diff options
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | .sops.yaml | 15 | ||||
| -rw-r--r-- | common.nix | 16 | ||||
| -rw-r--r-- | flake.lock | 52 | ||||
| -rw-r--r-- | flake.nix | 8 | ||||
| -rw-r--r-- | home-modules/default.nix | 7 | ||||
| -rw-r--r-- | home-modules/desktop/hyprland.nix | 6 | ||||
| -rw-r--r-- | home-modules/services/default.nix | 2 | ||||
| -rw-r--r-- | home-modules/services/vdirsyncer.nix | 74 | ||||
| -rw-r--r-- | home/wilkuu.nix | 3 | ||||
| -rw-r--r-- | hosts/apocalypse/default.nix | 8 | ||||
| -rw-r--r-- | hosts/apocalypse/firewall.nix | 9 | ||||
| -rw-r--r-- | hosts/test_vm/default.nix | 11 | ||||
| -rw-r--r-- | modules/desktop/common.nix | 24 | ||||
| -rw-r--r-- | modules/virt.nix | 2 | ||||
| -rw-r--r-- | secrets/eli.pub | 1 | ||||
| -rw-r--r-- | secrets/secrets.yaml | 32 | ||||
| -rw-r--r-- | users/remote-build.nix | 16 | ||||
| -rw-r--r-- | users/user-common.nix | 3 |
19 files changed, 246 insertions, 44 deletions
@@ -0,0 +1 @@ +*_unencrypted diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..1bb53dd --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,15 @@ +keys: + - &admin_wilkuu age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a + - &server_apocalypse age19cw4x4ycrdhfdkwvp009czmvfhucpdtn8lme4ja0rvq7er87z3wsd2fxz7 + +creation_rules: + - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ + key_groups: + age: + - *admin_wilkuu + - *server_apocalypse + - path_regex: secrets/apocalypse/[^/]+\.(yaml|json|env|ini)$ + age: + - *admin_wilkuu + - *server_apocalypse + @@ -1,4 +1,4 @@ -{pkgs, lib, ...}: { +{pkgs, lib, inputs, config,...}: { imports = [ ./modules ]; @@ -11,6 +11,11 @@ }; time.timeZone = "Europe/Amsterdam"; # Set timezone + sops.defaultSopsFile = ./secrets/secrets.yaml; + sops.age.sshKeyPaths = ["/etc/ssh_host_ed25519_key"]; + sops.age.keyFile = "/var/lib/sops-nix/key.txt"; + sops.age.generateKey = true; + systemd.oomd = { enable = true; enableUserSlices = true; @@ -41,6 +46,10 @@ ranger file lm_sensors + + # Needed for getting credentials + age + sops bashInteractive coreutils @@ -51,7 +60,8 @@ usbutils vim - # Dev stuff, move later + # TODO: Dev stuff, move later + # This could really make the image smaller git pkg-config cmake @@ -59,8 +69,6 @@ gnumake clang rustup - - # D ]; networking.hosts = { @@ -7,11 +7,11 @@ ] }, "locked": { - "lastModified": 1759573136, - "narHash": "sha256-ILSPD0Dm8p0w0fCVzOx98ZH8yFDrR75GmwmH3fS2VnE=", + "lastModified": 1761191301, + "narHash": "sha256-xsRL2Oyb4YRZZ1Tu4WzR2uFg1n931bH+PfLdFcqtLg8=", "owner": "nix-community", "repo": "home-manager", - "rev": "5f06ceafc6c9b773a776b9195c3f47bbe1defa43", + "rev": "4958aafe7b237dc1e857fb0c916efff72075048f", "type": "github" }, "original": { @@ -22,11 +22,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1759381078, - "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=", + "lastModified": 