This commit is contained in:
m3tam3re 2024-09-23 14:30:14 +02:00
parent b2c3dba781
commit 78a720e1a3
14 changed files with 269 additions and 7 deletions

110
flake.lock generated
View File

@ -1,5 +1,48 @@
{
"nodes": {
"agenix": {
"inputs": {
"darwin": "darwin",
"home-manager": "home-manager",
"nixpkgs": "nixpkgs",
"systems": "systems"
},
"locked": {
"lastModified": 1723293904,
"narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
"owner": "ryantm",
"repo": "agenix",
"rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
"type": "github"
},
"original": {
"owner": "ryantm",
"repo": "agenix",
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1700795494,
"narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
"type": "github"
},
"original": {
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"type": "github"
}
},
"disko": {
"inputs": {
"nixpkgs": [
@ -37,6 +80,27 @@
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1703113217,
"narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "home-manager",
"type": "github"
}
},
"home-manager_2": {
"inputs": {
"nixpkgs": [
"nixpkgs"
@ -58,15 +122,15 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1711703276,
"narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=",
"owner": "nixos",
"lastModified": 1703013332,
"narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "d8fe5e6c92d0d190646fb9f1056741a229980089",
"rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
"type": "github"
},
"original": {
"owner": "nixos",
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
@ -88,14 +152,46 @@
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1711703276,
"narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "d8fe5e6c92d0d190646fb9f1056741a229980089",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"agenix": "agenix",
"disko": "disko",
"dotfiles": "dotfiles",
"home-manager": "home-manager",
"nixpkgs": "nixpkgs",
"home-manager": "home-manager_2",
"nixpkgs": "nixpkgs_2",
"nixpkgs-stable": "nixpkgs-stable"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",

View File

@ -18,6 +18,8 @@
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.05";
agenix.url = "github:ryantm/agenix";
disko = {
url = "github:nix-community/disko";
inputs.nixpkgs.follows = "nixpkgs";
@ -31,6 +33,7 @@
outputs = {
self,
agenix,
disko,
dotfiles,
home-manager,
@ -56,6 +59,7 @@
modules = [
./hosts/m3-kratos
inputs.disko.nixosModules.disko
agenix.nixosModules.default
];
};
};

View File

@ -15,6 +15,7 @@ in {
set -x NIX_PATH nixpkgs=channel:nixos-unstable
set -x NIX_LOG info
set -x TERMINAL kitty
source /run/agenix/${config.home.username}-secrets
if test (tty) = "/dev/tty1"
exec Hyprland &> /dev/null

View File

@ -0,0 +1,5 @@
{
imports = [
./podman.nix
];
}

View File

@ -0,0 +1,32 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.extraServices.podman;
in {
options.extraServices.podman.enable = mkEnableOption "enable podman";
config = mkIf cfg.enable {
virtualisation = {
podman = {
enable = true;
dockerCompat = true;
autoPrune = {
enable = true;
dates = "weekly";
flags = [
"--filter=until=24h"
"--filter=label!=important"
];
};
defaultNetwork.settings.dns_enabled = true;
};
};
environment.systemPackages = with pkgs; [
podman-compose
];
};
}

View File

@ -0,0 +1,32 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.extraServices.podman;
in {
options.extraServices.podman.enable = mkEnableOption "enable podman";
config = mkIf cfg.enable {
virtualisation = {
podman = {
enable = true;
dockerCompat = true;
autoPrune = {
enable = true;
dates = "weekly";
flags = [
"--filter=until=24h"
"--filter=label!=important"
];
};
defaultNetwork.settings.dns_enabled = true;
};
};
environment.systemPackages = with pkgs; [
podman-compose
];
};
}

View File

@ -0,0 +1,32 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.extraServices.podman;
in {
options.extraServices.podman.enable = mkEnableOption "enable podman";
config = mkIf cfg.enable {
virtualisation = {
podman = {
enable = true;
dockerCompat = true;
autoPrune = {
enable = true;
dates = "weekly";
flags = [
"--filter=until=24h"
"--filter=label!=important"
];
};
defaultNetwork.settings.dns_enabled = true;
};
};
environment.systemPackages = with pkgs; [
podman-compose
];
};
}

View File

@ -36,6 +36,7 @@
imports = [
../common
./configuration.nix
./secrets.nix
./services
];

View File

@ -0,0 +1,13 @@
{
age = {
secrets = {
secret1 = {
file = ../../secrets/secret1.age;
};
m3tam3re-secrets = {
file = ../../secrets/m3tam3re-secrets.age;
owner = "m3tam3re";
};
};
};
}

