diff --git a/.direnv/flake-profile b/.direnv/flake-profile new file mode 120000 index 0000000..e289079 --- /dev/null +++ b/.direnv/flake-profile @@ -0,0 +1 @@ +flake-profile-4-link \ No newline at end of file diff --git a/.direnv/flake-profile-4-link b/.direnv/flake-profile-4-link new file mode 120000 index 0000000..a9ec7f1 --- /dev/null +++ b/.direnv/flake-profile-4-link @@ -0,0 +1 @@ +/nix/store/zy91ych2gdxkiz4qjljs5ykq1jj41nin-nix-shell-env \ No newline at end of file diff --git a/.envrc b/.envrc new file mode 100644 index 0000000..3550a30 --- /dev/null +++ b/.envrc @@ -0,0 +1 @@ +use flake diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..74f0c8b --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,10 @@ +keys: + - &admin_reboot 183892CF4E46CB3DF7D2242E60DF5E67E1746DA7 + - &workstation_custom-odin-nixos age1te8c7w69nxj6pqjlewacn35as7vktqhepmsh0fc74afxv20yjqtqrp2rrn +creation_rules: + - path_regex: secrets\.(yaml|json|env|ini)$ + key_groups: + - pgp: + - *admin_reboot + age: + - *workstation_custom-odin-nixos diff --git a/common/home/packages/dev.nix b/common/home/packages/dev.nix index 62e401c..2f2fe17 100644 --- a/common/home/packages/dev.nix +++ b/common/home/packages/dev.nix @@ -1,4 +1,5 @@ -{ pkgs, pkgs-stable, ... }: let +{ pkgs, pkgs-stable, ... }: +let unstable = with pkgs; [ # Dev vscode @@ -24,10 +25,13 @@ git godot_4 android-studio - androidStudioPackages.canary + androidStudioPackages.canary android-tools pipx - (python313.withPackages (ps: [ ps.rpyc ps.tkinter ])) + (python313.withPackages (ps: [ + ps.rpyc + ps.tkinter + ])) filezilla powershell fzf @@ -50,11 +54,13 @@ pods forge-sparks nixd - crc - qtcreator - # kdePackages.full - vrc-get - alcom + crc + qtcreator + # kdePackages.full + vrc-get + alcom + sops + rops ]; stable = with pkgs-stable; [ @@ -67,14 +73,23 @@ # stuff to make MC modding work. postBuild = '' wrapProgram $out/bin/idea-community \ - --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [libpulseaudio libGL glfw openal stdenv.cc.cc.lib]}" + --prefix LD_LIBRARY_PATH : "${ + lib.makeLibraryPath [ + libpulseaudio + libGL + glfw + openal + stdenv.cc.cc.lib + ] + }" ''; }) # vagrant renpy - unityhub + unityhub ]; -in { +in +{ packages = unstable ++ stable; } diff --git a/flake.lock b/flake.lock index 99e4c42..9baa72c 100644 --- a/flake.lock +++ b/flake.lock @@ -621,7 +621,8 @@ "nixpkgs-xr": "nixpkgs-xr", "nur": "nur", "pwndbg": "pwndbg", - "rust-overlay": "rust-overlay_3" + "rust-overlay": "rust-overlay_3", + "sops-nix": "sops-nix" } }, "rust-overlay": { @@ -683,6 +684,26 @@ "type": "github" } }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1776119890, + "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1681028828, diff --git a/flake.nix b/flake.nix index b41cb9b..1b52473 100755 --- a/flake.nix +++ b/flake.nix @@ -63,6 +63,11 @@ nixpkgs-xr.url = "github:nix-community/nixpkgs-xr"; distro-grub-themes.url = "github:AdisonCavani/distro-grub-themes"; + + sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = @@ -82,7 +87,12 @@ nix-index-database, nixpkgs-xr, distro-grub-themes, + sops-nix, }: + let + system = "x86_64-linux"; + pkgs = import nixpkgs { inherit system; }; + in { nixosConfigurations = import ./nixos { inherit @@ -100,6 +110,7 @@ nix-index-database nixpkgs-xr distro-grub-themes + sops-nix ; }; @@ -118,7 +129,26 @@ pwndbg nix-index-database nixpkgs-xr + sops-nix ; }; + + # Because declarative secrets tracking is annoying w/o devshell... + devShells.${system}.default = pkgs.mkShell { + # imports all files ending in .asc/.gpg + sopsPGPKeyDirs = [ + "${toString ./.}/keys/hosts" + "${toString ./.}/keys/users" + ]; + + sopsAgeKeyDirs = [ + "/etc/ssh/ssh_host_ed25519_key.pub" + ]; + + # adds the customized sops to the path + nativeBuildInputs = [ + (pkgs.callPackage sops-nix { }).sops-import-keys-hook + ]; + }; }; } diff --git a/home-manager.nix b/home-manager.nix index db4435a..64f4521 100644 --- a/home-manager.nix +++ b/home-manager.nix @@ -1,4 +1,5 @@ -{ nixpkgs, nixpkgs-stable, home-manager, flatpaks, rust-overlay, nur, chaotic, aagl, nixGL, ... }: let +{ nixpkgs, home-manager, ... }: +let defaultDesktop = { username = "reboot"; system = "x86_64-linux"; @@ -6,11 +7,12 @@ }; hostConfig = defaultDesktop; -in { +in +{ "${hostConfig.username}" = home-manager.lib.homeManagerConfiguration rec { pkgs = nixpkgs.legacyPackages."${hostConfig.system}"; modules = [ ../common/home ]; }; -} \ No newline at end of file +} diff --git a/keys/hosts/.gitkeep b/keys/hosts/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/keys/users/.gitkeep b/keys/users/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/nixos/custom-odin-nixos/configuration.nix b/nixos/custom-odin-nixos/configuration.nix index bacdada..541acea 100755 --- a/nixos/custom-odin-nixos/configuration.nix +++ b/nixos/custom-odin-nixos/configuration.nix @@ -32,6 +32,21 @@ in ./hardware-configuration.nix # Include the results of the hardware scan. ]; + sops = { + defaultSopsFile = ../../secrets.yaml; + + age = { + # This will automatically import SSH keys as age keys + sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + # This is using an age key that is expected to already be in the filesystem + keyFile = "/var/lib/sops-nix/key.txt"; + # This will generate a new key if the key specified above does not exist + generateKey = true; + }; + + secrets."logins/servers/zimaos/cifs" = { }; + }; + boot = { loader = { efi = { @@ -645,6 +660,8 @@ in nixpkgs-manual wl-clipboard gnupg + sops + rops libnotify appimage-run xhost @@ -689,7 +706,7 @@ in sshfs exfat ntfs3g - cifs-utils + cifs-utils mtpfs libimobiledevice ifuse diff --git a/nixos/custom-odin-nixos/hardware-configuration.nix b/nixos/custom-odin-nixos/hardware-configuration.nix index c0591b2..f9438a1 100755 --- a/nixos/custom-odin-nixos/hardware-configuration.nix +++ b/nixos/custom-odin-nixos/hardware-configuration.nix @@ -77,11 +77,19 @@ options = [ "subvol=swap,noatime" ]; }; - #fileSystems."