1761114652, + "narHash": "sha256-f/QCJM/YhrV/lavyCVz8iU3rlZun6d+dAiC3H+CDle4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee", + "rev": "01f116e4df6a15f4ccdffb1bcd41096869fb385c", "type": "github" }, "original": { @@ -36,10 +36,48 @@ "type": "github" } }, + "nixpkgs-stable": { + "locked": { + "lastModified": 1761016216, + "narHash": "sha256-G/iC4t/9j/52i/nm+0/4ybBmAF4hzR8CNHC75qEhjHo=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "481cf557888e05d3128a76f14c76397b7d7cc869", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-25.05", + "repo": "nixpkgs", + "type": "github" + } + }, "root": { "inputs": { "home-manager": "home-manager", - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs", + "nixpkgs-stable": "nixpkgs-stable", + "sops-nix": "sops-nix" + } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1760998189, + "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" } } }, @@ -3,6 +3,12 @@ inputs = { nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; + nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05"; + + sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; home-manager = { url = "github:nix-community/home-manager"; @@ -23,7 +29,9 @@ ./common.nix ./hosts/apocalypse ./users/wilkuu.nix + ./users/remote-build.nix inputs.home-manager.nixosModules.default + inputs.sops-nix.nixosModules.sops ]; }; test_vm = nixpkgs.lib.nixosSystem { diff --git a/home-modules/default.nix b/home-modules/default.nix index 413a08e..46db559 100644 --- a/home-modules/default.nix +++ b/home-modules/default.nix @@ -1,4 +1,9 @@ -{pkgs, ...}: { +{pkgs, config ,...}: { imports = [./theming.nix ./apps ./desktop ./services ]; + sops = { + age.keyFile = "/home/${config.home.username}/.config/sops/age/keys.txt"; + defaultSopsFile = ../secrets/secrets.yaml; + }; + } diff --git a/home-modules/desktop/hyprland.nix b/home-modules/desktop/hyprland.nix index 127141f..6f36b2f 100644 --- a/home-modules/desktop/hyprland.nix +++ b/home-modules/desktop/hyprland.nix @@ -11,9 +11,10 @@ with lib; xdg-desktop-portal-hyprland wl-clipboard brightnessctl - lxqt.lxqt-policykit ]; + services.hyprpolkitagent.enable = true; + homeprogs.waybar.enable = true; homeprogs.mako.enable = true; # Environment variables for hyprland. @@ -39,14 +40,13 @@ with lib; settings = { exec-once = map (s: "uwsm app -- " + s) [ "kitty &" - "lxqt-policykit-agent &" "waybar &" "nm-applet &" "blueman-tray &" "blueman-applet &" "hyprctl setcursor Catppuccin-Mocha-Dark-Cursors 24" "kdeconnect-indicator &" - "fcitx5 -d" + # "fcitx5 -d" ] ++ [ "systemctl --user start hypridle.service" "systemctl --user start hyprpaper.service" diff --git a/home-modules/services/default.nix b/home-modules/services/default.nix index 4eb6005..b83312c 100644 --- a/home-modules/services/default.nix +++ b/home-modules/services/default.nix @@ -1,5 +1,5 @@ {lib, ...}: { - imports = [./direnv.nix ./syncthing.nix]; + imports = [./vdirsyncer.nix ./direnv.nix ./syncthing.nix]; # Gnome keyring, very smort services.gnome-keyring.enable = true; diff --git a/home-modules/services/vdirsyncer.nix b/home-modules/services/vdirsyncer.nix new file mode 100644 index 0000000..c5dd2cc --- /dev/null +++ b/home-modules/services/vdirsyncer.nix @@ -0,0 +1,74 @@ +{pkgs, inputs, config, lib, ...