupg.secrets."nginx/${domain}/${srv}/julm/PC/htpasswd".path;
+ basicAuthFile = "/run/credentials/nginx.service/${domain}.${srv}.julm.PC.htpasswd";
extraConfig = ''
fancyindex on;
fancyindex_name_length 255;
};
};
};
-security.gnupg.secrets = {
- "nginx/${domain}/${srv}/julm/PC/htpasswd" = {
- # Generated with: echo "$user:$(openssl passwd -apr1)"
- systemdConfig.before = [ "nginx.service" ];
- systemdConfig.wantedBy = [ "nginx.service" ];
- user = nginx.user;
- group = nginx.group;
- };
-};
}
{ domain, ... }:
-{ pkgs, lib, config, ... }:
+{ pkgs, lib, config, inputs, hostName, ... }:
let
inherit (config) networking;
- inherit (config.security) gnupg;
inherit (config.services) nginx;
srv = "www";
root = "/var/lib/nginx/${domain}";
-- turncredentials_host = "turn.${domain}"
-- turncredentials_port = 3478
- -- turncredentials_secret = "${coturn.settings.static-auth-secret}";
+ -- turncredentials_secret = "${coturn.static-auth-secret}";
- turn_external_secret = "${coturn.settings.static-auth-secret}"
+ turn_external_secret = "${coturn.static-auth-secret}"
turn_external_host = "turn.${domain}"
turn_external_port = 3478
turn_external_ttl = 86400
-{ pkgs, lib, config, ... }:
+{ pkgs, lib, config, inputs, hostName, ... }:
let
inherit (builtins) attrNames listToAttrs readFile;
inherit (lib) types;
inherit (pkgs.lib) unlinesAttrs;
- inherit (config.security) gnupg;
inherit (config.services) postfix rspamd dovecot2;
redis = config.services.redis.servers.rspamd;
inherit (config.users) users groups;
};
config = {
users.groups.redis-rspamd.members = [ rspamd.user ];
-users.groups.keys.members = [ rspamd.user ];
services.rspamd = {
enable = true;
debug = false;
locals = {
"dkim_signing.conf".text = ''
selector_map = ${rspamd.dkimSelectorMap};
- path = "/run/keys/gnupg/rspamd/dkim/$domain/$selector.key/file";
+ path = "/run/credentials/rspamd.service/$domain.$selector.key";
allow_username_mismatch = true;
'';
"arc.conf".text = ''
selector_map = ${rspamd.dkimSelectorMap};
- path = "/run/keys/gnupg/rspamd/dkim/$domain/$selector.key/file";
+ path = "/run/credentials/rspamd.service/$domain.$selector.key";
allow_username_mismatch = true;
'';
"redis.conf".text = ''
controller = {
includes = [
"$CONFDIR/worker-controller.inc"
- gnupg.secrets."rspamd/controller/hashedPassword".path
+ "/run/credentials/rspamd.service/controller.inc"
];
bindSockets = [
"127.0.0.1:11334"
};
};
};
-security.gnupg.secrets."rspamd/controller/hashedPassword" = {
- # Generated with: rspamadm pw
- user = rspamd.user;
- pipe = ''${pkgs.gnused}/bin/sed -e 's/.*/password = "\0";/' '';
- systemdConfig.postStart = "systemctl try-restart --no-block rspamd"; # rspamd does not support reloading so far
-};
systemd.services.rspamd = {
- wants = [ gnupg.secrets."rspamd/controller/hashedPassword".service ];
- after = [ gnupg.secrets."rspamd/controller/hashedPassword".service ];
+ serviceConfig = {
+ LoadCredentialEncrypted = [
+ "controller.inc:${inputs.self}/hosts/${hostName}/rspamd/controller.inc.cred"
+ ];
+ };
};
fileSystems."/var/lib/redis-rspamd" = {
