Secrets via nixos-sops, caldav and fixed virt

19 files changed, 246 insertions, 44 deletions

diff --git a/.gitignore b/.gitignore
index e69de29..26222bb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1 @@
+*_unencrypted
diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..1bb53dd
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,15 @@
+keys: 
+  - &admin_wilkuu age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+  - &server_apocalypse age19cw4x4ycrdhfdkwvp009czmvfhucpdtn8lme4ja0rvq7er87z3wsd2fxz7 
+
+creation_rules: 
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    age: 
+      - *admin_wilkuu
+      - *server_apocalypse 
+  - path_regex: secrets/apocalypse/[^/]+\.(yaml|json|env|ini)$
+    age: 
+      - *admin_wilkuu
+      - *server_apocalypse 
+
diff --git a/common.nix b/common.nix
index 2b1a479..2ffe4d9 100644
--- a/common.nix
+++ b/common.nix
@@ -1,4 +1,4 @@
-{pkgs, lib, ...}: {
+{pkgs, lib, inputs, config,...}: {
   imports = [
     ./modules
   ]; 
@@ -11,6 +11,11 @@
   };
   time.timeZone = "Europe/Amsterdam"; # Set timezone
 
+  sops.defaultSopsFile = ./secrets/secrets.yaml;
+  sops.age.sshKeyPaths = ["/etc/ssh_host_ed25519_key"]; 
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt"; 
+  sops.age.generateKey = true; 
+
   systemd.oomd = {
     enable = true;
     enableUserSlices = true;
@@ -41,6 +46,10 @@
     ranger
     file
     lm_sensors 
+
+    # Needed for getting credentials
+    age
+    sops 
   
     bashInteractive
     coreutils
@@ -51,7 +60,8 @@
     usbutils
     vim
 
-    # Dev stuff, move later
+    # TODO: Dev stuff, move later
+    # This could really make the image smaller 
     git
     pkg-config
     cmake 
@@ -59,8 +69,6 @@
     gnumake
     clang
     rustup
-
-    # D
   ];
   
   networking.hosts = {
diff --git a/flake.lock b/flake.lock
index 3380cfa..e744054 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759573136,
-        "narHash": "sha256-ILSPD0Dm8p0w0fCVzOx98ZH8yFDrR75GmwmH3fS2VnE=",
+        "lastModified": 1761191301,
+        "narHash": "sha256-xsRL2Oyb4YRZZ1Tu4WzR2uFg1n931bH+PfLdFcqtLg8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5f06ceafc6c9b773a776b9195c3f47bbe1defa43",
+        "rev": "4958aafe7b237dc1e857fb0c916efff72075048f",
         "type": "github"
       },
       "original": {
@@ -22,11 +22,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759381078,
-        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
+        "lastModified": 1761114652,
+        "narHash": "sha256-f/QCJM/YhrV/lavyCVz8iU3rlZun6d+dAiC3H+CDle4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
+        "rev": "01f116e4df6a15f4ccdffb1bcd41096869fb385c",
         "type": "github"
       },
       "original": {
@@ -36,10 +36,48 @@
         "type": "github"
       }
     },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1761016216,
+        "narHash": "sha256-G/iC4t/9j/52i/nm+0/4ybBmAF4hzR8CNHC75qEhjHo=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "481cf557888e05d3128a76f14c76397b7d7cc869",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-stable": "nixpkgs-stable",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1760998189,
+        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index f7ff977..9bac301 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,6 +3,12 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
+
+    sops-nix = { 
+      url = "github:Mic92/sops-nix"; 
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     home-manager = {
        url = "github:nix-community/home-manager";
@@ -23,7 +29,9 @@
           ./common.nix
           ./hosts/apocalypse
           ./users/wilkuu.nix
+          ./users/remote-build.nix
           inputs.home-manager.nixosModules.default
+          inputs.sops-nix.nixosModules.sops 
         ];
       };
       test_vm = nixpkgs.lib.nixosSystem {
diff --git a/home-modules/default.nix b/home-modules/default.nix
index 413a08e..46db559 100644
--- a/home-modules/default.nix
+++ b/home-modules/default.nix
@@ -1,4 +1,9 @@
-{pkgs, ...}: {
+{pkgs, config ,...}: {
   imports = [./theming.nix ./apps ./desktop ./services ];
 