}: +let + cfg = config.homesv.vdirsyncer; +in +{ + options.homesv.vdirsyncer = { + enable = lib.mkEnableOption "Enable syncing via vdirsyncer"; + user = lib.mkOption { default = config.home.username; }; + server = lib.mkOption { default= "https://webdav.wilkuu.xyz/dav.php"; }; + }; + config = lib.mkIf cfg.enable { + sops.secrets.webdav_uname = { + sopsFile = ../../secrets/secrets.yaml; + key="${cfg.user}/webdav/username"; + }; + sops.secrets.webdav_pass = { + sopsFile = ../../secrets/secrets.yaml; + key="${cfg.user}/webdav/password"; + }; + services.vdirsyncer = { + enable = true; + frequency = "*:0/5"; # About once in 5 minutes + }; + + systemd.user.services.vdirsyncer.unitConfig.After = [ "sops-nix.service" ]; + + sops.templates."vdirsyncer_config_${cfg.user}" = { + content = '' + [general] + status_path = "~/.vdirsyncer/status/" + + [pair contacts] + a = "contacts_local" + b = "contacts_remote" + collections = ["from a", "from b"] + + [storage contacts_local] + type = "filesystem" + path = "~/.contacts/" + fileext = ".vcf" + + [storage contacts_remote] + type = "carddav" + auth = "digest" + url = "${cfg.server}" + username = "${config.sops.placeholder.webdav_uname}" + password = "${config.sops.placeholder.webdav_pass}" + + [pair calendar] + a = "calendar_local" + b = "calendar_remote" + collections = ["from a", "from b"] + metadata = ["color", "displayname"] + conflict_resolution = "b wins" + + [storage calendar_local] + type = "filesystem" + path = "~/.calendar/" + fileext = ".ics" + + [storage calendar_remote] + type = "caldav" + auth = "digest" + url = "${cfg.server}" + username = "${config.sops.placeholder.webdav_uname}" + password = "${config.sops.placeholder.webdav_pass}" + ''; + }; + home.file.".config/vdirsyncer/config" = { + source = config.lib.file.mkOutOfStoreSymlink config.sops.templates."vdirsyncer_config_${cfg.user}".path; + }; + }; +} + diff --git a/home/wilkuu.nix b/home/wilkuu.nix index 914824e..9547aec 100644 --- a/home/wilkuu.nix +++ b/home/wilkuu.nix @@ -1,6 +1,4 @@ { config ,pkgs, hostconfig, ... }: { - - imports = [../home-modules]; homeapps.presets.full.enable = true; @@ -16,6 +14,7 @@ }; }; + homesv.vdirsyncer.enable = true; home.username = "wilkuu"; home.homeDirectory = "/home/wilkuu"; diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix index d199263..c4bffbf 100644 --- a/hosts/apocalypse/default.nix +++ b/hosts/apocalypse/default.nix @@ -61,7 +61,6 @@ programs.nix-ld.enable = true; services.printing.enable = true; - # nix.config.allowUnfree = true; services.resolved = { @@ -96,13 +95,6 @@ PrintMotd = true; }; }; - - # Winbox setup. - programs.winbox = { - enable = true; - openFirewall = true; - package = pkgs.winbox; - }; } diff --git a/hosts/apocalypse/firewall.nix b/hosts/apocalypse/firewall.nix index