diff --git a/.envrc b/.envrc new file mode 100644 index 0000000..1d953f4 --- /dev/null +++ b/.envrc @@ -0,0 +1 @@ +use nix diff --git a/.gitignore b/.gitignore index 2fd7c16..0f307bd 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ +.direnv/ + result/ result iso @@ -5,3 +7,4 @@ iso # For nixos-vms *.qcow2 *.fd +modules/private diff --git a/default.nix b/default.nix index 577e400..a14b22d 100644 --- a/default.nix +++ b/default.nix @@ -1,7 +1,7 @@ let - pins = import ./npins; + pins = import ./modules/npins; - nlib = import ./lib { + nlib = import ./modules/lib { inherit pins; lib = import "${pins.nixpkgs-stable}/lib"; }; @@ -17,25 +17,40 @@ let config.allowUnfree = true; }; }; + + temp_pkgs = import pins.nixpkgs-stable { }; in { hosts = { desktop = nlib.nixosHost rec { - nixpkgs = pins.nixpkgs-unstable; + + nixpkgs = temp_pkgs.applyPatches { + name = "nixpkgs_pathced"; + src = pins.nixpkgs-unstable; + patches = [ + (temp_pkgs.fetchpatch2 { + url = "https://github.com/NixOS/nixpkgs/pull/497870.patch"; + sha256 = "sha256-JF1mojt455HJU2TlNAOAK48jVJgsxybySixn1cI1Xg0="; + }) + ]; + }; + system = "x86_64-linux"; specialArgs = { inherit repos; args = { - # inherit pins; + inherit pins; inherit nixpkgs; flakes = nlib.gen_flakes [ "hjem" "hjem-rum" "zen-browser" + "helium" "nix-gaming-edge" + "sops-nix" ]; }; }; @@ -54,7 +69,9 @@ in args = { # inherit pins; inherit nixpkgs; - # flakes = nlib.gen_flakes []; + flakes = nlib.gen_flakes [ + "sops-nix" + ]; }; }; diff --git a/hosts/desktop/default.nix b/hosts/desktop/default.nix index ea8510a..76ea6c4 100644 --- a/hosts/desktop/default.nix +++ b/hosts/desktop/default.nix @@ -12,12 +12,23 @@ ./system/networking.nix # Network config ./system/services.nix ./hjem-rum/snowy.nix # :3 - ../private/desktop.nix + ../../modules/private/desktop.nix # /mnt/SnowData/snowy/Documents/repos/nixpkgs/nixos/modules/services/networking/tetrd.nix args.flakes.hjem.nixosModules.default args.flakes.nix-gaming-edge.nixosModules.default + # (import "${args.pins.lix-nixos-module}/module.nix" ({ + # lix = args.pins.lix; + # # versionSuffix = "pre${builtins.substring 0 8 args.pins.lix.lastModifiedDate}-${ + # # args.pins.lix.shortRev or args.pins.lix.dirtyShortRev + # # }"; + # })) + + # (import "${args.pins.lix-nixos-module}/module.nix" { lix = args.pins.lix; }) + # + ../../modules/sops/snowflake.nix + ../../modules/snownet ]; nixpkgs = { @@ -41,15 +52,15 @@ pkgs.proton-cachyos ]; - drivers.mesa-git = { - enable = false; - enableCache = false; - cacheCleanup = { - # protonPackage is null by default - thus Proton caches are not cleaned by default. Must define a protonPackage to clear Proton / engine caches - enable = true; - protonPackage = pkgs.proton-cachyos; # or variation - }; - }; + # drivers.mesa-git = { + # enable = true; + # enableCache = false; + # cacheCleanup = { + # # protonPackage is null by default - thus Proton caches are not cleaned by default. Must define a protonPackage to clear Proton / engine caches + # enable = true; + # protonPackage = pkgs.proton-cachyos; # or variation + # }; + # }; hjem = { clobberByDefault = true; diff --git a/hosts/desktop/hjem-rum/snowy.nix b/hosts/desktop/hjem-rum/snowy.nix index b4d81dc..f38db05 100644 --- a/hosts/desktop/hjem-rum/snowy.nix +++ b/hosts/desktop/hjem-rum/snowy.nix @@ -8,12 +8,20 @@ { users.users.snowy.packages = with pkgs; [ + fluxer-desktop + # factorio # factorio-space-age args.flakes.zen-browser.packages."${stdenv.hostPlatform.system}".twilight + args.flakes.helium.packages.x86_64-linux.default zed-editor vscode helix + gh + nix-output-monitor + glow + delta + nixpkgs-review ctop waypipe @@ -41,6 +49,8 @@ # d-spyd # bustle + vesktop + rustup gcc just @@ -54,8 +64,9 @@ papers loupe gnome-clocks - helvum - krita + # helvum # deprecated + crosspipe + # krita # orca-slicer protonplus protontricks @@ -66,7 +77,7 @@ heroic # hydralauncher - wineWowPackages.staging + wineWow64Packages.stagingFull easyeffects monocraft @@ -147,7 +158,6 @@ }; }; }; - }; }; } diff --git a/hosts/desktop/system/configuration.nix b/hosts/desktop/system/configuration.nix index fdc00bf..68cd68f 100644 --- a/hosts/desktop/system/configuration.nix +++ b/hosts/desktop/system/configuration.nix @@ -27,10 +27,11 @@ nixPath = [ "nixpkgs=${args.nixpkgs}" ]; registry.nixpkgs.to = { type = "path"; - path = args.nixpkgs; + path = args.pins.nixpkgs-unstable.outPath; + # narHash = args.pins.nixpkgs-unstable.narHash; }; - package = pkgs.lix; + package = repos.unstable.lixPackageSets.git.lix; channel.enable = false; settings = { experimental-features = [ @@ -54,7 +55,7 @@ gc = { automatic = true; - dates = "daily"; + dates = "weekly"; persistent = true; options = "--delete-older-than 3d"; }; @@ -74,7 +75,8 @@ supportedFilesystems = [ "ntfs" ]; # kernelPackages = pkgs.linuxPackages_cachyos-rc; # kernelPackages = pkgs.linuxPackages_cachyos; - kernelPackages = pkgs.linuxPackages_lqx; + # kernelPackages = pkgs.linuxPackages_lqx; + kernelPackages = pkgs.linuxPackages_zen; kernelParams = [ "amdgpu.noretry=0" @@ -276,8 +278,6 @@ # firewall.enable = false; }; - - xdg = { portal = { enable = true; @@ -511,7 +511,7 @@ prismlauncher signal-desktop qbittorrent - wireshark-qt + wireshark scrcpy glogg diff --git a/hosts/desktop/system/networking.nix b/hosts/desktop/system/networking.nix index b2a67c6..90e720f 100644 --- a/hosts/desktop/system/networking.nix +++ b/hosts/desktop/system/networking.nix @@ -20,12 +20,13 @@ # }; networking = { - hostName = "Snowflake"; + hostName = "snowflake"; # wireless.enable = true; networkmanager.enable = false; + useNetworkd = true; # networkmanager.wifi.backend = "iwd"; # wireless.iwd.enable = true; - useDHCP = true; + # useDHCP = true; # dhcpcd = { # enable = true; diff --git a/hosts/desktop/system/services.nix b/hosts/desktop/system/services.nix index d47e783..e504f12 100644 --- a/hosts/desktop/system/services.nix +++ b/hosts/desktop/system/services.nix @@ -1,6 +1,8 @@ { pkgs, ... }: { services = { + timesyncd.enable = true; + pipewire = { enable = true; alsa.enable = true; @@ -81,7 +83,7 @@ desktopManager.gnome.enable = true; # Enable the COSMIC desktop environment - desktopManager.cosmic.enable = true; + desktopManager.cosmic.enable = false; sunshine = { enable = true; diff --git a/hosts/homelab/default.nix b/hosts/homelab/default.nix index 04ec750..b5735b1 100644 --- a/hosts/homelab/default.nix +++ b/hosts/homelab/default.nix @@ -11,6 +11,9 @@ "${args.nixpkgs}/nixos/modules/profiles/minimal.nix" # Disables some options by default for a minimal installation: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/minimal.nix ./system/configuration.nix ./ports.nix + ../../modules/sops/homelab.nix + ../../modules/snownet + ./services ]; nixpkgs = { @@ -26,4 +29,24 @@ }) ]; }; + + virtualisation.vmVariant.virtualisation = { + memorySize = 4096; + cores = 4; + forwardPorts = [ + { + from = "host"; + proto = "tcp"; + host = { + port = 2222; + }; + guest = { + port = 22; + }; + } + ]; + qemu.guestAgent.enable = true; + useEFIBoot = false; + diskSize = 15360; + }; } diff --git a/hosts/homelab/ports.nix b/hosts/homelab/ports.nix index 0ddf2b9..e0eebec 100644 --- a/hosts/homelab/ports.nix +++ b/hosts/homelab/ports.nix @@ -6,6 +6,13 @@ type = lib.types.attrsOf lib.types.anything; default = { home_assistant = 3000; + + garage = { + s3_api = 3014; + web_api = 3015; + admin = 3016; + rpc = 3901; + }; }; }; } diff --git a/hosts/homelab/services/default.nix b/hosts/homelab/services/default.nix new file mode 100644 index 0000000..db23483 --- /dev/null +++ b/hosts/homelab/services/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./garage.nix + ./samba.nix + ]; +} diff --git a/hosts/homelab/services/garage.nix b/hosts/homelab/services/garage.nix new file mode 100644 index 0000000..e39dfc7 --- /dev/null +++ b/hosts/homelab/services/garage.nix @@ -0,0 +1,58 @@ +{ + config, + pkgs, + ... +}: +{ + # todo! garage-webui :3 + services.garage = { + enable = true; + package = pkgs.garage_2; + settings = { + db_engine = "sqlite"; + compression_level = 18; + replication_factor = 2; + consistency_mode = "degraded"; + metadata_fsync = false; + data_fsync = false; + allow_world_readable_secrets = true; + + metadata_dir = "/mnt/silo/garage/meta"; + data_dir = "/mnt/silo/garage/data"; + + rpc_bind_addr = "[::]:${toString config.ports.garage.rpc}"; + rpc_public_addr = "${config.snownet.currentHost.ipv6}:${toString config.ports.garage.rpc}"; + rpc_secret_file = config.sops.secrets."garage/rpc_secret".path; + # rpc_public_addr_subnet = "fdd8:e380:437e::/112"; + + bootstrap_peers = [ ]; + + s3_api = { + api_bind_addr = "[::]:${toString config.ports.garage.s3_api}"; + s3_region = "Europe-1"; + root_domain = "s3.mrsnowy.dev"; + }; + + s3_web = { + bind_addr = "[::]:${toString config.ports.garage.web_api}"; + index = "index.html"; + root_domain = "garage.mrsnowy.dev"; + }; + + admin = { + api_bind_addr = "[::]:${toString config.ports.garage.admin}"; + admin_token_file = config.sops.secrets."garage/admin_token".path; + metrics_token_file = config.sops.secrets."garage/metrics_token".path; + metrics_require_token = true; + }; + + # k2v_api = { + # api_bind_addr = "[::]:3904"; + # }; + }; + }; + + # systemd.services.garage.serviceConfig = { + # # Dynamicuser = false; + # }; +} diff --git a/hosts/homelab/services/samba.nix b/hosts/homelab/services/samba.nix new file mode 100644 index 0000000..831fd04 --- /dev/null +++ b/hosts/homelab/services/samba.nix @@ -0,0 +1,56 @@ +{ + config, + # pkgs, + ... +}: +{ + # for Web Services Dynamic Discovery host daemon. + services.samba-wsdd = { + enable = true; + openFirewall = true; + }; + + # samba + services.samba = { + enable = true; + openFirewall = true; + settings = { + global = { + security = "user"; + }; + # public = { }; + private = { + "path" = "/mnt/silo/samba/private"; + "browsable" = "yes"; + "comment" = "Private share"; + "read only" = "no"; + "guest ok" = "no"; + "valid users" = "samba_user"; + }; + }; + }; + + users = { + groups.samba_user = { }; + users.samba_user = { + description = "samba user for the private samba share"; + group = "samba_user"; + isSystemUser = true; + }; + }; + + system.activationScripts = { + # The "init_smbpasswd" script name is arbitrary, but a useful label for tracking + # failed scripts in the build output. An absolute path to smbpasswd is necessary + # as it is not in $PATH in the activation script's environment. The