+  sops = {
+    age.keyFile = "/home/${config.home.username}/.config/sops/age/keys.txt"; 
+    defaultSopsFile = ../secrets/secrets.yaml; 
+  };
+
 } 
diff --git a/home-modules/desktop/hyprland.nix b/home-modules/desktop/hyprland.nix
index 127141f..6f36b2f 100644
--- a/home-modules/desktop/hyprland.nix
+++ b/home-modules/desktop/hyprland.nix
@@ -11,9 +11,10 @@ with lib;
       xdg-desktop-portal-hyprland
       wl-clipboard
       brightnessctl
-      lxqt.lxqt-policykit
     ];
 
+    services.hyprpolkitagent.enable = true; 
+
     homeprogs.waybar.enable = true;
     homeprogs.mako.enable = true;
     # Environment variables for hyprland.
@@ -39,14 +40,13 @@ with lib;
         settings = {
           exec-once = map (s: "uwsm app -- " + s) [
                "kitty &"
-               "lxqt-policykit-agent &"
                "waybar &"
                "nm-applet &"
                "blueman-tray &"
                "blueman-applet &"
                "hyprctl setcursor Catppuccin-Mocha-Dark-Cursors 24"
                "kdeconnect-indicator &"
-               "fcitx5 -d"
+               # "fcitx5 -d"
           ] ++ [
             "systemctl --user start hypridle.service"
             "systemctl --user start hyprpaper.service"
diff --git a/home-modules/services/default.nix b/home-modules/services/default.nix
index 4eb6005..b83312c 100644
--- a/home-modules/services/default.nix
+++ b/home-modules/services/default.nix
@@ -1,5 +1,5 @@
 {lib, ...}: {
-   imports = [./direnv.nix ./syncthing.nix];
+   imports = [./vdirsyncer.nix ./direnv.nix ./syncthing.nix];
 
   # Gnome keyring, very smort 
   services.gnome-keyring.enable = true;
diff --git a/home-modules/services/vdirsyncer.nix b/home-modules/services/vdirsyncer.nix
new file mode 100644
index 0000000..c5dd2cc
--- /dev/null
+++ b/home-modules/services/vdirsyncer.nix
@@ -0,0 +1,74 @@
+{pkgs, inputs, config, lib, ...}: 
+let 
+  cfg = config.homesv.vdirsyncer; 
+in 
+{ 
+  options.homesv.vdirsyncer = {
+    enable = lib.mkEnableOption "Enable syncing via vdirsyncer"; 
+    user = lib.mkOption {  default = config.home.username; };
+    server = lib.mkOption { default= "https://webdav.wilkuu.xyz/dav.php"; };
+  };
+  config = lib.mkIf cfg.enable {
+    sops.secrets.webdav_uname = {
+      sopsFile = ../../secrets/secrets.yaml;
+      key="${cfg.user}/webdav/username";
+    }; 
+    sops.secrets.webdav_pass = {
+      sopsFile = ../../secrets/secrets.yaml;
+      key="${cfg.user}/webdav/password";
+    }; 
+    services.vdirsyncer = {
+      enable = true; 
+      frequency = "*:0/5"; # About once in 5 minutes
+    }; 
+
+    systemd.user.services.vdirsyncer.unitConfig.After = [ "sops-nix.service" ];
+    
+    sops.templates."vdirsyncer_config_${cfg.user}" = {
+      content = ''
+        [general]
+        status_path = "~/.vdirsyncer/status/"
+
+        [pair contacts] 
+        a = "contacts_local"
+        b = "contacts_remote"
+        collections = ["from a", "from b"]
+
+        [storage contacts_local] 
+        type = "filesystem"
+        path = "~/.contacts/"
+        fileext = ".vcf" 
+
+        [storage contacts_remote]
+        type = "carddav"
+        auth = "digest"
+        url = "${cfg.server}"
+        username = "${config.sops.placeholder.webdav_uname}"
+        password = "${config.sops.placeholder.webdav_pass}"
+
+        [pair calendar] 
+        a = "calendar_local"
+        b = "calendar_remote"
+        collections = ["from a", "from b"]
+        metadata = ["color", "displayname"]
+        conflict_resolution = "b wins"
+
+        [storage calendar_local] 
+        type = "filesystem"
+        path = "~/.calendar/"
+        fileext = ".ics" 
+
+        [storage calendar_remote]
+        type = "caldav"
+        auth = "digest"
+        url = "${cfg.server}"
+        username = "${config.sops.placeholder.webdav_uname}"
+        password = "${config.sops.placeholder.webdav_pass}"
+      '';
+    };
+    home.file.".config/vdirsyncer/config" = {
+      source = config.lib.file.mkOutOfStoreSymlink config.sops.templates."vdirsyncer_config_${cfg.user}".path;
+    };
+  };
+} 
+
diff --git a/home/wilkuu.nix b/home/wilkuu.nix
index 914824e..9547aec 100644
--- a/home/wilkuu.nix
+++ b/home/wilkuu.nix
@@ -1,6 +1,4 @@
 { config ,pkgs, hostconfig, ... }: {
-   
-
    imports = [../home-modules];
 