c63e556..26097af 100644 --- a/hosts/apocalypse/firewall.nix +++ b/hosts/apocalypse/firewall.nix @@ -33,8 +33,10 @@ let ]; in { + networking.nftables.enable = false; networking.firewall = { - enable = false; + enable = false; + checkReversePath = false; allowedTCPPorts = baseTCP; allowedUDPPorts = baseUDP; allowedUDPPortRanges = baseUDPRanges; @@ -47,6 +49,11 @@ in allowedTCPPortRanges = secureTCPRanges; }; }; + trustedInterfaces = [ + "docker0" + "br-*" + "veth*" + ]; }; } diff --git a/hosts/test_vm/default.nix b/hosts/test_vm/default.nix index 280cb9a..06998c6 100644 --- a/hosts/test_vm/default.nix +++ b/hosts/test_vm/default.nix @@ -1,9 +1,14 @@ -{pkgs, lib, ...}: { - +{pkgs, lib, inputs,...}: { boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; + imports = ["${inputs.nixpkgs}/nixos/modules/virtualisation/libvirtd.nix"]; - addons.desktop.hyprland.enable = true; + networking.hostName = "cookie_vm"; # Define your hostname. + networking.networkmanager.enable = true; + programs.nix-ld.enable = true; + + + addons.desktop.hyprland.enable = false; addons.desktop.xfce.enable = true; addons.virtualisation.guest = true; virtualisation.vmVariant = { diff --git a/modules/desktop/common.nix b/modules/desktop/common.nix index 88e0071..c04a6b0 100644 --- a/modules/desktop/common.nix +++ b/modules/desktop/common.nix @@ -51,17 +51,19 @@ }; - i18n.inputMethod = { - type = "fcitx5"; - enable = true; - fcitx5.addons = with pkgs; [ - fcitx5-gtk - fcitx5-lua - fcitx5-mozc - catppuccin-fcitx5 - fcitx5-table-other - ]; - }; + # fcitx is broken for now + # i18n.inputMethod = { + # type = "fcitx5"; + # enable = true; + # fcitx5.addons = with pkgs; [ + # fcitx5-gtk + # fcitx5-lua + # fcitx5-mozc + # catppuccin-fcitx5 + # fcitx5-table-other + # kdePackages.fcitx5-qt + # ]; + # }; fonts.packages = with pkgs; [ noto-fonts diff --git a/modules/virt.nix b/modules/virt.nix index feb27c7..597b957 100644 --- a/modules/virt.nix +++ b/modules/virt.nix @@ -22,8 +22,6 @@ in qemu = { swtpm.enable = true; vhostUserPackages = with pkgs; [ virtiofsd ]; - ovmf.enable = true; - ovmf.packages = [ pkgs.OVMFFull.fd ]; }; }; }; diff --git a/secrets/eli.pub b/secrets/eli.pub new file mode 100644 index 0000000..c4b902a --- /dev/null +++ b/secrets/eli.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt45NZS0gBeiSX4P2ous4oZmPmCJ1dNrNlakVuQCPZf diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml new file mode 100644 index 0000000..18e36d7 --- /dev/null +++ b/secrets/secrets.yaml @@ -0,0 +1,32 @@ +wilkuu: + webdav: + username: ENC[AES256_GCM,data:NVdz+9U/EvOiHTLL8J9N4A==,iv:jEZCiHUgCPxuwhgBCDwns+QoCKOXX3fjHlQpCDm2Js0=,tag:hPOrHNMQsQ6YKicmucGlag==,type:str] + password: ENC[AES256_GCM,data:jtf7GGioSTHEaOndQK3SG5tPCpuI4QbhquegcWdQSMIl2lpt6z+lMZnFzA8x0jh3TridOn/J,iv:ZvFDEMY6V4W/ict0V7sLLt/c2oxM5UDCPpgpmkQIT7Q=,tag:AhmZxKGUiCufYVDXp+Mcxw==,type:str] +remote: + ssh: + pub: ENC[AES256_GCM,data:U085pFFBMqd38eRXZKAYo8pjSiK9KUB1a/oXFEn5TKldH5vx3IBT+/c7VxG8O/W08sZlnHZxnjOKco3Klnmzpi+R+pAzTC7qe8hjk69JGbBKRKV0jp8gmNKM2o3cme8dsGuq,iv:gq271TCYh8akbMJTACOrwLuBVb6vUWkMQwQP088XBDI=,tag:9Vya17dym0VJxKRLRuBGAw==,type:str] + priv: ENC[AES256_GCM,data:R6VtDPTw0pK9v8uEPVtL77CksucebIF7GHKhR4ZPrpxb76JLFnHKrX3HsinoRdMLkKHluF5+MOux8QcQwc0wvFWMUnIr0DX4gvbGsliFnbjG7XHAzcVrZmt6I/WKPDwDBNNjy/hoaBTBp29e7NfkSGRbVze7onEQocUPOfhJZ2CGKH/Gb3lkCy9l/35wwC0BwziIV/4jFQSVpywxKao3h6nu+SGSt0OQhs1j0eyNCyuneCVvNeI/UxuRM89TWNUbTWFxWsIuc366OMgq3PyywDHGTnO6JrjCAXHZ1ZdZPpAyDZhGuUEgp2fVOVsl2X64h0kus8X0kJTtEEtEvD6bvw02BBErfDkXY8+x6TCFYVW7x/S+9+G8ZXaHePRUCeIjYO6IisKsJwbggbTE8SDxZiilke2hHHZMvbezbLB3BczOvFCO1LCdVH5hBA1nR3KjJ2vSo1QVOY2Q2XltuJFhTfHlzpUXm4feFJ8VeoB8cTGBoEgT+w87QjoCJvRdznVTPL0uIlU1Gp+lEBDpi8Wqwfekbr+aEX1kO81E,iv:lKOJ9GPtcSORlcLyPm1Vm8ValuyC4MQkIrfPRApBZj4=,tag:IwIzmt0I0T8xGa48/arTJw==,type:str] +sops: + age: + - recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyYUx2M3BCQURCL05peGp0 + SkE5SVNMNFZuRzRwMER0eEVucGxEbUVFN0VjCi9EUExiT3hPcEJqMmdmZU9wOFF5 + RmFzOW1aMHh2QWQ2SnFmQVk1VEoxdjgKLS0tIEJFOFZHZVR2V0QyMG1CaFlnQ2NM + Q2U0QzZmMkNISFdXV0toQmtiYXgwb3MKU13rv8KnMK3uPAqE4rQ9eUuibrMoDpJb + zXzsfug550/vZOIcKYbRbush4r5rmS2Z5GO2z0S6062qOICmwTxbVw== + -----END AGE ENCRYPTED FILE----- + - recipient: age19cw4x4ycrdhfdkwvp009czmvfhucpdtn8lme4ja0rvq7er87z3wsd2fxz7 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGQ1RrRFZ0NWtYL0toQks2 + K3Y0M1o3OUE2RUNsZDJ6ckVHbyt4Y1k2TUdJCnpieDQvNHR1dnhMd0hIU04wbjA4 + U1I1bkhSRDZKcnBkbk5NTlFvNHc5VTAKLS0tIGw2MWRzSTMweGhCK3NrdnpiZjUz + c1NBbDBUZVRQQ2p2aWp5dXB1eHAxcTQKcON/bYv2tyHr1q7jzgcWHlc8Ikp2/734 + IttERY1sS+iwKVWkodqPPQ9s+/0te0BQ5jEc3vJf0Rcn0lDtfzzwsQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-11-05T20:11:43Z" + mac: ENC[AES256_GCM,data:Csq9wzz8XcuwL7z/Pra0iOcDurxC5DyAILBpKyZFRQ6o6HJuRQc/7Xk1PPSwrjzCJJjyJOYNtM0IzjxWoXn+8QE9dzytX+xMTiKXL+gzajeZuNn05ibMZi4/LmRBbW0eQAHB3YI2RZk7zj35aCNeKjETbUERHzgct1zFyuGfV/k=,iv:HvBVBEK/EokkDMgdru20JowiAnM4UHd21qJVhTIYQOw=,tag:MWy8lHOmpUywTFMJmLWP0A==,type:str] + unencrypted_suffix: _unencrypted + version: 3.11.0 diff --git a/users/remote-build.nix b/users/remote-build.nix new file mode 100644 index 0000000..7993d70 --- /dev/null +++ b/users/remote-build.nix @@ -0,0 +1,16 @@ +{pkgs, config, ...}: { + + sops.secrets.remote_pub = { + key = "remote/ssh/pub"; + sopsFile = ../secrets/secrets.yaml; + }; + users.users.remotebuild = { + isSystemUser = true; + group = "remotebuild"; + useDefaultShell = true; + openssh.authorizedKeys.keyFiles = [ ../secrets/eli.pub ]; + }; + + users.groups.remotebuild = {}; + nix.settings.trusted-users = [ "remotebuild" ]; +} diff --git a/users/user-common.nix b/users/user-common.nix index 4b60044..b6da2bb 100644 --- a/users/user-common.nix +++ b/users/user-common.nix @@ -1,4 +1,4 @@ -{pkgs, config, ...}: { +{pkgs, config, inputs, ...}: { # Pass host config to HM (Common config) # TODO: Move this somewhere else. home-manager = { @@ -11,6 +11,7 @@ _module.args.hostconfig = config; }) + inputs.sops-nix.homeManagerModules.sops ]; }; } |