password + # is repeated twice with newline characters as smbpasswd requires a password + # confirmation even in non-interactive mode where input is piped in through stdin. + init_samba_user_smbpasswd.text = '' + /run/current-system/sw/bin/printf "$(/run/current-system/sw/bin/cat ${ + config.sops.secrets."samba/samba_user".path + })\n$(/run/current-system/sw/bin/cat ${ + config.sops.secrets."samba/samba_user".path + })\n" | /run/current-system/sw/bin/smbpasswd -sa samba_user + ''; + }; +} diff --git a/hosts/homelab/system/configuration.nix b/hosts/homelab/system/configuration.nix index 38a01e2..e7d9dbc 100644 --- a/hosts/homelab/system/configuration.nix +++ b/hosts/homelab/system/configuration.nix @@ -18,26 +18,6 @@ ./services.nix ]; - virtualisation.vmVariant.virtualisation = { - memorySize = 4096; - cores = 4; - forwardPorts = [ - { - from = "host"; - proto = "tcp"; - host = { - port = 2222; - }; - guest = { - port = 22; - }; - } - ]; - qemu.guestAgent.enable = true; - useEFIBoot = false; - diskSize = 15360; - }; - # Enable zram (compressed ram) zramSwap = { enable = true; @@ -80,7 +60,13 @@ boot = { enableContainers = true; - kernelModules = [ ]; + kernelModules = [ + "wireguard" + + # docker + "xt_tcp" + "overlay2" + ]; supportedFilesystems = [ "zfs" @@ -105,9 +91,9 @@ }; }; - # zfs = { - # enabled = true; - # }; + zfs = { + extraPools = [ "silo" ]; + }; blacklistedKernelModules = [ # Obscure network protocols @@ -143,25 +129,39 @@ time.timeZone = "Europe/Berlin"; # Set your time zone. i18n.defaultLocale = "en_US.UTF-8"; # Select internationalisation properties. + # man pages good + documentation = { + enable = true; + man.enable = true; + }; + environment = { defaultPackages = [ ]; # Disable any default installed packages systemPackages = with pkgs; [ + waypipe + fastfetch - wget btop dysk + gdu git helix + tree + eza + erdtree + zellij + + smartmontools ]; }; fonts = { fontconfig.enable = false; - packages = with pkgs; [ - monocraft - ]; + # packages = with pkgs; [ + # monocraft + # ]; }; system = { @@ -185,8 +185,8 @@ }; security = { - lockKernelModules = true; - protectKernelImage = true; + lockKernelModules = false; + protectKernelImage = false; # use sudo-rs instead of sudo sudo.enable = false; @@ -209,6 +209,7 @@ shell = pkgs.fish; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL2za6psnuIMZ6FrdUehhyQlqYvy05+wv8dKER+Lctna snowy@Snowflake" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOPNLNK5h3nZ2UQO8ElWTA7E0j1iC8FlJFDudo6QgfWC u0_a231@localhost" ]; }; @@ -216,6 +217,7 @@ shell = pkgs.fish; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL2za6psnuIMZ6FrdUehhyQlqYvy05+wv8dKER+Lctna snowy@Snowflake" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOPNLNK5h3nZ2UQO8ElWTA7E0j1iC8FlJFDudo6QgfWC u0_a231@localhost" ]; }; }; diff --git a/hosts/homelab/system/network.nix b/hosts/homelab/system/network.nix index 668e2ca..2ffc6fc 100644 --- a/hosts/homelab/system/network.nix +++ b/hosts/homelab/system/network.nix @@ -3,6 +3,7 @@ networking = { hostName = "snowlab"; hostId = "2c77257e"; + useNetworkd = true; # Some good default dns servers nameservers = [ @@ -37,6 +38,15 @@ 443 ]; }; - }; + + # networking.nftables.ruleset = '' + # table inet filter { + # chain input { + # type filter hook input priority -100; policy accept; + + # tcp dport ${toString config.ports.garage.rpc} log prefix "GARAGE_RPC_DENIED: " reject + # } + # } + # ''; } diff --git a/hosts/server/default.nix b/hosts/server/default.nix index 020ae03..6f54bf9 100644 --- a/hosts/server/default.nix +++ b/hosts/server/default.nix @@ -30,8 +30,10 @@ ./containers ./services - ../../sops args.flakes.home-manager.nixosModules.home-manager + + ../../modules/sops/vps.nix + ../../modules/snownet ]; } diff --git a/hosts/server/services/broadcastbox.nix b/hosts/server/services/broadcastbox.nix new file mode 100644 index 0000000..5acf49f --- /dev/null +++ b/hosts/server/services/broadcastbox.nix @@ -0,0 +1,19 @@ +{ + config, + ... +}: +{ + services.broadcast-box = { + enable = true; + openFirewall = true; + web.port = config.ports.broadcast_box; + + settings = { + UDP_MUX_PORT = 9070; + INCLUDE_PUBLIC_IP_IN_NAT_1_TO_1_IP = true; + STUN_SERVERS = "stun.l.google.com"; + NETWORK_TEST_ON_START = false; + DISABLE_STATUS = false; + }; + }; +} diff --git a/hosts/server/services/caddy.nix b/hosts/server/services/caddy.nix index 3ee6d63..92b93b8 100644 --- a/hosts/server/services/caddy.nix +++ b/hosts/server/services/caddy.nix @@ -1,21 +1,25 @@ { config, + lib, ... }: -let - hestia_ip = "10.0.100.65"; -in +# let +# hestia_ip = "10.0.100.65"; +# in { services.caddy = { enable = true; + logFormat = lib.mkForce "level DEBUG"; globalConfig = '' ''; extraConfig = '' mail.mrsnowy.dev, fpps4.net, www.paradijs-in-hongarije.nl, paradijs-in-hongarije.nl, smarty.nl, www.zendojaku.nl, zendojaku.nl { - reverse_proxy https://${hestia_ip} { - transport http { + reverse_proxy https://hestia.local { + header_up Host {host} + + transport http { tls_insecure_skip_verify } } @@ -56,7 +60,8 @@ in } hestia.mrsnowy.dev { - reverse_proxy https://${hestia_ip}:8083 { + reverse_proxy https://hestia.local:8083 { + header_up Host {host} transport http { tls_insecure_skip_verify } @@ -66,7 +71,8 @@ in api.fpps4.net { encode zstd gzip - reverse_proxy https://${hestia_ip} { + reverse_proxy https://hestia.local { + header_up Host {host} transport http { tls_insecure_skip_verify } @@ -132,13 +138,13 @@ in reverse_proxy :${toString config.ports.ente.embed} } - minio.ente.mrsnowy.dev { - reverse_proxy :${toString config.ports.ente.minio.api} - } + # minio.ente.mrsnowy.dev { + # reverse_proxy :${toString config.ports.ente.minio.api} + # } - minio-web.ente.mrsnowy.dev { - reverse_proxy :${toString config.ports.ente.minio.web} - } + # minio-web.ente.mrsnowy.dev { + # reverse_proxy :${toString config.ports.ente.minio.web} + # } headscale.mrsnowy.dev { reverse_proxy :${toString config.ports.headscale} @@ -153,10 +159,44 @@ in } *.s3.mrsnowy.dev, s3.mrsnowy.dev { - reverse_proxy :${toString config.ports.garage.s3_api} - # header { - # Access-Control-Allow-Origin * - # } + tls { + ciphers TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 + } + + @h2 protocol h1 + reverse_proxy :${toString config.ports.garage.s3_api} { + flush_interval -1 # low-latency mode + # request_body { + # max_size 5GB # raise for large object uploads + # } + # + + transport http { + keepalive_idle_conns_per_host 0 + read_buffer 1MiB + write_buffer 1MiB + compression off + # versions 1.1 + } + } + } + + http://s4.mrsnowy.dev { + + reverse_proxy :${toString config.ports.garage.s3_api} { + flush_interval -1 # low-latency mode + # request_body { + # max_size 5GB # raise for large object uploads + # } + # + + transport http { + keepalive_idle_conns_per_host 0 + read_buffer 1MiB + write_buffer 1MiB + compression off + } + } } ''; }; diff --git a/hosts/server/services/default.nix b/hosts/server/services/default.nix index 8a80260..1ada587 100644 --- a/hosts/server/services/default.nix +++ b/hosts/server/services/default.nix @@ -5,5 +5,6 @@ ./caddy.nix ./garage.nix ./postgres.nix + ./broadcastbox.nix ]; } diff --git a/hosts/server/services/garage.nix b/hosts/server/services/garage.nix index a927c1c..1b0c73d 100644 --- a/hosts/server/services/garage.nix +++ b/hosts/server/services/garage.nix @@ -10,11 +10,11 @@ package = pkgs.garage_2; settings = { db_engine = "sqlite"; - compression_level = 18; - replication_factor = 1; - consistency_mode = "consistent"; - metadata_fsync = true; - data_fsync = true; + compression_level = 0; + replication_factor = 2; + consistency_mode = "degraded"; + metadata_fsync = false; + data_fsync = false; allow_world_readable_secrets = true; data_dir = [ @@ -24,8 +24,8 @@ } ]; - rpc_bind_addr = "[::]:3901"; - # rpc_public_addr = "127.0.0.1:3901"; + rpc_bind_addr = "[::]:${toString config.ports.garage.rpc}"; + rpc_public_addr = "${config.snownet.currentHost.ipv6}:${toString config.ports.garage.rpc}"; rpc_secret_file = config.sops.secrets."garage/rpc_secret".path; bootstrap_peers = [ ]; diff --git a/hosts/server/services/postgres.nix b/hosts/server/services/postgres.nix index 68eb9ad..37b0015 100644 --- a/hosts/server/services/postgres.nix +++ b/hosts/server/services/postgres.nix @@ -1,11 +1,13 @@ { config, pkgs, + lib, ... }: { services = { + postgresql = { enable = true; package = pkgs.postgresql_18; @@ -32,8 +34,6 @@ #type database user address auth-method [auth-options] host ente_db ente localhost scram-sha-256 ''; - - initialScript = config.sops.secrets.postgres_sql.path; }; postgresqlBackup = { @@ -47,4 +47,8 @@ }; }; + # Hijack the systemd service to add our custom script in :P + systemd.services.postgresql-setup.script = lib.mkAfter '' + psql -f "${config.sops.secrets.postgres_sql.path}" -d postgres + ''; } diff --git a/hosts/server/services/random.nix b/hosts/server/services/random.nix index d24104d..4b024f7 100644 --- a/hosts/server/services/random.nix +++ b/hosts/server/services/random.nix @@ -15,7 +15,7 @@ authorizedKeysInHomedir = false; settings = { PasswordAuthentication = false; - AllowTcpForwarding = false; + AllowTcpForwarding = true; TCPKeepAlive = false; PermitRootLogin = "no"; MaxAuthTries = 3; @@ -76,6 +76,15 @@ # }; # }; - tailscale.enable = true; + tailscale = { + enable = true; + extraSetFlags = [ + "--advertise-exit-node" + ]; + }; }; + + systemd.services.tailscaled.serviceConfig.Environment = [ + "TS_DEBUG_FIREWALL_MODE=nftables" + ]; } diff --git a/hosts/server/system/configuration.nix b/hosts/server/system/configuration.nix index b48f278..09fb487 100644 --- a/hosts/server/system/configuration.nix +++ b/hosts/server/system/configuration.nix @@ -56,9 +56,13 @@ # Use grub so it works on both EFI and BOOT boot = { + # prevent system waiting on networking + initrd.systemd.network.wait-online.enable = false; + enableContainers = true; # kernelPackages = pkgs.linuxKernel.packages.linux_hardened; kernelModules = [ + "wireguard" # "overlay2" ]; @@ -154,6 +158,8 @@ # wget btop dysk + zellij + gdu ]; }; @@ -182,7 +188,7 @@ }; security = { - lockKernelModules = true; + lockKernelModules = false; protectKernelImage = true; # auditd = { @@ -223,6 +229,8 @@ virtualisation = { docker = { + storageDriver = "overlay2"; + autoPrune.enable = true; rootless = { enable = true; setSocketVariable = true; @@ -280,6 +288,9 @@ }; systemd = { + # Dont make the system wait on networking... + network.wait-online.enable = false; + # Make docker only run for the "snow" user. user.services.docker.unitConfig.ConditionUser = lib.mkForce "snow"; }; diff --git a/hosts/server/system/hardware-configuration.nix b/hosts/server/system/hardware-configuration.nix index d74c3da..5c43cfe 100644 --- a/hosts/server/system/hardware-configuration.nix +++ b/hosts/server/system/hardware-configuration.nix @@ -4,7 +4,6 @@ { config, lib, - pkgs, modulesPath, ... }: diff --git a/hosts/server/system/network.nix b/hosts/server/system/network.nix index cacf483..0f1ad01 100644 --- a/hosts/server/system/network.nix +++ b/hosts/server/system/network.nix @@ -1,8 +1,13 @@ -{ ... }: +{ config, ... }: { networking = { hostName = "snow-den"; domain = "mrsnowy.dev"; + useNetworkd = true; + + hosts = { + "10.0.100.65" = [ "hestia.local" ]; + }; nameservers = [ # Mullvad @@ -34,6 +39,48 @@ }; }; + # wireguard = { + # enable = true; + # interfaces = { + # # network interface name. + # # You can name the interface arbitrarily. + # snownet0 = { + # # meow + # # fdd8:e380:437e::/48 + # ips = [ + # "fdd8:e380:437e::1/128" + # "100.0.10.1/32" + # ]; + + # listenPort = 51820; + + # privateKeyFile = config.sops.secrets."wireguard/key".path; + + # peers = [ + # { + # name = "snowlab"; + # # publicKey = "ejmbag/fcc9OLp8K62zfV0NCbp056DnA0qpNixLXwCo="; + # publicKey = "otQG6qBjzt/yjqdLtiCM0M5P8eljpywmGe95bEajNjY"; + # presharedKeyFile = config.sops.secrets."wireguard/snowlab_pre".path; + # allowedIPs = [ + # "fdd8:e380:437e::2/128" + # "100.0.10.2/32" + # ]; + # # endpoint = "192.168.1.56:51820"; + # # ToDo: route to endpoint not automatically configured + # # https://wiki.archlinux.org/index.php/WireGuard#Loop_routing + # # https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 + # # Send keepalives every 25 seconds. Important to keep NAT tables alive. + # persistentKeepalive = 25; + # } + # ]; + # }; + # }; + # }; + # it’s not imperative but it does not know how to do it : + # sudo ip route add 11.111.11.111 via 192.168.1.11 dev wlo1 + # the ip adresse 11: external and 192: local. + # interfaces = { # ens18 = { # ipv4 = { @@ -49,8 +96,10 @@ firewall = { enable = true; + checkReversePath = "loose"; trustedInterfaces = [ "hestia-bridge" + "tailscale0" ]; # extraCommands = '' @@ -67,6 +116,8 @@ 335 665 + config.ports.garage.s3_api + # LXD 8443 @@ -95,6 +146,9 @@ 7777 8888 + # meow + 9999 + # VALHEIM 2456 2457 @@ -113,6 +167,13 @@ 80 443 + # wireguard + 51820 + 51826 + + # tailscale + config.services.tailscale.port + # mumble 64738 @@ -130,16 +191,47 @@ 27015 27016 + 25565 + 25564 + # mc 41448 8100 ]; }; + nftables = { + ruleset = '' + table ip nat { + chain PREROUTING { + type nat hook prerouting priority dstnat; policy accept; + iifname "ens3" udp dport 9999 dnat to 100.126.229.18:7777 + # iifname "ens3" tcp dport 27765 dnat to 10.0.20.2:25565 + } + + chain OUTPUT { + type nat hook output priority dstnat; policy accept; + udp dport 9999 dnat to 100.126.229.18:7777 + # tcp dport 27765 dnat to 10.0.20.2:25565 + } + + chain POSTROUTING { + type nat hook postrouting priority srcnat; policy accept; + oifname "tailscale0" masquerade + # oifname "rawrsnet0" masquerade + } + } + ''; + }; + nat = { enable = true; # internalInterfaces = [ "hestia-bridge" ]; externalInterface = "ens3"; + internalInterfaces = [ + "tailscale0" + "hestia-bridge" + ]; # externalInterface = "wg0"; forwardPorts = [ # SSH @@ -150,16 +242,16 @@ } # meow ;3 - { - sourcePort = 7777; - proto = "tcp"; - destination = "100.126.229.18:7777"; - } - { - sourcePort = 7777; - proto = "udp"; - destination = "100.126.229.18:7777"; - } + # { + # sourcePort = 9999; + # proto = "tcp"; + # destination = "100.126.229.18:7777"; + # } + # { + # sourcePort = 9999; + # proto = "udp"; + # destination = "100.126.229.18:7777"; + # } # IMAP { diff --git a/hosts/server/system/ports.nix b/hosts/server/system/ports.nix index 958eebe..c242f7d 100644 --- a/hosts/server/system/ports.nix +++ b/hosts/server/system/ports.nix @@ -30,6 +30,7 @@ s3_api = 3014; web_api = 3015; admin = 3016; + rpc = 3901; }; syncthing = 3020; diff --git a/justfile b/justfile index 6ea107c..4d9d143 100644 --- a/justfile +++ b/justfile @@ -1,8 +1,36 @@ +# deploy target: +# nh os switch --file ./default.nix hosts.{{ target }} --target-host {{ target }} --build-host {{ target }} + +set shell := ["bash", "-c"] + deploy target: - nh os switch --file ./default.nix hosts.{{ target }} --target-host {{ target }} --build-host {{ target }} + nixos-rebuild switch --file ./default.nix -A hosts.{{ target }} --target-host {{ target }} --build-host {{ target }} --sudo |& nom + # preview {{ target }} + + # nixos-rebuild switch --store-path xxx --target-host {{ target }} --build-host {{ target }} --sudo &| nom + +preview target: + #!/usr/bin/env bash + nixos-rebuild build --file ./default.nix -A hosts.{{ target }} --target-host {{ target }} --build-host {{ target }} --no-flake | tee /tmp/build |& nom + export build=$(cat /tmp/build) + ssh {{ target }} "nix run nixpkgs#dix -- --color always /run/current-system $build" + + read -p "Continue deploying? (y/n)\n" ans + if [[ "$ans" = "y" ]]; then + # ssh {{ target }} "nixos-rebuild switch --store-path $build --sudo" + nixos-rebuild switch --target-host {{ target }} --build-host {{ target }} --sudo + fi deploy-homelab: - nh os switch --file ./default.nix hosts.home-server --target-host root@snowlab.local --build-host root@snowlab.local + nixos-rebuild switch --file ./default.nix -A hosts.home-server --target-host root@snowlab.local --build-host root@snowlab.local |& nom deploy-server: nh os switch --file ./default.nix hosts.server --target-host server --build-host server + +wireguard_gen: + #!/usr/bin/env nix-shell + #!nix-shell -i bash -p wireguard-tools + key=$(wg genkey) + pub=$(echo $key | wg pubkey) + psk=$(wg genpsk) + echo -e "key: $key\npub: $pub\npsk: $psk" diff --git a/lib/default.nix b/modules/lib/default.nix similarity index 100% rename from lib/default.nix rename to modules/lib/default.nix diff --git a/npins/default.nix b/modules/npins/default.nix similarity index 100% rename from npins/default.nix rename to modules/npins/default.nix diff --git a/npins/sources.json b/modules/npins/sources.json similarity index 57% rename from npins/sources.json rename to modules/npins/sources.json index a3d008d..432f35f 100644 --- a/npins/sources.json +++ b/modules/npins/sources.json @@ -14,6 +14,19 @@ "url": "https://git.lix.systems/lix-project/flake-compat/archive/549f2762aebeff29a2e5ece7a7dc0f955281a1d1.tar.gz", "hash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=" }, + "helium": { + "type": "Git", + "repository": { + "type": "GitHub", + "owner": "amaanq", + "repo": "helium-flake" + }, + "branch": "master", + "submodules": false, + "revision": "9d3ef138f70b3540397320d25ead6aa96101371d", + "url": "https://github.com/amaanq/helium-flake/archive/9d3ef138f70b3540397320d25ead6aa96101371d.tar.gz", + "hash": "sha256-OxeMEMxRJ6dF3UGXVJoNRwxU/F1nOVbdcyX9n8S3Mxk=" + }, "hjem": { "type": "Git", "repository": { @@ -23,9 +36,9 @@ }, "branch": "main", "submodules": false, - "revision": "9d0c8d4b44f661910595b07e6480557644c1431c", - "url": "https://github.com/feel-co/hjem/archive/9d0c8d4b44f661910595b07e6480557644c1431c.tar.gz", - "hash": "sha256-cKETEBrseo7Iz+bOzflwy1xTpDuUj3QaLA+P49yJw8k=" + "revision": "4d0d0e4dc99245ffaa0d51acf69e288fb59fb0f1", + "url": "https://github.com/feel-co/hjem/archive/4d0d0e4dc99245ffaa0d51acf69e288fb59fb0f1.tar.gz", + "hash": "sha256-bPTW00Tkp8c7HJbhNC7wLO3fcngFXBpuX7LZByE/F8c=" }, "hjem-rum": { "type": "Git", @@ -36,9 +49,9 @@ }, "branch": "main", "submodules": false, - "revision": "edac54b7d57ad72cc4b124da2f44e7b2e584f3c6", - "url": "https://github.com/snugnug/hjem-rum/archive/edac54b7d57ad72cc4b124da2f44e7b2e584f3c6.tar.gz", - "hash": "sha256-P+59TbVusYqdx2Jt2liwvQ+hslUzU6M1ezRDy6c66Tc=" + "revision": "3506a77b5cbb35640f7dac595f98b10bdbe07b15", + "url": "https://github.com/snugnug/hjem-rum/archive/3506a77b5cbb35640f7dac595f98b10bdbe07b15.tar.gz", + "hash": "sha256-xM7gYCLOUH2fnPgdst7HcPpEn6GlEOf7nelJVxJZ040=" }, "home-manager": { "type": "Git", @@ -49,35 +62,22 @@ }, "branch": "release-25.11", "submodules": false, - "revision": "366d78c2856de6ab3411c15c1cb4fb4c2bf5c826", - "url": "https://github.com/nix-community/home-manager/archive/366d78c2856de6ab3411c15c1cb4fb4c2bf5c826.tar.gz", - "hash": "sha256-tNqCP/+2+peAXXQ2V8RwsBkenlfWMERb+Uy6xmevyhM=" + "revision": "5c0f63f8d55040a7eed69df7e3fcdd15dfb5a04c", + "url": "https://github.com/nix-community/home-manager/archive/5c0f63f8d55040a7eed69df7e3fcdd15dfb5a04c.tar.gz", + "hash": "sha256-rK0507bDuWBrZo+0zts9bCs/+RRUEHuvFE5DHWPxX/Q=" }, "nix-gaming-edge": { "type": "Git", "repository": { "type": "GitHub", - "owner": "MrSn0wy", + "owner": "powerofthe69", "repo": "nix-gaming-edge" }, "branch": "nightly", "submodules": false, - "revision": "cbf0780954e15ef909140773eeb92370237655eb", - "url": "https://github.com/MrSn0wy/nix-gaming-edge/archive/cbf0780954e15ef909140773eeb92370237655eb.tar.gz", - "hash": "sha256-o6VHnCp6E8aFkEF7jTAnw/cBJ3T3z1eNNTUhDF6l7AY=" - }, - "nix-index-database": { - "type": "Git", - "repository": { - "type": "GitHub", - "owner": "nix-community", - "repo": "nix-index-database" - }, - "branch": "main", - "submodules": false, - "revision": "82befcf7dc77c909b0f2a09f5da910ec95c5b78f", - "url": "https://github.com/nix-community/nix-index-database/archive/82befcf7dc77c909b0f2a09f5da910ec95c5b78f.tar.gz", - "hash": "sha256-d3NBA9zEtBu2JFMnTBqWj7Tmi7R5OikoU2ycrdhQEws=" + "revision": "a6644fdb35fb66e3f15ed1ce5dd5e56ea64ddf06", + "url": "https://github.com/powerofthe69/nix-gaming-edge/archive/a6644fdb35fb66e3f15ed1ce5dd5e56ea64ddf06.tar.gz", + "hash": "sha256-aKwGEGa3UffChR91GNkk/TnVNXWQth8mmZATAgrG0Yc=" }, "nixpkgs-stable": { "type": "Git", @@ -88,9 +88,9 @@ }, "branch": "nixos-25.11", "submodules": false, - "revision": "fa83fd837f3098e3e678e6cf017b2b36102c7211", - "url": "https://github.com/NixOS/nixpkgs/archive/fa83fd837f3098e3e678e6cf017b2b36102c7211.tar.gz", - "hash": "sha256-e7VO/kGLgRMbWtpBqdWl0uFg8Y2XWFMdz0uUJvlML8o=" + "revision": "3e20095fe3c6cbb1ddcef89b26969a69a1570776", + "url": "https://github.com/NixOS/nixpkgs/archive/3e20095fe3c6cbb1ddcef89b26969a69a1570776.tar.gz", + "hash": "sha256-SEzUWw2Rf5Ki3bcM26nSKgbeoqi2uYy8IHVBqOKjX3w=" }, "nixpkgs-unstable": { "type": "Git", @@ -101,9 +101,9 @@ }, "branch": "nixos-unstable", "submodules": false, - "revision": "bfc1b8a4574108ceef22f02bafcf6611380c100d", - "url": "https://github.com/NixOS/nixpkgs/archive/bfc1b8a4574108ceef22f02bafcf6611380c100d.tar.gz", - "hash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=" + "revision": "c06b4ae3d6599a672a6210b7021d699c351eebda", + "url": "https://github.com/NixOS/nixpkgs/archive/c06b4ae3d6599a672a6210b7021d699c351eebda.tar.gz", + "hash": "sha256-wvfdLLWJ2I9oEpDd9PfMA8osfIZicoQ5MT1jIwNs9Tk=" }, "sops-nix": { "type": "Git", @@ -114,9 +114,9 @@ }, "branch": "master", "submodules": false, - "revision": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff", - "url": "https://github.com/Mic92/sops-nix/archive/c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff.tar.gz", - "hash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=" + "revision": "d1ff3b1034d5bab5d7d8086a7803c5a5968cd784", + "url": "https://github.com/Mic92/sops-nix/archive/d1ff3b1034d5bab5d7d8086a7803c5a5968cd784.tar.gz", + "hash": "sha256-M3zEnq9OElB7zqc+mjgPlByPm1O5t2fbUrH3t/Hm5Ag=" }, "wire": { "type": "Git", @@ -140,9 +140,9 @@ }, "branch": "main", "submodules": false, - "revision": "e97c8e719c7e2567ccf86d279f73ade1dbf72373", - "url": "https://github.com/0xc000022070/zen-browser-flake/archive/e97c8e719c7e2567ccf86d279f73ade1dbf72373.tar.gz", - "hash": "sha256-wD3QwqGZ1cqZDkDQanwy3HgoVL4Dooqlgta3jOu3Mng=" + "revision": "9346698c4562819f61b4e5097151ec0b17729fab", + "url": "https://github.com/0xc000022070/zen-browser-flake/archive/9346698c4562819f61b4e5097151ec0b17729fab.tar.gz", + "hash": "sha256-L1yMYmFffHfZNP+hKJGRBmrFKkn/VDhu7jEbVftBQuM=" } }, "version": 7 diff --git a/modules/snownet/default.nix b/modules/snownet/default.nix new file mode 100644 index 0000000..c279a81 --- /dev/null +++ b/modules/snownet/default.nix @@ -0,0 +1,177 @@ +{ + lib, + config, + pkgs, + ... +}: + +let + ipv6_sub = "fdd8:e380:437e"; + ipv4_sub = "10.0.10"; + interface = "snownet0"; + + hosts = + lib.mapAttrs + ( + name: value: + value + // { + ipv6 = "${ipv6_sub}::${value.id}"; + ipv4 = "${ipv4_sub}.${value.id}"; + endpoint = if value ? endpoint then value.endpoint else null; # set a default val for endpoint + } + ) + { + "snow-den" = { + id = "1"; + endpoint = "[2a0a:4cc0:0:1eb::c0ff:ee]:51820"; + PublicKey = "lAmtCO55kZjkiH4NKBdlSQYtIvvAp6qKDH0mjw7R2iM="; + PrivateKeyFile = config.sops.secrets.wireguard_key.path; + }; + "snowlab" = { + id = "2"; + PublicKey = "otQG6qBjzt/yjqdLtiCM0M5P8eljpywmGe95bEajNjY="; + PrivateKeyFile = config.sops.secrets.wireguard_key.path; + }; + "snowflake" = { + id = "3"; + PublicKey = "V+hXqlL1Rybl02PfkGObyW0A1l/UhETSeRvTQ0SG2nk="; + PrivateKeyFile = config.sops.secrets.wireguard_key.path; + }; + }; + + preshared_keys = { + "snow-den_snowlab" = config.sops.secrets.snow-den_snowlab.path; + "snow-den_snowflake" = config.sops.secrets.snow-den_snowflake.path; + "snowlab_snowflake" = config.sops.secrets.snowlab_snowflake.path; + }; + + peers = lib.removeAttrs hosts [ config.networking.hostName ]; + currentHost = hosts."${config.networking.hostName}"; + + cfg = config.snownet; + +in +{ + options.snownet = { + enable = lib.mkOption { + default = true; + example = false; + description = "Whether to enable the snownet."; + type = lib.types.bool; + }; + + currentHost = lib.mkOption { + type = lib.types.attrs; + readOnly = true; + default = currentHost; + }; + + ipv4_subnet = lib.mkOption { + type = lib.types.str; + readOnly = true; + default = ipv4_sub; + }; + + ipv6_subnet = lib.mkOption { + type = lib.types.str; + readOnly = true; + default = ipv6_sub; + }; + + interface = lib.mkOption { + type = lib.types.str; + readOnly = true; + default = interface; + }; + }; + + ###### implementation + + config = lib.mkIf cfg.enable { + environment.systemPackages = [ + pkgs.wireguard-tools + ]; + + # Add some common rules for inside of the snownet + networking.firewall.extraInputRules = '' + iifname ${toString cfg.interface} tcp dport ${toString config.ports.garage.rpc} accept comment "Trusted ${toString cfg.interface} connection" + ''; + + # nftables is pretty blackmagic + networking.nftables.ruleset = '' + table inet filter { + chain prerouting { + type filter hook prerouting priority raw ; policy accept ; + + iifname != { "${cfg.interface}", "lo" } ip saddr ${cfg.ipv4_subnet}.0/24 log prefix "SPOOF-V4-DROP: " drop + iifname != { "${cfg.interface}", "lo" } ip6 saddr ${cfg.ipv6_subnet}::/112 log prefix "SPOOF-V6-DROP: " drop + } + } + ''; + + networking.hosts = lib.concatMapAttrs (name: value: { + "${value.ipv6}" = [ "${name}.mrsnowy.dev" ]; + "${value.ipv4}" = [ "${name}.mrsnowy.dev" ]; + }) peers; + + systemd.network = { + # add "snownet" wireguard interface + networks."50-${cfg.interface}" = { + matchConfig.Name = cfg.interface; + + address = [ + "${currentHost.ipv6}/112" + "${currentHost.ipv4}/24" + ]; + }; + + # add "snownet wireguard netdev + netdevs."50${cfg.interface}" = { + netdevConfig = { + Kind = "wireguard"; + Name = cfg.interface; + }; + + wireguardConfig = { + ListenPort = 51820; + + # ensure file is readable by `systemd-network` user + PrivateKeyFile = currentHost.PrivateKeyFile; + + # To automatically create routes for everything in AllowedIPs, + RouteTable = "main"; + + # FirewallMark marks all packets send and received by wg0 + # with the number 42, which can be used to define policy rules on these packets. + # FirewallMark = 42; + }; + + # Add the wireguard peers in the snownet + wireguardPeers = ( + lib.mapAttrsToList ( + name: value: + { + PublicKey = value.PublicKey; + + PresharedKeyFile = + preshared_keys."${config.networking.hostName}_${name}" + or preshared_keys."${name}_${config.networking.hostName}"; + + AllowedIPs = [ + "${value.ipv6}/128" + "${value.ipv4}/32" + ]; + + PersistentKeepalive = 25; + } + // lib.optionalAttrs (value ? endpoint && value.endpoint != null) { + Endpoint = value.endpoint; + } + ) peers + ); + }; + }; + }; + +} diff --git a/modules/sops/.sops.yaml b/modules/sops/.sops.yaml new file mode 100644 index 0000000..7cd7a22 --- /dev/null +++ b/modules/sops/.sops.yaml @@ -0,0 +1,84 @@ +# This example uses YAML anchors which allows reuse of multiple keys +# without having to repeat yourself. +# Also see https://github.com/Mic92/dotfiles/blob/d6114726d859df36ccaa32891c4963ae5717ef7f/nixos/.sops.yaml +# for a more complex example. +keys: + - &admin_snowyboo D40CE1579C09BFD7EF4AB7E631250420834310B5 + - &root_vps age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg + - &root_homelab age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0 + - &root_snowflake age1qqex87tl6kq68hszp66z49n95zurcxcvveumpxjvh5w2yhx8g47q5s24ya + +creation_rules: + - path_regex: \.pub$ + key_groups: + - pgp: + - *admin_snowyboo + age: + - *root_vps + - *root_homelab + - *root_snowflake + + - path_regex: \.pub$ + key_groups: + - pgp: + - *admin_snowyboo + age: + - *root_vps + - *root_homelab + - *root_snowflake + + - path_regex: garage/.*\.(yaml)$ + key_groups: + - pgp: + - *admin_snowyboo + age: + - *root_vps + - *root_homelab + + - path_regex: psk/snow-den_snowflake\.key + key_groups: + - pgp: + - *admin_snowyboo + age: + - *root_vps + - *root_snowflake + + - path_regex: psk/snowlab_snowflake\.key + key_groups: + - pgp: + - *admin_snowyboo + age: + - *root_homelab + - *root_snowflake + + - path_regex: ^all/.*$ + key_groups: + - pgp: + - *admin_snowyboo + age: + - *root_vps + - *root_homelab + - *root_snowflake + - path_regex: ^vps/.*$ + key_groups: + - pgp: + - *admin_snowyboo + age: + - *root_vps + - path_regex: ^homelab/.*$ + key_groups: + - pgp: + - *admin_snowyboo + age: + - *root_homelab + + - path_regex: ^snowflake/.*$ + key_groups: + - pgp: + - *admin_snowyboo + age: + - *root_snowflake + + # - key_groups: + # - pgp: + # - *admin_snowyboo diff --git a/modules/sops/all/default.nix b/modules/sops/all/default.nix new file mode 100644 index 0000000..519ac2c --- /dev/null +++ b/modules/sops/all/default.nix @@ -0,0 +1,44 @@ +{ + # config, + # lib, + # pkgs, + args, + ... +}: + +# Nix secrets hehe :3 +{ + imports = [ + args.flakes.sops-nix.nixosModules.sops + ]; + + sops = { + age.generateKey = false; + + secrets = { + wireguard_snowlab_pub = { + format = "binary"; + sopsFile = ../homelab/wireguard.pub; + + mode = "0400"; + owner = "systemd-network"; + }; + + wireguard_snow-den_pub = { + format = "binary"; + sopsFile = ../vps/wireguard.pub; + + mode = "0400"; + owner = "systemd-network"; + }; + + wireguard_snowflake_pub = { + format = "binary"; + sopsFile = ../snowflake/wireguard.pub; + + mode = "0400"; + owner = "systemd-network"; + }; + }; + }; +} diff --git a/modules/sops/all/default.yaml b/modules/sops/all/default.yaml new file mode 100644 index 0000000..d4a664c --- /dev/null +++ b/modules/sops/all/default.yaml @@ -0,0 +1,50 @@ +#ENC[AES256_GCM,data:6mNsfa7CFk85yw==,iv:1+mG8GGysHrgJlXhfbrYugcFhz+gBg4KaPNCevrWdkI=,tag:WfWop9TbknHElJ2yQVooOA==,type:comment] +wireguard: + snowden_pub: ENC[AES256_GCM,data:mSmk6wX8YUUm3ELLEJkqB364gIcg4ahRN/TUq+l152+PEsuhIuIZrWiGw/M=,iv:9hj1xYu+W0yl2xqAnFAWEllRZyipU356pzjGGxiWAsU=,tag:uVHOMeuAtSxXsXdKSYywYg==,type:str] + snowlab_pub: ENC[AES256_GCM,data:rOy9hZOdmmCpBnYfjtyiIc1ZDB8lqrb0/6UPE8ZVj1vRt9oBzFyV9gtuChY=,iv:pa+3b5WpRilvaKh124gNK0qv0swKt3qK5fv2HkwEMQw=,tag:doaee3t7uajbUs4wT+0V1A==,type:str] + snowden_snowlab_psk: ENC[AES256_GCM,data:LadonlAz3C58rq4pT60W6Q34n+5dBEGEahkaN/hpkhlwhjogMX/crbH7au4=,iv:f2thDX7xU8b1m/XrCqq95zwS3mBtSMwWMJy5LSoMS1U=,tag:ArgrzoWhox46yJPkLlK5vg==,type:str] +sops: + age: + - recipient: age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQalNYV01GUEkvUEMyb1RH + eXpGS2lRenZsZ3JpN2paamcvb0ZhbWY2TGtnCkE4N1A4YVltZC9xNTV6SGNkdUhw + S0dBR1Y5ZHdpV3JrNnpPcldqK21pb0UKLS0tIFNTN0RqaG1NMEppWlRRcHFCUlkv + bkRXeDErNmEzYlBhM0pSU3VDd0MzYncK8hqlDq3LeXyNFCcyqiW8gpI9uCxxhtMq + 8Qp26G+Okx4TFeVt1MNeP1wBKYykmCewrDMf8jRqaunfX5xX2lma0g== + -----END AGE ENCRYPTED FILE----- + - recipient: age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2aElXeDB3TkZQMGJPbXRv + bGdyQjBjcGg0TE9zOXVMTHBoak5KTzBkUFNRCnZaRkFtR25MQzNCb2VMdkRKQ0k3 + Q1dTUG1uT3o1VjJ2S0hObWRsMUxyNE0KLS0tIEZUMU92WUlCNnltMHlCWDM2UjFZ + NnpjNkFCdHhPMmRLaGExWTJia29pTDgKq8XpdFHMUrvZvSelywiBsXe1c3hBgaC7 + CgCzS/ib0APkcrvZU49WpMEBj8vvA2bACbHdICKPaFYjvRfcRQdDcw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-02-08T01:29:18Z" + mac: ENC[AES256_GCM,data:lH19MAC3bxAL7XVo+xfd7SYKHKZ6//P/VpXNmTRzhgGv1NlO3UpSy5/J+0ACixOphYMQTy1vnqhroi590QBePEQo8m6l8DwMhH1AFXzd98e6waBp/H5e2PnSFdROmhg6To6j4MybdGiANcG5wkgLbrfgIkV57A4JzvZ44bfGbPo=,iv:qnwp7ofkvmO79a1yFU0zApq45VO6fEFnVbJ7IcUBBxo=,tag:/Dd2NkgAJMsRDhonhQeIeg==,type:str] + pgp: + - created_at: "2026-02-06T18:24:46Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQILA09oKgMfawMUAQ/3RgFIkv6I4Y1DgCHHciYYRdEV5j9dyzm+qFYglLhht6C6 + V8WaK2t1P+S8FvArJOUp/dtQDQ470saWlcJTu08a51DSCKSTKnfnJJ4uMtwqvkCj + TCqZtzmPc1g0QsfwnEEXVjeBEd9dZwn8ieZWkP6Vny/lG1RFfXuCLWQSAt8Zzvw4 + bs8wBge9/TSivceuM29EA2g6X13Xy9wks/NMT7kJokGVGrjOGC5R1KQvGOBRxXGz + 4CL/WhnJCitvYPioEqf9Ocv6C8fWdxOQL9jQxLiedx9t6Sv99SbXUTe4zJUMF571 + skbEOt/Jh+8rciorGFIZ4EEVPak0WcLmeGoqUTBLjTYUm9SF7E3K8TWeL/MSoAuL + FFVLOsNMUjt8TraH5GeCosodyb8vR7qv6NGDXoi5Ibt1CsjRyxlDd0JoVW396PoI + 2uRkeDL6qayMlHAgH2qj94IyVQXNPyut1PUK+JpQYf5wEFndHu7OMfsp5TL/7OYt + ytyPFChuCVISd/8fLzrygPkuq24shHazDts5BdXhojNTD5vvWf5/YT7rykwCm+Ex + obu91lWhxCA9TSjylskxy9VZAw6Sn/TSy9/9COWwlVEVVAgXTfEowMOdX5BfdEZc + +GocsYbMjc7L5a2BYmc2YO0nKNhsn9fmyE3v9cnpIVUo4OmOogu78yhqWKxPitJe + Ad6CSHR6ClEM1NffPth0+FH6SiUE7I7q/3YiaRb42cxfS3mrnJZ/K+TCw+06oEQQ + FYQrPMXzzfcB1leUbVZpdEEyGrpGALzQHmTvO2cCG+0UFmLZCV8QFKNLr2G6xw== + =ozhG + -----END PGP MESSAGE----- + fp: D40CE1579C09BFD7EF4AB7E631250420834310B5 + unencrypted_suffix: _unencrypted + version: 3.11.0 diff --git a/modules/sops/garage/default.nix b/modules/sops/garage/default.nix new file mode 100644 index 0000000..ffb0f56 --- /dev/null +++ b/modules/sops/garage/default.nix @@ -0,0 +1,31 @@ +{ + sops.secrets = { + "garage/rpc_secret" = { + mode = "0440"; + group = "sops_garage"; + sopsFile = ./default.yaml; + }; + + "garage/admin_token" = { + mode = "0440"; + group = "sops_garage"; + sopsFile = ./default.yaml; + }; + + "garage/metrics_token" = { + mode = "0440"; + group = "sops_garage"; + sopsFile = ./default.yaml; + }; + }; + + users.groups = { + sops_garage = { }; + }; + + systemd.services = { + garage.serviceConfig.SupplementaryGroups = [ + "sops_garage" + ]; + }; +} diff --git a/modules/sops/garage/default.yaml b/modules/sops/garage/default.yaml new file mode 100644 index 0000000..25aff98 --- /dev/null +++ b/modules/sops/garage/default.yaml @@ -0,0 +1,53 @@ +#ENC[AES256_GCM,data:hRxhcI4d9bZ7xQ==,iv:2Hm4Dfzfnc7ARqEaZ1cNmLMcH7BK//GyZXoCZgvt3vs=,tag:kRJiR0a/t2Q4F2SWwbc1Sw==,type:comment] +garage: + #ENC[AES256_GCM,data:AaGRk88oXeNsEBMwCprWaMgbiVAoLl2l0tXmU4RJyIuFLw==,iv:MMLb9lnZAs36AyELtMdoW63fxhJmpfcjHsHk4bdPhX8=,tag:iQLGgoKk4LwhedSKQSSnbQ==,type:comment] + rpc_secret: ENC[AES256_GCM,data:7owLQIvgJseja2tzV0YV579Q/a00eZWGAQIfPdTDDtVi1ytf9jiRrFW5juVkh2zq9j1c62XhslmfNDmoPUYxVg==,iv:jmXqlWsuuNMVRV+nHtBwAbDnBXW0fUd4afb8VTuZgYo=,tag:GlgeUMNH+Og7UtYBdGc6KA==,type:str] + #ENC[AES256_GCM,data:GwIxZOH+JtAt0lPy9y7pqv6V9VIDSnItW7xeZabQcPiVNz5oSlAHKPSWPxw=,iv:jMhdJ/vAz1jCiRj1w1W2YAujq0jsElSI/4s4hnetV0c=,tag:x11mVA53tb443gjNnlGyog==,type:comment] + admin_token: ENC[AES256_GCM,data:PbIEfM2Y32uvQKWTfnzsOQW3KIu+njj91SpDfFvjMvd07fahYF/rDBqIbKfraj/unNQjEBCu97SNhuWtziS/xQ==,iv:kbOnicCUtTA+EjoCF/fbn8O0Rj7W4pOke/NZXBtZqzE=,tag:dUACXTjjekqQjWv29H8uaQ==,type:str] + #ENC[AES256_GCM,data:q/J1guMs0WwvA7/1GLdMNpRF8GYPP8X0auOXz6gl5xB2A+dBhzQNmn8Uzm0=,iv:inQvjJPg+bAQg+X+bXRn3T5S5yeD0J/4bGOulb5FSts=,tag:wts6UOpFvizeQ0KLCieypg==,type:comment] + metrics_token: ENC[AES256_GCM,data:8xGgPEXo/laDMCBVAfI8WjfWMoTk/PwhJGOuqzi/BwaYXmFSgSpWyW8BpWylU3P7JeaT42VzdNgjmYMjsb48sg==,iv:JF8E9ZGy4zhNLw3KfsU0xb8dj8M8rjZIJaEAuiHuxe0=,tag:tiDGOjlZ3F0TryPslK2QXw==,type:str] +sops: + age: + - recipient: age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1ODNRNUZpbkk5RitwS1pR + RXQ2bW44Vmw5TEhJYVVxVEZwSkZ0allTN1FvCnNvbGowdUViZzFnNHpzM0dvU3By + SkZqM3dSZ0ZjRW84aHdIYWJxUUNKclkKLS0tIDhZMDNjWDQrUjN5aTFaTFNRdG96 + bFBFbG9odkYyditnc0tMenR0bWsvd1kKxL/545sb9g76aztnWYNLIwZjdlVPY3YO + pOLW/YCx4EjbsWl6lXgOpnYPiEFt3uja9d43FIHBh8+b7cN+O+/X6A== + -----END AGE ENCRYPTED FILE----- + - recipient: age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDeThwNXNKZlliajRKMlE4 + QmpXU0Z3VmQvUXdzYm9SUTl2TGkrekRsaW13CkpSQ1ZmUlZydXdZUDBjRE5tYXl6 + OGY5VHZKc2ZyWlRERUpLVFhtSCtwZjQKLS0tIGVNMmdZbHUxS0hqRjJQSXJkd2V3 + M1QyMEhEOFZFdlhFbmNmQ1gyWFFQbWsKHPkTQg+K4km9ZmT34uXSTKhhEpiTktvB + Xm551+BlT2nmBo2kPys44nAn8nuS0XrZjV/wSUjGeXUpFINimkZ7+w== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-02-12T14:48:58Z" + mac: ENC[AES256_GCM,data:V957fpONHWjWdCR4I7OQNo/nHl2PWHbfO5bS3a/nu0Av1UktowyAn3rHnRH8pdf6Vzf7+iycGxLDmrDLvVcnSsJhg7XVeh2nhzEv3/YfVnfl/uoxGd7CAnVrF4lP3utn7xkoxMubJmQ52BK1P+F26E8UTWkBOO8BMGYcwKbXU3Q=,iv:au8JqR2qi0PMiv7N+N+OYbzvrGuWQK0J1MrVpEl2JJ0=,tag:SJbRnxC59ZN+dPktYhb5eA==,type:str] + pgp: + - created_at: "2026-02-12T14:48:50Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA09oKgMfawMUAQ//aXFrxN5r0yI24FvPRNYV8hfMc2o+pEGdUwuwFEv3z9lb + n8estmEJXyzAxd7F/lh4riRqypwyNoOmHHF7JnL/SHjwCCtUpTnbeXDFAYWwnhCr + mgONbD6b9HRhjDik9ivVMo3G1Jm+Orxb76J/YLRJakSmFtjXNaGIyiBHJ30+AgL3 + 9LitFif2+w8ZvhmnrdxaWHD8HA9Wzroei1eA95spFaZ33I6E4dPzd/I6W2yfxLvn + uQ8cMRHWDTld21wXJ6uG+p6cvlKTQKiV4HW7IM4QdE7Wo0YeuluE66dCT3hwaNZe + yz85H7sPzj7+04w6WVDhJHVX0QsRa8/5OwsfQU5sLSBi+Boqsh75AcaTyszNeoKY + S3vXyoNzOlHLcN2Q8kvks9J/HPLqAJquNIM2VkfEsjzN6GYEZD/MygNe0eLp9jUY + 1d6G99jPxoqSjCMJu8Jwttk14PA4xG6fsmqT0q8cEmFd0zdwbwEp2522i3Kl1h23 + fs+sQiiox6Wf+IkzSxIdee2wcvp/4Xk6Q4jRzt+zhLNwSsBZv7xYolAtPVFp8GMm + p9/tM7MUkCyHsM5DsI6OVqfh0xJyDY0QctDzmanDWQkcqFru/VxLhDwjRTQFW7BU + blTDrknsuAN/pw9TqxxeKty3TgYpUMD+cUb5jn8rBpXCQFJxwKEBp64JsV71m7rS + XgHfybmWWHbhO764Ba+jJ78sAF1D0WVC9yJj8cCgqhdPjdkYRHXB7B2gxjjUDj+G + AXpHTxq0SWXcTvzM6smDct16MDJFRafhHnitnNXEaUJTlXPiVQCzJpPD+m7FqPo= + =ZbXI + -----END PGP MESSAGE----- + fp: D40CE1579C09BFD7EF4AB7E631250420834310B5 + unencrypted_suffix: _unencrypted + version: 3.11.0 diff --git a/modules/sops/homelab.nix b/modules/sops/homelab.nix new file mode 100644 index 0000000..7f7fd4e --- /dev/null +++ b/modules/sops/homelab.nix @@ -0,0 +1,44 @@ +{ + imports = [ + ./all + ./garage + ]; + + sops = { + age.keyFile = "/root/.config/sops/age/keys.txt"; + + defaultSopsFile = ./homelab/default.yaml; + + secrets = { + wireguard_key = { + format = "binary"; + sopsFile = ./homelab/wireguard.key; + + mode = "0400"; + owner = "systemd-network"; + }; + + snow-den_snowlab = { + format = "binary"; + sopsFile = ./psk/snow-den_snowlab.key; + + mode = "0400"; + owner = "systemd-network"; + }; + + snowlab_snowflake = { + format = "binary"; + sopsFile = ./psk/snowlab_snowflake.key; + + mode = "0400"; + owner = "systemd-network"; + }; + + "samba/samba_user" = { + mode = "0400"; + owner = "root"; + # group = "root"; + }; + }; + }; +} diff --git a/modules/sops/homelab/default.yaml b/modules/sops/homelab/default.yaml new file mode 100644 index 0000000..dacb7d2 --- /dev/null +++ b/modules/sops/homelab/default.yaml @@ -0,0 +1,41 @@ +#ENC[AES256_GCM,data:jjIjrPrLhyO1tRzG8g==,iv:+4hIgcYnm/51n30FpC8Tbl1j4pqIevceEQf9tA45rl4=,tag:LlW131iOk+UZrtPtZSL8wg==,type:comment] +wireguard: + key: ENC[AES256_GCM,data:TZG68pWFZW5T+UxoCXhmLgp2SYhvN/kKeLLgjRf48M79pzZVWnwQT2769Cc=,iv:WmfvM9H0zwYUTnM4DszQRA3W+si0eULNpW4ZJqAjtyk=,tag:UBultWSGxv1spMeBtknmUg==,type:str] +samba: + samba_user: ENC[AES256_GCM,data:iaWzLYgvJPMKjrqBPt3YjiWhS073oQ/kpg88pUuMUj0kfuXSZ9sjTmwr2HUam0Gpod8Zujj76HpxxH9N5Cqiqg==,iv:uLeZ4v3PhCZ7hZ7NTDpsGx76WBlIQinfvU4iN2YMjVQ=,tag:DYdFVPTunMzDg60sSB3Lpg==,type:str] +sops: + age: + - recipient: age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFUU1kNkpKdGVpQ2FDREY0 + Ymc1ZWFQVzlXTmt0MlJYdXJYNDIyaTZZV1NvCk1qV2o1b3NTNzNzcEkwaGQvZzFz + OW9hU1lMRFBwZ1d5QXRyWVpIN2loTE0KLS0tIEJuazdYTHJxYjgvSmVSSUdFVnUr + UXhYeElvSTNaV21CY2s2c29tOFplakkKdSQ+SSMQje7l3AmNndI/PAmMVzmJe7sm + snnqYTs6E1sKfBklznsYbcZrXeuDzgPt6XhtC1XIgHP0bxTFVYSPRA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-19T13:26:55Z" + mac: ENC[AES256_GCM,data:bI/dov0roY6UVz/DwJa7GpYD2oLy7KKx6QiAiePKIy+gsp2qgVFVar2R+98mU6JkRTO4qVCF3mjpIqXmb0ezJOJZKKJTzMrIA3TpTJJcfhiw2WLA7LpxLKi7o80NdvbXBQxFKsZCaEBJoJxwxqMbch/0lltZAgClu7MW/FW7WG4=,iv:taiX25EYw0spPzBg6thtJJWEKy0j9gt5w8orC/uhd+4=,tag:ECN3I7vgFUwXOrFsSffL/g==,type:str] + pgp: + - created_at: "2026-02-06T18:21:16Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA09oKgMfawMUAQ/9ERw3FmlBF7prJrAhzqKDG7EvignzZalzU0xwGQjtaGM+ + lculJ/5W61tr+L6Nsnw4Wqa+lrQGodmhLmamhepl4pFHEjmhg4ammjRJfQ46efGi + QnT/UktFTrRmvyx8wWii0KmujrIKeGtq4WClmmp4KUjrtlAyONBRssbIUOoyTadA + RjbJr56cAzeFPYdpll8V6cgnRzfmI2uTNHMS6YnusfTZ2xUt1nKmRzjq6X9w3xlG + 15eYalRfXayEynma4xYUJDIJ1ArtZaitvuaRtkDNi75SmYhk5ajvS8F/NVRBN+IJ + q4pYzIzZxhm6b1vWFMmIszHsubZ7PoF/Y9ydm/sDXEk0YbYIXW15O/ufpuX9Vbkl + dV8BVICoVkCP1fiX5ip9v0Ajs2Rjq92JmbEwwgDyz2RqN+yTnobSYvacglpj+hWT + jQIK/ytdvb1XOzgXavJheZjiA62/+xh35UOMqn0UY+0YS2EeTeEhChNwvWp2MtXC + BgeZ+6XpdDxpubD/0OnyDHb23fp1fPcvMRh8NLxnYFZoC++5ju8sKf5E8w6uztGb + 2cs++QY/Tb69M/pO1F9ByynK/MGE3mJwjxEd2rgARVdjPPg5kYh/ND6MJFRQHdaX + EMKxjo421+pCn9YzK/2kdWm+x+VnRCVjTb/WsVh+gmxqHYNEwF6FCqieJX6HPCTS + XgHKoJsBW5uycRdQLzVkkmKcuoEzcgEjhq3U5a2r5UiCNw4KMWE8Ws4VnngmqQeq + Xy8PsrpSGrGQ+RMTMtMCmoUxZyGcZkaLO7L3MTpoZ4fbioRKYezyk0y2L1T/TV4= + =OsGE + -----END PGP MESSAGE----- + fp: D40CE1579C09BFD7EF4AB7E631250420834310B5 + unencrypted_suffix: _unencrypted + version: 3.12.1 diff --git a/modules/sops/homelab/wireguard.key b/modules/sops/homelab/wireguard.key new file mode 100644 index 0000000..20932e1 --- /dev/null +++ b/modules/sops/homelab/wireguard.key @@ -0,0 +1,21 @@ +{ + "data": "ENC[AES256_GCM,data:9IlJBWB51p5jeRnF+mlci9Y/v5H1dqApIOxcBZTOvM8q2AkfkQqjPIkYqhgJ,iv:MyHhZM8EdnnJko1xKe6vcc/yoDo2PfuEmfr4NvxnwSo=,tag:McRopBG5bsKw/uj4IpKvYg==,type:str]", + "sops": { + "age": [ + { + "recipient": "age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArTzlvZ3BqVWtrQU1qNmxm\nYlJhUVduYUdrdmJUQ0tLeTlkaWp2SUVEM2g4Cm10WEdybldVb3VoTTBxbjZhSEpw\nRncxSG1GRzg3NGdpVmpQSXhlZWMzSWsKLS0tIDB6OSt6L3hibmVxQkUyT1NVdjVQ\ncFloVUVEbU50alcrbHo5ZjIxbjRHQmsKYtuWpN4tVTSwCni+dAh9X2kL64Dh15kG\nW3GhnNaqXhPOIUPN6U/emEs4/HeMpcD5pAh9Jlpx0ydsY1IKqzVNQA==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-08T01:40:57Z", + "mac": "ENC[AES256_GCM,data:+J5tkO+Tr/74o52p///V5JuX1buPk8s9jXdmPeCCBmjq6cHBji2QZPqmxLUX2hYforgumjh0bkemPPlnzaAAABBABzx5BWDe6qyaBPw/WIgyS+4hLSo6pl0oL5AgMqO0x6ABViqURWVNZ8RjhKvJruNuVvwti7kYHm6WkFMre0g=,iv:z/8qUQ76acybWMtmAlKFNt9X+eQl98uaaLp616hGC98=,tag:6x2s12SStB18zoSa/GM8MA==,type:str]", + "pgp": [ + { + "created_at": "2026-02-08T01:40:49Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ//Rat/wV5un/mwwpKiEs5ct8od/K/M7vI3rqYWYVeuWLjI\n97zp1pPP+7e4oc2P89KoUIogknxHbBmOBr46cMbJBzVp+d+W7+ll51yIZMDlUXfo\nPl4hJaUuUfu0fJD9nrhVuPLWiExDblapCt0qUmZH8JCdnKvodpEIWO1zUT7+nCZG\n7/oUNSPUVBz+VpVz58x/NH3WQ9LdUoJN9lHX+IfrV2GiwuQZpdRUfJA0jB4Uef8V\nC5hkMOMGmJmDQN0PLf26iApN+4AB7xrkz9zFCyfyUjUyfDwCMmlc8+5f5Uta2toL\nje0YcOVxxpzSc2UkpJ7xZfrriOYNGJkE9myKwQtrU62vP4LLsGJ5+JLAsVYqHhja\njgDaohivVhYF3q6sL/KjZA53tMa5eI788prRI/pkdQEsvzrGX41rrsT6ZramavJq\nQnX0EiGPVHmWZNDGqPo/Yk1kPIv5crW0IwSt9v2NtCyG7VA8sADZxTcsAFnAylK6\njRfWQ5DfHvwZwmks69CT+04kKadQkkaRFmLmVT5XKocgwjtrgN6zeVNff8qMlK0Y\neJN4QMMj84drrbbHE9vimWu9tL+0yHNe/rqQaWnLp4hQJQxGUCn2SDD54pCnu/qG\nxmR4eASRle5azcTTbJP4cO7s4woX1/5QVcrI4S8qrRl1t71uM3wWsEdbGk6wdO7S\nXAHZs024tUSeWWhXyoPXF0oVbWbFdUFNf+sHHkjpwTAR5qVVGOohQfRTUB4tI9Gw\n1YGG6rqxWOM/wTE+xdOFSNZCXHhzR9y/x/VhRLlEwiS2y8xHxvadzRh8qI2X\n=7qza\n-----END PGP MESSAGE-----", + "fp": "D40CE1579C09BFD7EF4AB7E631250420834310B5" + } + ], + "version": "3.11.0" + } +} diff --git a/modules/sops/homelab/wireguard.pub b/modules/sops/homelab/wireguard.pub new file mode 100644 index 0000000..6936a20 --- /dev/null +++ b/modules/sops/homelab/wireguard.pub @@ -0,0 +1,30 @@ +{ + "data": "ENC[AES256_GCM,data:jCdPCYrl+PwEW/bxMP2WWQxoDNVK+GASNeZH6vg2POV4daPkFrGJszFYuZLX,iv:ShWZdKmh+Bj+j9VSjCOdGczGuZkGdLdqUCm0CMZzRyw=,tag:YC1OksX5L84FmGIGs50O9w==,type:str]", + "sops": { + "age": [ + { + "recipient": "age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBISXJYVVdPZzU2MDdRSnM2\nTVJnVEpqTi9oRnh0aXJqWUxrU2M0U2N4a0drCkZQY2c2dmJ4cjlnWTlWaTEwY3Fj\nVmRTeWIwMTlpNHFocEQ2RGFRTVQ1NEUKLS0tIG9rWnRkWkVvM1ltdVVKcXhGUFNM\nT3M4ZGhGeS9XNk1JZFgxMVdDcnNPbUkK6Gne3KeWLL/3ErwI4LH0KQ97KkJYnhps\nOO+V04sbQzdDO0aIDV/4JKO+F/0quRp7ouRCDg0pKnxwhfTZsald4w==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyaWRpNHFTekhOK1l0bWZJ\nMDA0TWM3NnJCbUpKcUh4czVJK252R2x0RlNNClJ6WDh4SnZxcmR6a0duYXU3KzRH\nSUZycDNXS1duUnhnYTlOL2wvME54VDAKLS0tIG1IVmRKNlg1a0tPQ0E1QUQwSGFj\nUmdIaTZQL0pyRnRIZU54LzN4Vk1IbXcKhj43PwkvdKAf+vdpjSQ9Eg4pEDxvja8e\nKkfNl6bfMBOcN7xaG+qiPDMQPyFBAoNgACJ36RLCHB32bpJULLjKtA==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1qqex87tl6kq68hszp66z49n95zurcxcvveumpxjvh5w2yhx8g47q5s24ya", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrN0V3SGpsUGNNTFFJM0Q0\nSFppUEZCUGdDV0oyT3ErMGpUN0lLZVR6OUJBCkdCZFdTYi9IL2o4Q0x6QXNWd3pO\ndFNmb0tEK2dNNnBuNStOZS9YVEUwaEEKLS0tIEthWng2aG10dmhFL0NDOVVtQkNt\nM2E1b2hwSFg1UTI4a1Ezb1E4TkEwTk0KL5DRcCfktSML0UR/DClDpwV2VyHT6slR\njbi/Oel2TSHvrM5gdZBf4P29em2JSnQsi9UPrOB++MXAj+Obo7xgEg==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-08T01:58:50Z", + "mac": "ENC[AES256_GCM,data:eWbUlQ3oFmqRCl8HYNfqL/JUXWfzF6RaTBjJ3QdNZhrqIFEkZ1aa7WjaVKZceXrcr5ZueBvhm78iJAUgA/z/ovmgmU13vhRjDXJqeJ3sqY2LAheTvzFRe/LPehzOwW4D4/sYosRrZZJ6wx5xnMBCTzFmaSPaCC+6MTXSiOb99C8=,iv:l4Ke6xyBoMQyw83Xf3xEegs0zXgHzxppsjqv0ZWeOkE=,tag:3BpnxUBR0jGfoat2A9V9kQ==,type:str]", + "pgp": [ + { + "created_at": "2026-02-08T02:54:22Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ//cVrx478PUOMF4QOVAt5EngXzk4DSiAy2T/egJAeAOSxc\n8fPcZkDEm2DNjd5Juo1TCd5J0X9aa/JK7F7g1Vlq2liR1GxJnTKccgorAggcCXYA\nrYAgPAcq8fKeosmLJpgjNMJztmp2qG1ovp9JeaHDboTU5FhEwyg4IH3cAjLVLrxF\nEW/BzoMMYWveNywOH8n0cdbHj1Qr5Laymyl286inl05XSNYyHiF4u7owgGQs+vku\n7OkEoRvU5AyMjl4k5W55JuOGWk1UQeV66ND7sJCVG9fccs0i3yTBJouPPIIvIkmr\nj8MvWBuqWAiJaI/HOvEO1RxmGOhbvSodfwCVC9A795KSItdS4C7X7Nn0TVhMCdcd\nse1KC11FrK8ao5jzAzPQTodDZtoRConRLV/gtFpqpLavkK5+qDgtzlVsMf+/GFv6\nAGBJHiDgS18tbXvHmQOPnKQD5A5ratrPCNFBaYn1Yi4GgZLOh9w/mANJFfweZCxS\n5w1eWwkNRBxW63Hak7VoUvEySrJJzNuB5lj8Ge1c8IN2XlUDBZPwLiZSYOz9bQb4\nW0VCQibtUI9dxTW3HhrW68JwRrIT9zH0DHppR+kJ6FWCkWoLAV8gry6+zJvb1Swc\nX1/vakMtmqOY636aHMrm3N/DF3a8KjHYaIMYTA0/peA5wwlim3nLfUy3muUHHCrS\nXgF3Ton57GVLoviXQR8kL1nG5XEjd2LJo1g8phusBGg+4sGrIdhvVW8gEDj8CSyx\n1rRrllz2Eg/vKrERpClIQD7r4a/SruglwgUwSJLLfsRxZLNlqtkLq/LXeeseV1A=\n=VyHo\n-----END PGP MESSAGE-----", + "fp": "D40CE1579C09BFD7EF4AB7E631250420834310B5" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.11.0" + } +} diff --git a/modules/sops/psk/snow-den_snowflake.key b/modules/sops/psk/snow-den_snowflake.key new file mode 100644 index 0000000..b4dfea4 --- /dev/null +++ b/modules/sops/psk/snow-den_snowflake.key @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:J0pHqduu1EgZx9xYtrSml8un2sRzVE1xwNTqZLeVulwKJG4Af8e/t2ip9BQV,iv:xILmyGfnpQQvVfiuDcaS7Z6tHqVaX6Lqweqn+OHvSjw=,tag:yFHAtmGmBvoz8xzdC69wqA==,type:str]", + "sops": { + "age": [ + { + "recipient": "age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0eUFYc0ZLNDkrZWJUaDlD\nRVZyL0JNSmJhbjZUV2wrWStteW1WWFhMRjBVCmxtRkh5c21iekZ6aUF5cGo2S3NV\nVmZlUWJWVEVoV09qZEdhMkVka1VJZU0KLS0tIDl2TzNPN2Y1a1BkM3JDS1Y1U2Yr\nQ3gvYXdnUDFNVFgxTVVXRkNZK1hVME0KZEvNxEnrPdU1gYEnILYIvBML5J/jY6FQ\nTLhhTAF0jiJeuHVec5pGdzYk+Qi7TyrEZM9XEAjagSmD3ME5PWHOuA==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1qqex87tl6kq68hszp66z49n95zurcxcvveumpxjvh5w2yhx8g47q5s24ya", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxTmFySW1JQm1uRWg2UkpO\neDBlbFM2eVZEb2hWay9DaU5GR3IvRkJrMWkwClhnYWd6eHg3T2RBQmRDTFRtbXQv\nSjVLYkhZZWU0U041cGw5TzRTVVZIQVEKLS0tIGJEVFYzalBUVXNIRWgvdWdIVFZF\nK05mZ2hVZ240eG1mZGZRNHBKQVdzU3cK8gOIktkGpaU01U9u3JX8vS7ki7i9zCnp\n+bc6Ok6y2FLlLCvhZGsXHdjNRMQO/G+qwSzu9ErosVAN3J919dUXEA==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-08T02:04:00Z", + "mac": "ENC[AES256_GCM,data:LwhoPV3B7QiSdgdh+epC0cee36iQka+hBo7/9F8MN/lkLlutCwVizerFEhjZpeWLYnfNmYu0kBkGEepJ2QXozNJM2mCwoaXvhHnlRRJAO9bUQ2vZK5DCY2t27owD1ytWVBv0Gb44UTokuch+qbgT/1BCz7kE2NXG9/H98Gryw30=,iv:WoxJcInLYq2ImwF2yP5aNxOCbG1ydQ936/dUDXdcnL4=,tag:+ghwOQGeWCXTlu9AdC02Bw==,type:str]", + "pgp": [ + { + "created_at": "2026-02-08T02:46:47Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ/+OnXuCujp9/y4/moU7WahItgTxH7/YknRvrFNmcpjCQpa\nq9IzsobQGyD9vf9sUIXvviIo8XU/iEJR6euPlP7Xo74+9Vv++Upn9nXGgTaGMVvH\nao3A4klCjkRBJZOpEIVJJwVW7BOEOH9YE2o41k6oGZ5GhTvELWY9Dwxs7Eh4F38c\nQZspjfZm1NVKCRgoqTQysb2c7e8G4bFLCq5bavu5aCM9LN7+UIaQFK1JvgxFhInq\ngTq4o6sdIvHjvdhjMn4YlcBYW7NiUpvy2mZWTXmOK9de8IIBle8t4vfbD+KnLUiY\nLQtYiqGNa+binI4VsjCF8tifhQSqtC5KHldWq1I2mNAQccwMlnQRrwbeQGsD4eiM\n8G6SNclVtpxBf5H967GBv+S/CclI1+l/6s2xu7hoGjZaeYCY5KNrlcnlkxQwmP6B\ngGnqxRINyZVR37+7SapbfMG+7HftQ6xeXkdxVxj/+AK/BzTY34kqktvn1P1qKhMM\nYK5tg8aJRyQsgkwfQUq06xw9xe0HNq84FEiBEB/ZAmsnO1UbfOft/7/nWle8FeIy\n3iaOrCTL1z2p/9it4MdSbABR3U4rCa7uebrNvmxDyfTxQja9J/76FMsUWCqjMcGv\nbRuWk1UK0VOuoiFGl/MWgZlNq1tRW6eh+9mhZhOUQ9gQ4T2gu3h58VwH2pRJoI7S\nXgEa6U9VlyH7xB+vUoL92nRzAMbGwQoqdBH6gjNo0+X5M/fRM55ULdPqQ0ynAZvW\nLTnBQjEtFwtp88tCpQL/M5BrYOzrb5iEcEZEPX3zpf0lc/lq6/kITsHYhKU5ilk=\n=G68Z\n-----END PGP MESSAGE-----", + "fp": "D40CE1579C09BFD7EF4AB7E631250420834310B5" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.11.0" + } +} diff --git a/modules/sops/psk/snow-den_snowlab.key b/modules/sops/psk/snow-den_snowlab.key new file mode 100644 index 0000000..703e981 --- /dev/null +++ b/modules/sops/psk/snow-den_snowlab.key @@ -0,0 +1,25 @@ +{ + "data": "ENC[AES256_GCM,data:yaIFiaaJLxt9ycdzEjnwoSKfDsREq30XAx5P2moAARGZxrNtzzahl3Pq2+5u,iv:3pxuuQBXxSaypf8BV5cmERcUJquxvF/wR7Xat+Zc50Y=,tag:PFo2WTO65uKRFdN5ZwP36g==,type:str]", + "sops": { + "age": [ + { + "recipient": "age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0dHdUR1doU28wdXg0YkVu\nTTdLYytMdXZLSUdOV21SaUFhb3p3TitoeTFvCjBCdzNhSkNKYnFBaVdmNTh0MmJN\nUHNsTUJHbUlmT1M4cFp1MXlDUUN4UEkKLS0tIE1UN2g1WTRRTDljSysydHFRbW42\nUG9QZXFaZUw0dkhjQXE4N290YUx3YWcKDt0RbDT7XaRtAOfMFyZtLTfXqpEC/nbv\nYeiNMfGHww4hGzHHaCXeepIUWPKQQqOtnU8Qz6W3VBzXP+AgkKdsTw==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQi9mSHdTRmNXeENrL2Mw\nZkFCNHBCSGlLdS8xOXRBMVNMYmd6VnlxQldnCmZzQ0R1SUxEcTFtWDhoMFFOZlo0\nTjl0Z1Zkdkw3a2FNajFScEo2eTNLekEKLS0tIHc4NHVrL3BXbFp3QjEwUDBhdVpk\ndzJPWmxJQWwwNElxb2gwb3NaU3plSWcKLMmhfQPs8DY/kQz+eHgtVS6kqw/nzaOS\ng2qLyrQq9p2wq4XsguCNCPP6e7Q+rqNmBSOnkWGa1hXWoetytIliQg==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-08T02:02:40Z", + "mac": "ENC[AES256_GCM,data:5SeqBOk9g/qjLyt4jhgOQvFB/H+6AVEvvqVheTH9MXJboz0q2jufcAwDdVjd8mMAoW+/pDRYoq4zkz7prwINMYTnPEXsP0QZA8nCMu8FWZT31tCor9WJhLnig7pJZCF55GoJct7fKDyLzRjZZEg+GZySUQZDx2oeiHM8Wj/Hdlg=,iv:XkXBxyq115QZxiYkYrqx7BTqmS1tpH+Ist/yuwuWtJM=,tag:QZRKjd/4peq/FICQ6ZsMpQ==,type:str]", + "pgp": [ + { + "created_at": "2026-02-08T02:02:10Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ//VsHEsmjd+xq8CCuNuXmlB1I9VwqroU7YghttwMI8iw7J\nNE1pjJwVC1hWjHVGt0n1xlIvhG9UTTligFveEBKjhAir3nJJbcQRlmLqBKuQuwBv\nZXU9HdJZLQcNHKI9NRu5w84aWQ+k81xP20Z1o6cowE9isHrIY+tGon/qH9KtuCFI\nt1HyihU6VnG1yqE0JLayZZkWnNSgIrgQPe3aW6GzmYP7Gc7PuPmUjtM6LJVz77bq\njgspfJUsqhSGLFKpWvy0+zLMFDnBZO/oqsB2WBX8ihT7q/Rbl/sQH6Y+WkFz2ZGP\nPXLvM0mHZt1bqXmnOFtx+DmSojoLdX6QKAyeO7sKXgaPbnmmZ3KBR+JUiXyHz0W+\n+FWbWvuEtrx3Vamir+GARH0mPmtiPw+xctLMeRj9OEy8oMTqNVXNWihQ4E3t5Ong\nyokyyPUgEZgDl8igaYW0pWYXC6m7pQlAGptSEvot/+es0xxYfy6XSS+jchOpYGl7\nYv78oQ2ck4qpU45Spm+4H5XvrQQwietNcy80UKWe+TB215UU6OMgNE7QmXBbhrng\ne4xuJS1RrZbf7cuxJgKP7biMKsJp98ZlambDek9/18vgO0MGrpLGv6wc8E1cxS0+\nCWwerICyYme2sR1yz2bo45pxDT/48LcVLyOkBEWx6l7gV7OEWhrh+dvzVU6JVKDS\nXgF/plfxXJL7SCPLbdkuPT9kQZ53pR8AIFYlSnTVmtqwjp91O3vttRO9noMRhd1I\nuh2B+Wg3cbNxjpdd7CkVpCMOAPiDrm+vSAlGrz4EeNxCeWdLsuBvdrs2IrjoATQ=\n=+z1l\n-----END PGP MESSAGE-----", + "fp": "D40CE1579C09BFD7EF4AB7E631250420834310B5" + } + ], + "version": "3.11.0" + } +} diff --git a/modules/sops/psk/snowlab_snowflake.key b/modules/sops/psk/snowlab_snowflake.key new file mode 100644 index 0000000..1ecd03a --- /dev/null +++ b/modules/sops/psk/snowlab_snowflake.key @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:xBs1CZRSQn/Ro5lob8IpPO7Xr66HhPgX4cE2vqH3TJQCoj1sOcVgAR36z9le,iv:D6F4MEI2qi9vBSjWYFJx0j4siAzgEo+nnwl0n2bm2K4=,tag:2mHTx/W8bH2hc1zGV6a7Ew==,type:str]", + "sops": { + "age": [ + { + "recipient": "age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTeU02RjVDUXBmT3Z0d1hi\nU0J2TXppOVZsNHBGbFhubGxPeVVBd1hPU0h3CjRTRzdYZVByKzRVOUgwSzhNbzIw\nSDB4Q1ZKZTVCUFFxajUrckoyZi9PdUkKLS0tIDh1QVlnTVkrV1dobUFHZ2p3S2xY\nRGZRZ0ZzbjZuaTRjd0JxK0J2NjJBRmMKhH7TqgI6wI2Qt0fYC2P6KAIB6w1j+gES\nFiawU4VXRLrJ5KUCjb1hxXNiauwJEqvYR9HDKGbuvXzr8YlXkwlVIg==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1qqex87tl6kq68hszp66z49n95zurcxcvveumpxjvh5w2yhx8g47q5s24ya", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLU08zZE9pcWNEa2lRaWNl\nTzJBb0liZGs5NC9zWjRRRGZHYWZjLzRPWGtFClZud0lKZDAxUVVhdE0ySXlsaGlQ\nNDR2VFpSQ3FKcTQ1aXJOR0tGZEFONUEKLS0tIEZMSDJSem5tRGdBM3BLb3FnT3l5\nN08zRkJEcDNMOXJhYjJiT1RldmJ4dEEKC5HWHTewhY5n7B+726sOud//mem57NhA\nZEun5JxxBEokNSwBwIrBq9j99MWXeTvNYmTZqqozM7fWIIFBB3OfIA==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-13T13:07:21Z", + "mac": "ENC[AES256_GCM,data:R8WLJukVG1aZg1D5qCXDtHeuRtq1sRr2ngIncWiMkR3jVXQTk1HhXiMyBM38DsxQOkb/xeIxDcva4nHLHzJeT7DObmwiUkse7dVju0SJFSWm7bPj8Ud/SBpla5V8oS7Y8ZrMYK8afO3H7ho+2XDY1hHCT/JvhKQu+t9vGgCArwI=,iv:mJDcoBkSl6zZhLqfgjQ7CUfHCm9qeH47En3tfEiqTHc=,tag:83UHK78ycExU2/5Hxw5qHw==,type:str]", + "pgp": [ + { + "created_at": "2026-02-08T02:47:25Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ/9HmsvMsLaf1jg/CSSyO19+/YxPJbuu7Q72FCmmRQ1EIUt\nWwkMz6+U8JrCQM58mk4xV+STfBRXPtgmvZ12dA5wuOVi2LnPf7xX7fZAvn/5mQdR\nDQFnVk818AhHrpnVaHVcc+wi0rjmjy5LcL5lq4PC9aINyu27mo/dcQYtKrq8KLRG\n5Lw/OQoHWwvO2eL+XzR6VUjRrgGJqbsKjgKYqBKoEIMXJhzixR7Q+bLqjDpXZZqR\n4QyktIig4njND+Wn5tGLSu8ZyqI9q56Wk7ln01Nu30mX8iKIiy8htvgb7EgrJxl8\nycgbx1Kcgd32lk+B9T+f3UFJEEYmNGLJr+9ZJ9Kg38tyMCk+CrvWHBpRGzfocPjy\n8+x5+SpLLnZMmCLmEpZFKjvLKa0rnjsWFNJN5jDBiJ/uffP9RCDIHuzWkEJMbCo7\nd3XZqUE3WW45PjbFr+Me9dNT5EaENm0g8675vVYAzea55kCEH5HeQhp7NLgx1v7i\niDbimQzRJu+3fz7NE37izUNSVM/M1SBdYmTrNDCrvvcqhbJvcRG94OWYoOG0G7t0\nKr7aeEoe+rozj1mDjmxIuZDWlSS11tRVBZ7+usTjLu2W1T4T8wjgy9vyL6HHQhM8\nGmWcaPgThVij+0UpwefX5RFDdkjZtLibSO4Cgu8BXkiY7sovikxrqKopyrMcy1XS\nXAH6fLueBBX/QqUMiR7W43Dltbh2NGGEmTk7bpxqsKvY5WxcruHbERKdIAVaGwV9\nZkjYLhTmuSQo5IX+ViNlpVvhLEFsCV6MN8V25ekHpIKL8WjE73lqS6OcbloM\n=/xk3\n-----END PGP MESSAGE-----", + "fp": "D40CE1579C09BFD7EF4AB7E631250420834310B5" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.11.0" + } +} diff --git a/modules/sops/snowflake.nix b/modules/sops/snowflake.nix new file mode 100644 index 0000000..542cfcd --- /dev/null +++ b/modules/sops/snowflake.nix @@ -0,0 +1,37 @@ +{ + imports = [ + ./all + ]; + + sops = { + age.keyFile = "/root/.config/sops/age/keys.txt"; + + defaultSopsFile = ./homelab/default.yaml; + + secrets = { + wireguard_key = { + format = "binary"; + sopsFile = ./snowflake/wireguard.key; + + mode = "0400"; + owner = "systemd-network"; + }; + + snow-den_snowflake = { + format = "binary"; + sopsFile = ./psk/snow-den_snowflake.key; + + mode = "0400"; + owner = "systemd-network"; + }; + + snowlab_snowflake = { + format = "binary"; + sopsFile = ./psk/snowlab_snowflake.key; + + mode = "0400"; + owner = "systemd-network"; + }; + }; + }; +} diff --git a/modules/sops/snowflake/wireguard.key b/modules/sops/snowflake/wireguard.key new file mode 100644 index 0000000..0fdf853 --- /dev/null +++ b/modules/sops/snowflake/wireguard.key @@ -0,0 +1,23 @@ +{ + "data": "ENC[AES256_GCM,data:85yFVsktex3Y5H+tRzNSSyWkL1XxGvT25oOhjDLVMoJ4VBUuAPlF8bmL+KnD,iv:4WRrTHc9i9b4BHmBQIvSje4eML+Ave4m5DywQvvMLJ4=,tag:wC5ccSnvmq7iAA/KaGAw6w==,type:str]", + "sops": { + "shamir_threshold": 1, + "age": [ + { + "recipient": "age1qqex87tl6kq68hszp66z49n95zurcxcvveumpxjvh5w2yhx8g47q5s24ya", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3djl0UUhNT21rU3p4eDl6\nSU5OOGx0cGZHT1lUMkJBTzB2bTZnZnQwdGxrCldxNTZlc1RQamZPRFJIY0FMUTRS\nMExwM0wrNmkram1JdFFwN1p4ZXgwWEEKLS0tIGh0dWhMS1Y1MmJHNm0yNVdWTUdG\nbUZmZ3BtZjlPUEF1K0lMd2htRVlPUmMKn4Va0+leR4mDIYYoGc9GPh2jCovwLwNS\ntxdpFMsiz3wKNsmTyhkxUqE66uCyywKvi5XwJDzJbA6bRdwGT6uYtw==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-08T02:19:15Z", + "mac": "ENC[AES256_GCM,data:dBtZ9uBySQ0eJsDDyDCPSHFV5JgHBcaU4Jl9QpSFhjsmQ8Q8O3Wo/7AXkTB+eXewdzWoR3Oyvxq2GWRiPnhAQlxVVJ6sb6eCv0LU4my1aK4Zw49UB9PEOpCpM2ZZOHSJYvul45aVlGoBZeJqOCFoT/Mr7AjIiEmo8tcOKdFE1VE=,iv:RZEM5KahLMEjUA14NaCrcktzTJFHmBlGbdm2bJbFroI=,tag:eZFB4H2900wHtA4IodHDog==,type:str]", + "pgp": [ + { + "created_at": "2026-02-08T02:44:49Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ//R9mSlPb6fA1xzUBVxCI5kqFKcuqWCPuTWn7ENMfkf/hU\n4i7IOb9wLhwwa8TPubQBQ5aI3R+c5+0zv0cnEKwEk6mbiLJL7OK4aeglp6TpBi5N\nFA7qpykxSmX/3BhU/nmLwVPJDH/ISS1MdIqeIGcRQA7eZJ8a+A3bDoXX8Xw4C/rY\naIaVwEgoEiCAjutmmX3oxqEF2s2p8u5qtP3E2LncvB5T7UG1eRdp3Xlnwr3LV1Z/\niqHuJ0jamCumm4NKUjjRHdW898UlNN7wkheew6W/78zlj67Bf4O0x8uZ/Y18aoDy\nNA5Y8Gi8uClRs9kdlHJHDdI32aEXHlfSBfBe3xjSHk2lFkf6vgzR8dlx79rrXepK\nk2z4A0MJGJ5h16UIKQ2NbsT/PoFLMW0Y5MD8J+1mSTPfPOUHGWUfuMwWsDWUJQbz\n3zk+J6sBrvlgPSYFC9nj3faYLNT1Csvm3Hr3x1HJsnX7eiPSINFSBEJuoGeOYmTc\n46M80djveSRjXRFfenbPx9vx0nKevccbh7GDYuNjvrsidKqe59Hyx0ztYyFxDIbd\nJuWcWPbZfwqRir5XqbIE1/TBXB8R7D06JKPDzA5yq3yE3YwHpIt41tEAVE/Hu1eE\nE3XC2WtSHDdcM6kgElTx80g+XG3Pyf56Biy0hF+nl8uYmUMuzdlLH/pmhrS0RG7S\nXgHKJ9d9SMXfnw4w41rh0RWklhiWMT01JXtC+UMZfkWae3La0J7cEMqxwlGtpdjj\na8W281zj/RJMQDf6nuYaznStclJyCjtOGD06OXLfnMaiTmfMTJ065gsNSXOcU3I=\n=rRPm\n-----END PGP MESSAGE-----", + "fp": "D40CE1579C09BFD7EF4AB7E631250420834310B5" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.11.0" + } +} diff --git a/modules/sops/snowflake/wireguard.pub b/modules/sops/snowflake/wireguard.pub new file mode 100644 index 0000000..2035db4 --- /dev/null +++ b/modules/sops/snowflake/wireguard.pub @@ -0,0 +1,30 @@ +{ + "data": "ENC[AES256_GCM,data:U3sZs+RdHFScp6oWpMZLhPJldAmftzzDQ9wxTUkXW109bluXNphU2HRO3N7T,iv:ZFPdtU4yNCMbuKctEU4t39a3wGrPWtupgZjYLjEleRE=,tag:Yi/AtWyhksQqLuyLf2TEfw==,type:str]", + "sops": { + "age": [ + { + "recipient": "age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjQWo3UGg0RnhJT05MbEZW\nei9mVlcvR1pCdXVkeTZXVFc0ZVhpdXJkNFhzClZQQnJLankwNU9obEZFYUYyaUln\nTFg1Tkpab3lnelVzWVdRS0lTbmYzNFUKLS0tIGRoUlErbGx0SzE2OHUvMzJENFpX\nMFduNnNTdlh3MkQxQUpSZTdXL3JMdlUKp9kpRBma40MQ66rtzUV7tpGZr0I/+UxW\nRKhg1huyhPjqQmuTsroM3/nzwJNzFHUhNPZ1Hj7wnia4oA26jRZ7kQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ODhwK3IxZS93c3dla29o\nYnZ6SVdEb2xKQ3hidnk1QW55QjBHREhvNFhrCkZ2OEJvbHZxQjZqQit6YmpLeCtn\ndVo5ODJ1UzRwOFVvejBLZXVtZCtuelkKLS0tIGhNdTVrWDRVSkRBRFFGYUdOQXly\nTml3amNmS2pXSFNnKzZsVmFnbVY4TG8KMePUBF8OdojcQnc6YfcrmJNTWwJbz0vH\nQOQ+/ILS1VqDsKa1H87rvmVkR2wvgGPN6jNyppZdHgSvYk4rE4P3cg==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1qqex87tl6kq68hszp66z49n95zurcxcvveumpxjvh5w2yhx8g47q5s24ya", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSa3JMS2NxZk1QditZMk0x\najNkaDJSZWg4NHVORWpuV3VNaGdLL1BycTMwClZkTkhrR0RhazRCdDk2VTU2YlZk\nNnMxbDdPTW85cG9weUcramRDZUNmQjgKLS0tIHlObTBSUG13VG8wUS83bzBXRS9m\nWjZQc0pGQzlBTHJ3TDFzNk1FK0pId0kK6++CNGRDKYGpRwc6ghLszFsLfzLe+kWq\nCiPWLMUXJq9DDLTnT/VQJp5LgrF9uNPDuEb8A7DbmlzxG8N1eMIf/A==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-08T02:19:24Z", + "mac": "ENC[AES256_GCM,data:iayJu4tu0mewoeyxC4m2HjJY9210yDtOIu2TUW5J40z/udz4K4un6LLfYwHaKwtucp1NozbXBx9/Dx2sUxK9l7RZptbihyc9Dcqc+EFrQyX4b9LjelI7P+aEcxTA/7PCkHhKnLDwNasz6SG8lUP2NffD2F5RJApROcKsY8agS74=,iv:eau4tvefeB7AB40lm7lANPypXqGPYRDpe55J4jTzoFU=,tag:v5h4sx2szEu94tMzjkmkxg==,type:str]", + "pgp": [ + { + "created_at": "2026-02-08T02:41:19Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ/8D63lggrqGhwGwNKaNx2yVrcV3hg7MloKq4xELUqOv0pO\nQNzexI/BORR4tJB6+FgG0/5EBPE4rpS4THmrFf7HAdZ8r7WyBf+AJSGbMVyPmBL5\nQPohT+ul830ZyAFjjmsDQ0JEc8tq+FOli6rmX4WZJoHdVLTG0pZE1fmXi7+cSu5I\nFxHF/Ln9Yt252zRqSz3caclsCdXKZ4SP+WEqdycGyL5A2IUkDY9wPdW9cJXA/lpY\nf3Cu+69gj1couaUFc/8BeXG8lrlzKn/iMZze5inznyP8xbrXQryb2pisPwSoZtX6\nxQIFB7UPbsmtrvHD8FVzh5kc4ku7997rlNgK8B7cdY/jH4P0oj0Dds1HziyVtIM2\nFE/cEWtYaf/xZd6xsVToOYg42MJbu7Iyal6gUX3w+/ELe4/CL51xjfrfScbI7QjO\nxoWL9pTQotJ6a9qtEjyRHrqYgymeLNR3hJIlJsMbbaLQarzGWqaSl9ksMq905NFD\nMi2TNfTdRVWrkFGMB+QKqPf2DtTkonGntJ3z49M5xH7K1bEOfv7EATz1HapXn9A0\n3cM54zpvJD73Hmg335ylL0BxFMnL6PMscOz6F509CGKTtMOMueImK+1liwSZ/s2H\nrdpHjJyLwlhIsDBcodj+27KyhNjQTbrESXnB93ytqImzJa0HCS+o9g3CrOp9Xe3S\nXgFXI2VBbOXHaE5Pa3YJv1l9zK90NoUwtDvw6bvxYvR+/3X7YWHPUbMjQ8c74xa+\nyK7NPE5hR5nplFWnXELHcCEKFCR3vymDs1V4aNrG83wmi6AW9klRPyHDNpQEw8s=\n=uPKQ\n-----END PGP MESSAGE-----", + "fp": "D40CE1579C09BFD7EF4AB7E631250420834310B5" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.11.0" + } +} diff --git a/modules/sops/vps.nix b/modules/sops/vps.nix new file mode 100644 index 0000000..cc94fca --- /dev/null +++ b/modules/sops/vps.nix @@ -0,0 +1,46 @@ +{ + imports = [ + ./all + ./garage + ]; + + sops = { + age.keyFile = "/root/.config/sops/age/keys.txt"; + + defaultSopsFile = ./vps/example.yaml; + + secrets = { + wireguard_key = { + format = "binary"; + sopsFile = ./vps/wireguard.key; + + mode = "0400"; + owner = "systemd-network"; + }; + + snow-den_snowlab = { + format = "binary"; + sopsFile = ./psk/snow-den_snowlab.key; + + mode = "0400"; + owner = "systemd-network"; + }; + + snow-den_snowflake = { + format = "binary"; + sopsFile = ./psk/snow-den_snowflake.key; + + mode = "0400"; + owner = "systemd-network"; + }; + + postgres_sql = { + format = "binary"; + sopsFile = ./vps/postgres.sql; + + mode = "0400"; + owner = "postgres"; + }; + }; + }; +} diff --git a/sops/secrets/example.yaml b/modules/sops/vps/example.yaml similarity index 55% rename from sops/secrets/example.yaml rename to modules/sops/vps/example.yaml index 749f6b2..27f678c 100644 --- a/sops/secrets/example.yaml +++ b/modules/sops/vps/example.yaml @@ -1,12 +1,6 @@ #ENC[AES256_GCM,data:VCoJrRdEXtuZG4hsS2oTFv16IC7wX1gHKnfh,iv:EAFpXE1fm3A0a1gPk+GOs7eblCOAN58cJ9aDZfg4qvI=,tag:1oMrvTDE7GeGS7eFiZkBuA==,type:comment] -#ENC[AES256_GCM,data:+b7sZjD7+b6SgA==,iv:x6SjxKlIOSH6CgT7Yb9e31p4bHlPZuRJ9FBMKpir+3k=,tag:j8gk26rDYzMIr/zUM+tKDQ==,type:comment] -garage: - #ENC[AES256_GCM,data:Yx8PEnI/5OpHx6iVtE1oASzXSMJpEdgdX5V+5zUGDP6R1g==,iv:ggeiDdg3uzZKwRyw/yFFWg1ohxGbrHiSrhXbydhG10g=,tag:RrwmHXYdERfyh0JE1xEq0g==,type:comment] - rpc_secret: ENC[AES256_GCM,data:4pv/pkXGajsUxxcQ/qrn4S5rB1sVATgTlDK58aZmtR7vu777DhnMnC+kIYijKt/Sr/fKbbfcNnYHVx1XV0LnhA==,iv:WY+V7viT7LSoKLbEgjncyzih82zQvFjWlvDDpDEuwb0=,tag:Fd98GTbXnqYWw5Onh1BR6A==,type:str] - #ENC[AES256_GCM,data:Df0g74tf3/UB0jOq1tIwxzyipJ66ZVdt4Qe17kS4ou635wM0jTyxuqw0hIM=,iv:M91CxwA7PsUJse7sIwWEdF54a0o+ZuOyT5IS5UGaWdk=,tag:CrCbgoPh1dHCmC/BxaVBtw==,type:comment] - admin_token: ENC[AES256_GCM,data:RAftH7+QvGbGiY3V+COPFwsSiiqfcg3w0JTOgabLNujcK+6eXz25mveeSQd6kBe8wbZm3+nC21fq1Q3SRXo10w==,iv:1Hy9p6c+0N/pu8m+AevCcWQj2AwWtKcL9/W43R1XDn0=,tag:Aaj1vFWsBqhiyz0fdohokA==,type:str] - #ENC[AES256_GCM,data:Df0g74tf3/UB0jOq1tIwxzyipJ66ZVdt4Qe17kS4ou635wM0jTyxuqw0hIM=,iv:M91CxwA7PsUJse7sIwWEdF54a0o+ZuOyT5IS5UGaWdk=,tag:CrCbgoPh1dHCmC/BxaVBtw==,type:comment] - metrics_token: ENC[AES256_GCM,data:aMEA+JL+Dnd+S4v6ypA/eMocI1nOOHLvGrOtaKN0Vkx2U6c9EYnOZ09DfpPb4n+r9p0X/cOt09zW+ZSQEJqS7A==,iv:a5UUHkybp87dO0Gk6vbta9L5C4EbYZ3oRQS8ItlQILE=,tag:4HCPGq5+jmVsgpODBxefPg==,type:str] +#ENC[AES256_GCM,data:dzZsbdI=,iv:CR6RVtXEO7c81r5cOsanbem9jFAoj1jpOdYFB3n16Ik=,tag:bP2/jVzcDP39ioKrdVQf2g==,type:comment] +meow: ENC[AES256_GCM,data:7HTnsw==,iv:EZ87XxIfKrsz8m1pj69MoPeLh+S0CyW6Wmr4127ctoU=,tag:b5n3dJAgXAP6UE7D6k1Fuw==,type:bool] sops: age: - recipient: age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg @@ -18,8 +12,8 @@ sops: dUp2cU1wMU1Kd2J2cmlBMmlnbjVJV2sKkKx5nO2auold0qB6066aY1KXAjC2slna