View File

@ -1,5 +1,6 @@
{
imports = [
./echo.nix
./nginx.nix
];
}

View File

@ -0,0 +1,8 @@
{config, ...}: {
virtualisation.oci-containers.containers."nginx" = {
image = "docker.io/nginx:alpine";
environmentFiles = [
config.age.secrets.secret1.path
];
};
}

View File

@ -0,0 +1,15 @@
age-encryption.org/v1
-> ssh-ed25519 l/KTwg +8dkEwTxSxpSykhcm+qqMU5c9FxuL0VURTO+Et3Hqjg
IPzfKtktyMQdv5SceryhZrYhCeB/TVLgXAlu78ihMTw
-> ssh-rsa DQlE7w
j4z7/+j+OxQn5pyhuzYdhUYKVhsU7VndBt62wHkt/3akh4a31GbXDmhhFasO/0LX
vj0MnsoNQSyWxSE16oP3abFL3dnv8u5nUNsTUUKnd7gv58RglfGzUI3vZ5iIQVZx
ryAiRhmZbzb+oXN4Kzi3Mj1yNExnmDK5JXwKMZpWRPlgmnEAvoRnBGK9povIk+Av
vACdqLC0jZPsw3B2zw1L35iVSeb2HbbqYdUab3ElClPu6HVQBa7JGSSNfyVJY3c4
zbz9H9gwDvspu0jexK6D7cZjDalh3UCYly7JvPGoUd6bWHUCNhHOyAhZFIZlNIhj
pD1BqBis9Mh5xtCElml+PQkfKQKqGJz7KZ6v6bs6EGq/0nXaEiMmn3HRYnPEL98O
u63SVH5vevAcUewVw6/iENN+0vUTK19C3vkEFDaEwuPTituAMReicx+9vZZvz7ZE
nTUDblgl+8MngAQBaRjH4HrsXb3mx/4vFhSMO7gBYwYq8xpPXLqlwqgyBS54fBSU
--- T7qcXQKB/ktQb5Epx0/k+EDOdpbJV1x7VaZKEGEfaOE
 ¶»qñQ¥?Nƒ˯:a1)§\<5C>Ë&¹Ezl[Ê'¯Ö`%¯QQÞÁ9Ö/{Ûßà&<w®ÅåÙÄ°s

15
secrets/secret1.age Normal file
View File

@ -0,0 +1,15 @@
age-encryption.org/v1
-> ssh-ed25519 l/KTwg rtb9YLrncvwCrLgxUrpsyWQKh5EpORg+M3V2jWFEI0Q
+QaPHNxR+5GcIKt9+0EbP/9UbZPe1ET6OS+NOByeZ90
-> ssh-rsa DQlE7w
k2jNaCjCwamanfwOn2U+mxjo1n4445GvfEk2U8OG75AGox4UxlvCBqbzecx9jx+t
w3CBDstgVvJgEMjZ70g4fhok6gISiyMKc/KQxU9TLRYlTU3ulvX3nf+/4pX05YVv
Xj+7amLZtEPSMNgNDbRnverPToVTCEgzpG7XELzhrhV+cbLvI702f2ws2puySvkR
rMkAyyHNA3UfYv42FX4ZitIiOKHALdAVw89oxVFLj4qcYIuo6GdmDoMiRQCLdDvs
CkRyPm7qtrcc6Kmeyl0xLZnTWi90IOF8tHmwbOhSxbhRpWPn05Gzdw27hbX41gkZ
qqerT71oFVJhueK8gCJPtePQQXIXLsOc4gjI78WXaRB/BlpwWK4GlKEeaIHP9f35
HVN8PAjWmgA9MR2/p9azmwYjVduaZoRrINmSVMwtS31h6eZD1m5XAuO3orBZHKqX
8Z9gkpaeIOvGhdP0ye861l3PSduI01CNe9dT0T+iIWhXbMkJ3woVaQTOl8h/IVb6
--- Q6mzi+/lp1nHSpHoVZqH4RXzNh0Jei8FRhBgU4IjHCQ
º£µéaŒè²Ck ®ýlà !¡\Hˆ>܃¥HJ{C:ŒD¦Ñ£&¦îøˆŲPEŠ¬ŠW

7
secrets/secrets.nix Normal file
View File

@ -0,0 +1,7 @@
let
m3-kratos-vm = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE+8dfimMlWKZOlpjEGI6/2hVFDhytJVTi/P92Jf9mTz";
m3tam3re = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU=";
in {
"secret1.age".publicKeys = [m3-kratos-vm m3tam3re];
"m3tam3re-secrets.age".publicKeys = [m3-kratos-vm m3tam3re];
}