    homeapps.presets.full.enable = true; 
@@ -16,6 +14,7 @@
     };
    };
      
+   homesv.vdirsyncer.enable = true;
 
    home.username = "wilkuu";
    home.homeDirectory = "/home/wilkuu";
diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix
index d199263..c4bffbf 100644
--- a/hosts/apocalypse/default.nix
+++ b/hosts/apocalypse/default.nix
@@ -61,7 +61,6 @@
 
   programs.nix-ld.enable = true;
   services.printing.enable = true;
-  # nix.config.allowUnfree = true; 
 
 
 	services.resolved = {
@@ -96,13 +95,6 @@
       PrintMotd = true;
     }; 
   };
-
-   # Winbox setup.
-  programs.winbox = {
-    enable = true;
-    openFirewall = true;
-    package = pkgs.winbox;
-  };
 }
 
 
diff --git a/hosts/apocalypse/firewall.nix b/hosts/apocalypse/firewall.nix
index c63e556..26097af 100644
--- a/hosts/apocalypse/firewall.nix
+++ b/hosts/apocalypse/firewall.nix
@@ -33,8 +33,10 @@ let
   ]; 
 in 
 {
+    networking.nftables.enable = false; 
     networking.firewall = {
-        enable = false; 
+        enable = false;
+        checkReversePath = false; 
         allowedTCPPorts = baseTCP; 
         allowedUDPPorts = baseUDP; 
           allowedUDPPortRanges = baseUDPRanges;
@@ -47,6 +49,11 @@ in
             allowedTCPPortRanges = secureTCPRanges;
           };
        };
+       trustedInterfaces = [
+          "docker0" 
+          "br-*" 
+          "veth*"
+       ];
     };
 }
 
diff --git a/hosts/test_vm/default.nix b/hosts/test_vm/default.nix
index 280cb9a..06998c6 100644
--- a/hosts/test_vm/default.nix
+++ b/hosts/test_vm/default.nix
@@ -1,9 +1,14 @@
-{pkgs, lib, ...}: {
-  
+{pkgs, lib, inputs,...}: {
   boot.loader.systemd-boot.enable = true; 
   boot.loader.efi.canTouchEfiVariables = true;
+  imports = ["${inputs.nixpkgs}/nixos/modules/virtualisation/libvirtd.nix"];
 
-  addons.desktop.hyprland.enable = true; 
+  networking.hostName = "cookie_vm"; # Define your hostname.
+  networking.networkmanager.enable = true; 
+  programs.nix-ld.enable = true;
+
+
+  addons.desktop.hyprland.enable = false; 
   addons.desktop.xfce.enable = true; 
   addons.virtualisation.guest = true; 
   virtualisation.vmVariant = {
diff --git a/modules/desktop/common.nix b/modules/desktop/common.nix
index 88e0071..c04a6b0 100644
--- a/modules/desktop/common.nix
+++ b/modules/desktop/common.nix
@@ -51,17 +51,19 @@
 