G+Cy8EcjgRh29w5RFRyx541jOGvtf+wuz11R1dUY1o/NHdn2wFhJTg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-29T17:40:50Z" - mac: ENC[AES256_GCM,data:c3vUBN3tku/Z3t7blgYqOHdMwfFOPpEz+VaXb9up2+RrdtMTdUJ20ixKPSOvmle4jIb3q8u6aIsRC1NNb6ZCheIRy5orDHEOvLKnNmTHAIx+UXC2sN0oqJl3bs/NQefVAr9fwPqwuMLEXZ64fKg1yowLpmNZgkb49Xj1tKlm9tk=,iv:ITV4UPdRo7jwCSFw3QUHAvLx6E74EeD5FAE+pqf6JYA=,tag:Kc33MOhklLYdqhjtHefKRQ==,type:str] + lastmodified: "2026-02-12T14:48:29Z" + mac: ENC[AES256_GCM,data:hKiqjg4at8pkPxG7qBYnHtHNBbEcb1DjWaQCc7MULoJAylTV4nEh5GvPRgaMg56zBE3rNCV7QHZbwD6jt1mC4N2Vybs98j0PBOkCDBSJQR6oSrikcS68CXpIJOA2LS6wuciQSJI4M5OILVGc7vlvXCrs/C8HynDh919JQVFfpAY=,iv:VINinyGPXLyYBnlPLLeTNUHAwpV5Rg9Jn73FxCJxZaE=,tag:TVh43nQQquii698YBCdlmg==,type:str] pgp: - created_at: "2025-12-19T16:08:52Z" enc: |- diff --git a/sops/secrets/postgres.sql b/modules/sops/vps/postgres.sql similarity index 70% rename from sops/secrets/postgres.sql rename to modules/sops/vps/postgres.sql index b303ee5..3385334 100644 --- a/sops/secrets/postgres.sql +++ b/modules/sops/vps/postgres.sql @@ -1,5 +1,5 @@ { - "data": "ENC[AES256_GCM,data:51QF5BtvJgkRYqTwTHVHZqLbNhcyBER8biszh1KGmzvzcJ56bFxxMmFXxb+kNDUeBqN4e3N29q9mCS6L6Powms4FqaI1bd0cUVhGsAhmmdYAqBQFHT+5I5Qh6vPxoZ8xlekFv6xSSaS9+k5xCldajm0Tsf2X0K14qjvvDS3QKf6o6bBQS0zEa6cNZFLqokJGxEPDbiw=,iv:8mZzroAJYRAbRxX3WOGTEcoIMmmASp9GVm+4E2/5NI0=,tag:qGOZauuZEKdSndi6Qys9lA==,type:str]", + "data": "ENC[AES256_GCM,data:Fdzo5TicNuQkpAM43ok+2GhGr4PEwwzYvzWKi3I92FBn7/Cs5t4BVHe3seAkqVLbpBthZlemrpjzmsa3ZiFCXOqNyTyYui/tdkhSRNwncFd6UUaDcaR+PkK3XIjZvKnqOaeFT6KZYqw8SSP5ajU7JHw4gPR485Bh2hCvvECnVig4obZm8XLeGAYI70btQurjz1F26QiiAXCBpTTOP7/N272pIH56lp26ZcEVJPbzwjZ7dfpAEbxxqbpovw==,iv:YJZvRAL3TW+7LihY7wgN0KLIMNAVub6m3qzKlEV3Fhg=,tag:vLv1V2AY49iJBf5QvEsoFQ==,type:str]", "sops": { "age": [ { @@ -7,8 +7,8 @@ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdVpaenUrYVpMeEpRZlBl\nTndhYmkvUEcxQWZ5UjZFUHFUcGpqMXdoZ2xFCkFLUmY4YlhRRTdIUmpQTzNPYSsz\nZ2JaZ0JTM3NHNWNwMHdiR2J2M1RRb1kKLS0tIERXbGtkRUlRSnFybExqYlVoQjVz\ndFdNQ0kxU3FMT0Y1ZnRhZkxWZWcrbEEK8hSNNXzhRXLrqEUHsXnPM6p+2ZynT/is\nLT+kR1IhJjuAB0uFjlGDtL19OsQdwb85TV79i2shQZIxwftqVwYoeg==\n-----END AGE ENCRYPTED FILE-----\n" } ], - "lastmodified": "2026-01-29T18:35:32Z", - "mac": "ENC[AES256_GCM,data:y/VHDvRfwUaGyHCAIvOFNisyRwJYxoMk3ThurJmzf9804rkwVHaQFSXfVKzE13YhidG8kpI+6ELkidNzaew65M+VhWlw5atwqhWouIEp+Fib6OIWvhpd1dOKlEJe10ByibcsOKk3tCP/+xnE2LHnYnd7Bliio4wRt9v5Tb2KLDY=,iv:xF9UWM4Jr9yFGFDOzAdgE0D8JIAgrykLXrF+vp3N/Ls=,tag:C9mdtos0DoSztvpnRU1mfw==,type:str]", + "lastmodified": "2026-02-03T13:26:20Z", + "mac": "ENC[AES256_GCM,data:NtWhYA2B4hfBHZMEZShWzaeWCGmFCmINV2jhe+fQ03OtPmRG4yVsN/MPOhreRbg69Fu6G81xRnWDa3+o+kFq/qb/oQzzxkfifEJXpD6i24zkF44ezOI6vu5sGVMCSSRo59NZ6lzI7H+IOv8ctlH4bF92O1m8ojmFqJ4dtpVBduQ=,iv:I+s5ukAPu6lpASLypmXO+RBqMIQBvaistcbV2Mi8VL8=,tag:zZ8BXwuMlLv/u+AbNivuuA==,type:str]", "pgp": [ { "created_at": "2026-01-29T17:28:29Z", diff --git a/modules/sops/vps/wireguard.key b/modules/sops/vps/wireguard.key new file mode 100644 index 0000000..779abc4 --- /dev/null +++ b/modules/sops/vps/wireguard.key @@ -0,0 +1,21 @@ +{ + "data": "ENC[AES256_GCM,data:RyUklSzCpA+PYuACvc0c0EdB9gAjjP2fdtMAFgzTD3sUK99DPZzqrGwGK2Ha,iv:BYJaC6VK3D/P7RZtrzoneOUvJMJ68aHYrTMGk63PGMA=,tag:CeVP/aFn3ZxO5LLrvE8iuQ==,type:str]", + "sops": { + "age": [ + { + "recipient": "age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWnp2NWw3SzRnZFVDNW9W\ncTkyRDVIcEZ3MEtIWW0xdnZLNmFSaDFQRUFvCkxIMldGRWtsOGlKRnhMNXpwSHpT\nbFgydnFHNHNGZW5vZGJQZG50QkgxaE0KLS0tIG1ZS0Q2R01wQ29sdnZmYUI2NWkz\nMFc0aWdabXB4WXduWFVzUjA4aGpkZGMKbJ4Q9k9jSNqGmdiaF9wZNdNO6ajOcnZs\n5nYFfq+6XcOyl073VQq/GTuHbVszEFLbKJxFedww5fm1wDurZ9T2EQ==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-08T01:42:44Z", + "mac": "ENC[AES256_GCM,data:W3+ZQFVUR/NCtLqWYUMmxbv1lnOiR8JclUdpitjgJRD6KmXUGvcEjv25SkZh9QfHuES3/giu88FpavYcITNGGQ8avOQAD2pfejNSJRAS9FBD1nCE0S1e3V03rXdlqbpmr9DTZar4ydWGUhNUrdzzv+ajVlYw/VoO7YQyFoEPSCc=,iv:XWsExRyNp1c/DcCkE2lv0Mj7hgY3OUvTBktA4gw4ViE=,tag:f+gNIFPutevzji67QYYrhQ==,type:str]", + "pgp": [ + { + "created_at": "2026-02-08T01:42:39Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ//RTwldlRKuKXTE8Uxq4yMp/uTJAwOzzRoYefJOjb+sRHZ\n2CJgD6cnIytozeP4By5HUINxyu8X6qHLAjWIrcA+BHpBrk4MA3MromMCFRbczKqD\nO5IHv5qHhg5ti0+jD1IOHLIsMc6YFZUVcaQeR3B1srBP/MgdNxnPZNgqsFF2qoTJ\nixpyvB24pjQbVFxJhLuzph/zfuHFk6kTnrgk7ChFAjX0vAyvgJDT5pBvpIHtjPfk\n8QuwJGVtVCnrnT1UDuRkWtOp7IUpXQzwknbaA/ApIXx/XABLUNRNnCrf0EHHLnGo\nkr0l6MpFngCFIceoygbjzY5f+Qg4fxAcNBf6zQ5Rvz3u4AnF5Yw2EgzxGUWyjl5H\niCksZJpmMvd30mDrj5Uq4wAq4055SP2MCyY2N8mjBFqlihJWYr7f4x+MXge/TXas\nngPPtETTvmji780FvLEiggy6ldCblHS8HYa1tTtfqXGC7AG3JJmLvSKEE7FWVtZ+\nV8ZDUKNz0qg6rEuNt03JA3e5MY671DoQW0ZR534OSsD24t+ZLF83epbtsEGq0ILc\nhVoJsCX2WjTfelWQ0geGMcZON9Z8RNjIDQ9gmkeuKR79iXcgql64kiJjUeXGx8+v\nwMBJcgalOpwmgydn+5OoHb6gUbe/0bYsSd1/HT31T5gaiwT3G9VnVxjkRd2vESHS\nXgEJb5tG4LLcDGbZMTbRJdJ95l+qvUmr7yNfosLQzke594ixXXMekonzKwY4B2uQ\nONZ67UHa9CY2pSv0hB8jcUm31XnyKwfFqmc0PtNF26Z/n5qLiPaK63wvtpMiD2Y=\n=8F5t\n-----END PGP MESSAGE-----", + "fp": "D40CE1579C09BFD7EF4AB7E631250420834310B5" + } + ], + "version": "3.11.0" + } +} diff --git a/modules/sops/vps/wireguard.pub b/modules/sops/vps/wireguard.pub new file mode 100644 index 0000000..edfbcbf --- /dev/null +++ b/modules/sops/vps/wireguard.pub @@ -0,0 +1,30 @@ +{ + "data": "ENC[AES256_GCM,data:B9eWxHa/tEtEU0zaKPjkQ3DMiFlJFcC7dloSaoUJteFFExQSK8mQjUSL70N+,iv:q0PwSQAlEkoZ5kXVradG0rChJcUuRjqQdDQDSVQWvRg=,tag:srGF8fH6qLW/cJ9nCwbsVQ==,type:str]", + "sops": { + "age": [ + { + "recipient": "age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtT1cvMUZQRlBLcmh3UzFS\nTDhySmd3N3p5MkNZN3ZORnBoT3pJd1ZoQzE4CjRsVjRIaXp2Qnl6VTFZN2F1UmxC\nWmpHTHpDcER6VS9nWGo0K1BkWTIwODAKLS0tIDNTZysvUjF2NC83a2VqK2x1cUFi\nMHZDbllsL0VKUjNFZjF5VG1LWWZqUGMKeeTgjarg1/cxs9CzuEzoDez6pEbdVXHk\n3nwYvh/2hMLe8XlNE0Xn1EhNdH1kjwI8wFkp7KGyCVdLIHu/aF1qfA==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1yjv3ngyz26qqggvef3ekwdw60dfvcmfd0l6n88vs3axux6vusdhsyzlts0", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxM1pXMy9EM1NaWXlzK3B0\nV0JmU0xrTFRPZTkyZ0xxUzBILzJlSzZzZXpvCm5FQTFsZXBtajluY2lGMDgrMnJt\nR01sdHJaQnRlZU1FT0l6Z0FWWjhzK28KLS0tIHppYU1GLzBEbXMzbG9oWTFWeEVn\nS2VjRDR0OTRMcE4wbXo4RjQ4UkJJWjgKREn0YQtKboqI3uVZC/NwpIVsD3xBXKm0\ng+iKHbA5w0g35v9o6onlhe64b/Qx38OPLXux1wzzBb436qLcWjk1lg==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1qqex87tl6kq68hszp66z49n95zurcxcvveumpxjvh5w2yhx8g47q5s24ya", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFV0h5V3JlQkx6Zm1RbEU4\nSVlkYXZuNG5mS2dzMlF1UFNLcjBpWmIzdHd3CjNCQXo0WGVGcUxTcEt2VCthU0RC\nUGtnRHVpSGwrT3h5VFlMUlhtL3JUQjAKLS0tIDF0UlFJdnUwaUh1b1F4RHFTaDkv\neFExQTNOZGZUSSt4c0pHZ0wxREF0ckEK+HlPhQliQwbCbbmg1Kkk1CxClJMx5em6\nibryd1pJES4KBllt+Ng2OB120UZz6bB4EjgEU86KODsKIwjJaRC1aw==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-08T01:58:36Z", + "mac": "ENC[AES256_GCM,data:gvm626g2HSA2ABdwsHbupJ9lqcIkOem+ban+GkkpTSCY9FxeuEKnr74Z8RIb3oQyG9bbAupobadMpW+Cs91xg72dnzhag5Lz6p3p7xKa8HMs2zwVTNrWzNPOLW9ffxhsYxWslk1guOHGwpZoabFqs8O9b/v3x+usXdVibygE6K0=,iv:guw/5tN6KGbZTCOWW4TnUHUgrODmlAVOHIfGb/5kB+A=,tag:VaVN6b2fyEwajtrrfTX2WA==,type:str]", + "pgp": [ + { + "created_at": "2026-02-08T02:54:14Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA09oKgMfawMUAQ//aE/V4HZGdbTTtU+eF5R07O/I91VJuOC2DoaX8mz9ktj7\nGjX6AdpXZ68DZ73CYqjROy8ol63tfXN/vEe2F5RY9jnxwGa6rcdkyMJoyzAjdnYs\nQnzd2BqcuFhK6p2Wde39QBoVHKzmPxsPtpK1ljui2uMDC0CXYBmh72nBkQGcSPcD\nZdm7Q6oWpNGi6pPM+1aoFCeWqoac5yo17nb7ZEu4/MCwyeNH38fR+qk1HKGhukPT\ntwtYgzQbbTvgGm+iM406JU3+3VKlP4OTVf9oe7K6b9XhGEVlnDFqbEmWFpnzGUM/\nvPwyx7WtAQFXnoYKNS8jzu1PXG8yg/oetx8sNqMZqAldyqQ33fFT2Gl7mdYK1ZH7\nk1E9B5CaS7ShW/B0thi+KYNlTOKYUVHdaFDSWSEYpijsdne7RXjusDrqGFfiNxDs\nvWRyl3LYQidjX8VCWaPaIJ/YGvBuJcfxIFb67+CGe07TurqYpUgbQFYLmEyop95b\nrerW80pp+rhQMD4Ro2mZVfVuXL/rvIe1IDEkqjvl0Rw+NmXsHajFP8AplL+J1RJB\nGxG7+Kn5sycsK2ouDXXYCnXSClUjEA0qy0LJ3kUwYcb4qX/MK7KzpKN6sdAb60/f\nq6VbG9/lqd0a8vkCQE7+S+OUJQBhdHHIlNAgCtC6uAVI2M5tCG4zvh5tdNAyAszS\nXgEJFf0HX8NjvK1A3irELFf51HiJ9UOwIhJWUvxhechbRiopX0mnNO4stNF1/FNi\nJtL/osH5BvUj5KKDLosI8nITaeD6M2CoUGlp3xpHPZgA4nQ3Eyoka76aDbepYXY=\n=f6Jv\n-----END PGP MESSAGE-----", + "fp": "D40CE1579C09BFD7EF4AB7E631250420834310B5" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.11.0" + } +} diff --git a/shell.nix b/shell.nix index 81c3515..766978f 100644 --- a/shell.nix +++ b/shell.nix @@ -1,11 +1,20 @@ let - sources = import ./npins; + sources = import ./modules/npins; pkgs = import sources.nixpkgs-stable { }; - wire = import sources.wire; + unstable_pkgs = import sources.nixpkgs-unstable { }; + # wire = import sources.wire; in pkgs.mkShell { + strictDeps = true; packages = [ - wire.packages.${builtins.currentSystem}.wire - pkgs.npins + # wire.packages.${builtins.currentSystem}.wire + unstable_pkgs.npins + pkgs.just ]; + + shellHook = '' + export NPINS_DIRECTORY="modules/npins" + + # export PS1="(dotfiles) $PS1" + ''; } diff --git a/sops/.sops.yaml b/sops/.sops.yaml deleted file mode 100644 index 8de5efa..0000000 --- a/sops/.sops.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# This example uses YAML anchors which allows reuse of multiple keys -# without having to repeat yourself. -# Also see https://github.com/Mic92/dotfiles/blob/d6114726d859df36ccaa32891c4963ae5717ef7f/nixos/.sops.yaml -# for a more complex example. -keys: - - &admin_snowyboo D40CE1579C09BFD7EF4AB7E631250420834310B5 - - &root_server age16e3uae0sktxmwzlmcdxwn07jpudtjl0s42hnwx2qsdh9h72gc5ssktkazg -creation_rules: - - path_regex: secrets/* - key_groups: - - pgp: - - *admin_snowyboo - age: - - *root_server diff --git a/sops/default.nix b/sops/default.nix deleted file mode 100644 index 686d834..0000000 --- a/sops/default.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ - # config, - # lib, - # pkgs, - args, - ... -}: - -{ - imports = [ - # Nix secrets hehe :3 - args.flakes.sops-nix.nixosModules.sops - ]; - - sops = { - defaultSopsFile = ./secrets/example.yaml; - - age = { - keyFile = "/root/.config/sops/age/keys.txt"; - generateKey = false; - }; - - secrets = { - "garage/rpc_secret" = { - mode = "0440"; - group = "sops_garage"; - }; - - "garage/admin_token" = { - mode = "0440"; - group = "sops_garage"; - }; - - "garage/metrics_token" = { - mode = "0440"; - group = "sops_garage"; - }; - - postgres_sql = { - format = "binary"; - sopsFile = ./secrets/postgres.sql; - - mode = "0400"; - owner = "postgres"; - }; - }; - }; - - users.groups = { - sops_garage = { }; - }; - - systemd.services = { - garage.serviceConfig.SupplementaryGroups = [ - "sops_garage" - ]; - }; -}