/dev/pts" = { - # fsType = "devpts"; - # device = "devpts"; - # options = [ "gid=5,mode=620" ]; - #}; + fileSystems."/data/ZimaOS" = { + device = "//192.168.0.201/ZimaOS-HD"; + fsType = "cifs"; + + options = [ + "credentials=/run/secrets/logins/servers/zimaos/cifs" + "vers=3.0" + "_netdev" + "nofail" + "uid=1000" + "gid=1000" + ]; + }; fileSystems."/srv/win11/pipewire-0" = { device = "/run/user/1000/pipewire-0"; diff --git a/nixos/default.nix b/nixos/default.nix index 9df97d4..de24205 100644 --- a/nixos/default.nix +++ b/nixos/default.nix @@ -13,6 +13,7 @@ nix-index-database, nixpkgs-xr, distro-grub-themes, + sops-nix, ... }: let @@ -70,6 +71,7 @@ in nix-index-database nixpkgs-xr distro-grub-themes + sops-nix ; }; @@ -81,6 +83,7 @@ in chaotic.nixosModules.default nix-index-database.nixosModules.nix-index nixpkgs-xr.nixosModules.nixpkgs-xr + sops-nix.nixosModules.sops { networking.hostName = "${hostname}"; # Define your hostname. @@ -95,7 +98,12 @@ in #! IMPORTANT: Any custom package inputs **need** to be placed here as well if they should be used by home-manager! extraSpecialArgs = { - inherit pkgs-stable pwndbg nixpkgs-xr; + inherit + pkgs-stable + pwndbg + nixpkgs-xr + sops-nix + ; }; }; } diff --git a/nixos/latitude7390-loki-nixos/configuration.nix b/nixos/latitude7390-loki-nixos/configuration.nix index 90d9411..8f2afc9 100755 --- a/nixos/latitude7390-loki-nixos/configuration.nix +++ b/nixos/latitude7390-loki-nixos/configuration.nix @@ -412,6 +412,8 @@ nixpkgs-manual wl-clipboard gnupg + sops + rops libnotify appimage-run xhost @@ -456,7 +458,7 @@ sshfs exfat ntfs3g - cifs-utils + cifs-utils mtpfs libimobiledevice ifuse diff --git a/nixos/minisforum-valkyrie-2-nixos.cloud.reboot-codes.com/configuration.nix b/nixos/minisforum-valkyrie-2-nixos.cloud.reboot-codes.com/configuration.nix index 9e33ad1..f8df371 100755 --- a/nixos/minisforum-valkyrie-2-nixos.cloud.reboot-codes.com/configuration.nix +++ b/nixos/minisforum-valkyrie-2-nixos.cloud.reboot-codes.com/configuration.nix @@ -500,6 +500,8 @@ nixpkgs-manual wl-clipboard gnupg + sops + rops libnotify appimage-run xhost diff --git a/nixos/temp-installer-nixos/configuration.nix b/nixos/temp-installer-nixos/configuration.nix index dbf49da..2887eee 100644 --- a/nixos/temp-installer-nixos/configuration.nix +++ b/nixos/temp-installer-nixos/configuration.nix @@ -111,6 +111,8 @@ bash wl-clipboard gnupg + sops + rops libnotify appimage-run xhost @@ -135,7 +137,7 @@ sshfs exfat ntfs3g - cifs-utils + cifs-utils mtpfs links2 alacritty diff --git a/secrets.yaml b/secrets.yaml new file mode 100644 index 0000000..9f3fcf8 --- /dev/null +++ b/secrets.yaml @@ -0,0 +1,51 @@ +logins: + servers: + zimaos: + cifs: ENC[AES256_GCM,data:UlU8GflKbgwPZoveQLvbWQdmrRyhlueLujySKE9TPiMjwY/LRA==,iv:WynEH27KhZD9CHjLhwKGnYc9MYX63n685YaXYm796wQ=,tag:Qj20+TNLH60olvVOg/T1nw==,type:str] +sops: + age: + - recipient: age1te8c7w69nxj6pqjlewacn35as7vktqhepmsh0fc74afxv20yjqtqrp2rrn + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSV01YQjZaTUhvRlEraHNU + VlJ5WmtxSnRoZjdaMldpN25kRnpPL09xQ2dnCm85MENGZExESGQ4TEhRT0ZKM1Ev + N2o3STd6dnRlMDh6c3dmQTFVdWhLZjAKLS0tIGNGSFhiV0ltODBtRUxiT3ltL3ZE + cUt1S2c1dkNBVmFaTGtrVFNDZzcrem8K2PNPp7X+z40NxMJlaZhvfmvRV/mabKpo + hT60VP+GVIKtEgfYxW5GE5y/lVR42Ps67GZyD5H6B0qpaqU779a6hg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-04-20T01:51:35Z" + mac: ENC[AES256_GCM,data:+0ULPf7P5p3YiLY+yuEIVRCzlylG9BAr2b5dXMAP9UrNn1v6HgVVjZHKqIR3ry2UM4xp7cTm4knEnXgDVU4tMprUD0dymqgp1q/6S2zsjy1AoSXPHGhr9ae+u8u4DhszrLYqzYCGAVmzO1O7N95gsUawG1IK8EF14Fiuv4kgG7k=,iv:9GKpSpjk59R56whk2V6zBKtKGIEcraDsR5QVTcM3/4E=,tag:P/vGUxJLUgc2sWGyqwqqGA==,type:str] + pgp: + - created_at: "2026-04-20T01:49:57Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA3TC8Y85cf60AQ/9GhSnuvHUyfVc1YBSH81lG2/Nc8gHGMxkz/xwS2samXK6 + 6/7AUweEBqbZAHpfpX5E0buMlrFM5Mro94o4cUrWM5rhaR4BMYkFRo/XEcQt4cmg + LPXfl1UuVT9FmnflrJvPu2JMm/EPeE2S7+3J7cHgfyd/zxSnxxQOKxCNsrO0Xlk+ + 4uXpB25E7l80uGGWSIYf6xthg4eN3YgvrdFnxG2j1Q/YdhGetlWFWcZV1uz+sp4J + ANHonPpok0disB6SPg+9BEKU1xbjQwiXBhGP0MFMHKNjIrcH97+/CLkJH2c1tLbN + est8h2Z+NlyeVxlSIc9pt3cKnSIVThr0X0UrF31366Ex0dRP8wIOPI2ZhnQOj3sA + 3NY5hC3EEZcnYO6fWWmiPlvBqaD57pmm6ML7t0OC0CksYlJnKGH5U59yO6XVrage + qUisDxivIEER399pY9ew7pgwLBiiNM+kORIGhpeyEtJcSFiuC8uhqauX76gkhPOR + MNPt4jxDcpbII5xsEsKwpW749NC85pTCD4KLpweS1QpJmPW5Jy8y0Vb3AstrTFah + iSEniuWRsQ6IOec77krqWMpSClsHaKU/tyQMHgpPoSYL3cT4W0cTocIguN62h5pW + Yzfe6Z2GAuhnFW6hVAcm8b/dcMiAwki27FWZ76ztLTNZwBI0xg23jvKEyi3TnbaF + AgwDz9do6UbeSzQBD/9zEIsDiqQBReNk4q4Nrl/oHy1+zsC9eeZchXx0EZHc31BB + 4aebsC0gOvWaqeJdxlAa/dWaNIzD2FgcamLd+Qrf965+6p4/8SS/svYXqiUVwNRr + QbXxFx3PjOkxuBKtoa6aXARQBEnRh2JTa0727Pt0cjjRvzw9AkVPlTknjsOuUcvg + E9e/+ju+V/zWFCUJvo71XhHtcPh4Q5xhXJ7lKVPqeDEkUmtLt7Wi8ynB7rXouUV2 + sIN81wiJfLfZUe6o+CMFEybXdbYkkyD/1bbBJaZuyh4c2DvnAgITRUVqUuJX4wyt + 4A+ZziFN4C3k/Vp/NRcTQLswgQkqHTQKMdz4XWLUbARKJ3Qm0NZOfAdud0OMKdGR + HSIy3bxegLwNfIChP/0jRpeO7OHpiyAgPfbFrjfAlEyZ+7+6KuOB9E6BOZ9KDFKy + JD4rDephUluCR4JQtxnRXjs8xHyntUpvdalyaZM4mLxK6FnCTJq0SRQrgS6PnplO + GEovXXADH4Jvgbxo+JH3FlRnTDR0OIC/0av/TPgZVl1R9M3XRyh7+LubhwZmiksH + nWbdQCuoHHrOQCLK/9C48Go6Eh9gM8UQN/y5qQmcf2ZLAaiK+3deknN+KwAT6zHM + T2QXiYTE6rWumdHtCAcAehSTdCkeY9eIvv9n2p41bJsFGSgTZHJdAkL9x76m0tJe + AfCmnH/9vYH2BcvD0pGXbs6dWz8OZJye1SxD2Nc+ELTAdupuNJSRMkcg/P1Y4WGu + tiJeaMlsPYtmkbE+FCuEsi58z0DaLTTVvcdziRFMs8xypC4+6bQBbvqS8AkxFg== + =UQuR + -----END PGP MESSAGE----- + fp: 183892CF4E46CB3DF7D2242E60DF5E67E1746DA7 + unencrypted_suffix: _unencrypted + version: 3.12.2