     };
 
-    i18n.inputMethod = {
-      type = "fcitx5";
-      enable = true; 
-      fcitx5.addons = with pkgs; [
-        fcitx5-gtk
-        fcitx5-lua
-        fcitx5-mozc
-        catppuccin-fcitx5 
-        fcitx5-table-other
-      ]; 
-    }; 
+    # fcitx is broken for now
+    # i18n.inputMethod = {
+    #   type = "fcitx5";
+    #   enable = true; 
+    #   fcitx5.addons = with pkgs; [
+    #     fcitx5-gtk
+    #     fcitx5-lua
+    #     fcitx5-mozc
+    #     catppuccin-fcitx5 
+    #     fcitx5-table-other
+    #     kdePackages.fcitx5-qt
+    #   ]; 
+    # }; 
 
     fonts.packages = with pkgs; [
        noto-fonts
diff --git a/modules/virt.nix b/modules/virt.nix
index feb27c7..597b957 100644
--- a/modules/virt.nix
+++ b/modules/virt.nix
@@ -22,8 +22,6 @@ in
           qemu = {
             swtpm.enable = true; 
             vhostUserPackages = with pkgs; [ virtiofsd ];
-            ovmf.enable = true; 
-            ovmf.packages = [ pkgs.OVMFFull.fd ];
           };
         };
       };   
diff --git a/secrets/eli.pub b/secrets/eli.pub
new file mode 100644
index 0000000..c4b902a
--- /dev/null
+++ b/secrets/eli.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt45NZS0gBeiSX4P2ous4oZmPmCJ1dNrNlakVuQCPZf
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
new file mode 100644
index 0000000..18e36d7
--- /dev/null
+++ b/secrets/secrets.yaml
@@ -0,0 +1,32 @@
+wilkuu:
+    webdav:
+        username: ENC[AES256_GCM,data:NVdz+9U/EvOiHTLL8J9N4A==,iv:jEZCiHUgCPxuwhgBCDwns+QoCKOXX3fjHlQpCDm2Js0=,tag:hPOrHNMQsQ6YKicmucGlag==,type:str]
+        password: ENC[AES256_GCM,data:jtf7GGioSTHEaOndQK3SG5tPCpuI4QbhquegcWdQSMIl2lpt6z+lMZnFzA8x0jh3TridOn/J,iv:ZvFDEMY6V4W/ict0V7sLLt/c2oxM5UDCPpgpmkQIT7Q=,tag:AhmZxKGUiCufYVDXp+Mcxw==,type:str]
+remote:
+    ssh:
+        pub: ENC[AES256_GCM,data:U085pFFBMqd38eRXZKAYo8pjSiK9KUB1a/oXFEn5TKldH5vx3IBT+/c7VxG8O/W08sZlnHZxnjOKco3Klnmzpi+R+pAzTC7qe8hjk69JGbBKRKV0jp8gmNKM2o3cme8dsGuq,iv:gq271TCYh8akbMJTACOrwLuBVb6vUWkMQwQP088XBDI=,tag:9Vya17dym0VJxKRLRuBGAw==,type:str]
+        priv: ENC[AES256_GCM,data:R6VtDPTw0pK9v8uEPVtL77CksucebIF7GHKhR4ZPrpxb76JLFnHKrX3HsinoRdMLkKHluF5+MOux8QcQwc0wvFWMUnIr0DX4gvbGsliFnbjG7XHAzcVrZmt6I/WKPDwDBNNjy/hoaBTBp29e7NfkSGRbVze7onEQocUPOfhJZ2CGKH/Gb3lkCy9l/35wwC0BwziIV/4jFQSVpywxKao3h6nu+SGSt0OQhs1j0eyNCyuneCVvNeI/UxuRM89TWNUbTWFxWsIuc366OMgq3PyywDHGTnO6JrjCAXHZ1ZdZPpAyDZhGuUEgp2fVOVsl2X64h0kus8X0kJTtEEtEvD6bvw02BBErfDkXY8+x6TCFYVW7x/S+9+G8ZXaHePRUCeIjYO6IisKsJwbggbTE8SDxZiilke2hHHZMvbezbLB3BczOvFCO1LCdVH5hBA1nR3KjJ2vSo1QVOY2Q2XltuJFhTfHlzpUXm4feFJ8VeoB8cTGBoEgT+w87QjoCJvRdznVTPL0uIlU1Gp+lEBDpi8Wqwfekbr+aEX1kO81E,iv:lKOJ9GPtcSORlcLyPm1Vm8ValuyC4MQkIrfPRApBZj4=,tag:IwIzmt0I0T8xGa48/arTJw==,type:str]