-{ pkgs, lib, config, ... }:
+{ pkgs, lib, config, inputs, hostName, ... }:
let
- inherit (config.security) gnupg;
inherit (config.services) rspamd;
domain = "autogeree.net";
selector = "20200101";
"+hH+Mr/4V1wnKtdosk/7+3VIQ6clTIfWhD6PlnWd78Uo5lfWnYxTem7EMc2q7j6tzGwj+Q+b4Li9fdhLqxGuD0V64/nVZit90b0HyfiV5srln2lK6Hczrwqr0gOEBGQ4YeLjOF6ldaV01mFWR9ddr9a5/gVCqw8vw7vhqXvU7yK8VHW2rdsvkNZ0bDOa66MCveD7pH2vyljrfZq9k0T/NLHrsu8CAwEAAQ=="
)
'';
-security.gnupg.secrets."rspamd/dkim/${domain}/${selector}.key" = {
- user = rspamd.user;
- systemdConfig.postStart = "systemctl try-restart --no-block rspamd";
-};
-systemd.services.rspamd = {
- wants = [ gnupg.secrets."rspamd/dkim/${domain}/${selector}.key".service ];
- after = [ gnupg.secrets."rspamd/dkim/${domain}/${selector}.key".service ];
+systemd.services.rspamd.serviceConfig = {
+ LoadCredentialEncrypted = [
+ "${domain}.${selector}.key:${inputs.self}/hosts/${hostName}/rspamd/${domain}/${selector}.dkim.key.cred"
+ ];
};
}
-{ pkgs, lib, config, ... }:
+{ pkgs, lib, config, inputs, hostName, ... }:
let
- inherit (config.security) gnupg;
inherit (config.services) rspamd;
domain = "sourcephile.fr";
selector = "20200101";
"rWWtSTdO8DilDqN8CAwEAAQ=="
)
'';
-security.gnupg.secrets."rspamd/dkim/${domain}/${selector}.key" = {
- user = rspamd.user;
- systemdConfig.postStart = "systemctl try-restart --no-block rspamd";
-};
-systemd.services.rspamd = {
- after = [ gnupg.secrets."rspamd/dkim/${domain}/${selector}.key".service ];
- wants = [ gnupg.secrets."rspamd/dkim/${domain}/${selector}.key".service ];
+systemd.services.rspamd.serviceConfig = {
+ LoadCredentialEncrypted = [
+ "${domain}.${selector}.key:${inputs.self}/hosts/${hostName}/rspamd/${domain}/${selector}.dkim.key.cred"
+ ];
};
}
-{ pkgs, lib, config, shared, ... }:
+{ pkgs, lib, config, ... }:
let
inherit (builtins) readFile;
inherit (config.users) users groups;
shell = users.root.shell;
group = groups.disk.name;
openssh.authorizedKeys.keys = [
- (readFile (shared + "/hosts/losurdo/syncoid/sshKey.pub"))
+ (readFile ../losurdo/syncoid/sshKey.pub)
] ++ users."julm".openssh.authorizedKeys.keys;
};
systemd.tmpfiles.rules = [
-{ pkgs, lib, config, shared, ... }:
+{ pkgs, lib, config, ... }:
let
inherit (builtins) readFile;
inherit (config.users) users;
root = {
openssh.authorizedKeys.keys =
users."julm".openssh.authorizedKeys.keys ++
- [ (readFile (shared + "/hosts/losurdo/users/root/ssh/ed25519.pub")) ];
+ [ (readFile ../../users/root/ssh/losurdo.pub) ];
hashedPassword = "!";
};
};
-{ pkgs, lib, config, ... }:
+{ pkgs, lib, config, inputs, ... }:
# NOTE: list explicitely the modules loaded by defaults.nix,
# its clearer, safer and more flexible if not quicker.
{
#modules/config/console.nix
#modules/services/x11/display-managers/default.nix
modules/services/networking/prosody.nix
+ (inputs.julm-nix + "/nixos/modules/security/systemd-creds.nix")
];
disabledModules = [
#"config/console.nix"
--- /dev/null
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F root@losurdo
sourcephile / git / sourcephile-nix.git / commitdiff