+sops:
+    age:
+        - recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyYUx2M3BCQURCL05peGp0
+            SkE5SVNMNFZuRzRwMER0eEVucGxEbUVFN0VjCi9EUExiT3hPcEJqMmdmZU9wOFF5
+            RmFzOW1aMHh2QWQ2SnFmQVk1VEoxdjgKLS0tIEJFOFZHZVR2V0QyMG1CaFlnQ2NM
+            Q2U0QzZmMkNISFdXV0toQmtiYXgwb3MKU13rv8KnMK3uPAqE4rQ9eUuibrMoDpJb
+            zXzsfug550/vZOIcKYbRbush4r5rmS2Z5GO2z0S6062qOICmwTxbVw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age19cw4x4ycrdhfdkwvp009czmvfhucpdtn8lme4ja0rvq7er87z3wsd2fxz7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGQ1RrRFZ0NWtYL0toQks2
+            K3Y0M1o3OUE2RUNsZDJ6ckVHbyt4Y1k2TUdJCnpieDQvNHR1dnhMd0hIU04wbjA4
+            U1I1bkhSRDZKcnBkbk5NTlFvNHc5VTAKLS0tIGw2MWRzSTMweGhCK3NrdnpiZjUz
+            c1NBbDBUZVRQQ2p2aWp5dXB1eHAxcTQKcON/bYv2tyHr1q7jzgcWHlc8Ikp2/734
+            IttERY1sS+iwKVWkodqPPQ9s+/0te0BQ5jEc3vJf0Rcn0lDtfzzwsQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-11-05T20:11:43Z"
+    mac: ENC[AES256_GCM,data:Csq9wzz8XcuwL7z/Pra0iOcDurxC5DyAILBpKyZFRQ6o6HJuRQc/7Xk1PPSwrjzCJJjyJOYNtM0IzjxWoXn+8QE9dzytX+xMTiKXL+gzajeZuNn05ibMZi4/LmRBbW0eQAHB3YI2RZk7zj35aCNeKjETbUERHzgct1zFyuGfV/k=,iv:HvBVBEK/EokkDMgdru20JowiAnM4UHd21qJVhTIYQOw=,tag:MWy8lHOmpUywTFMJmLWP0A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
diff --git a/users/remote-build.nix b/users/remote-build.nix
new file mode 100644
index 0000000..7993d70
--- /dev/null
+++ b/users/remote-build.nix
@@ -0,0 +1,16 @@
+{pkgs, config, ...}: {
+
+  sops.secrets.remote_pub = {
+    key = "remote/ssh/pub"; 
+    sopsFile = ../secrets/secrets.yaml;
+  };
+  users.users.remotebuild = {
+    isSystemUser = true; 
+    group = "remotebuild";
+    useDefaultShell = true; 
+    openssh.authorizedKeys.keyFiles = [ ../secrets/eli.pub ];
+  };
+
+  users.groups.remotebuild = {}; 
+  nix.settings.trusted-users = [ "remotebuild" ]; 
+}
diff --git a/users/user-common.nix b/users/user-common.nix
index 4b60044..b6da2bb 100644
--- a/users/user-common.nix
+++ b/users/user-common.nix
@@ -1,4 +1,4 @@
-{pkgs, config, ...}: {
+{pkgs, config, inputs, ...}: {
    # Pass host config to HM (Common config)
    # TODO: Move this somewhere else.
    home-manager = { 
@@ -11,6 +11,7 @@
           _module.args.hostconfig = config;
 
        })
+         inputs.sops-nix.homeManagerModules.sops
      ];
    };
 }